How to properly configure the firewall for OpenVPN?
Solved
narsene -
Hello everyone,
I have an OpenVPN server installed on a virtual machine running Ubuntu Server 22.04 LTS. When I connect to it, I am able to access other hosts on the local network on the server side.
How can I configure the firewall to restrict access to only internal resources and block access to hosts present on the network as well as the gateway?
I am not an expert in firewalls. I searched on the Internet but could not find exactly what I was looking for.
However, many questions are about blocking Internet access on the server side and restricting access to hosts on the local network only.
What I am looking for is the opposite. I found a discussion (in English) https://serverfault.com/questions/250927/how-do-i-block-access-to-lan-through-openvpn/250948#250948 regarding what I am trying to do.
By adjusting the syntax parameters to match my network configuration, I manage to restrict access to other hosts on the server side, but this also blocks Internet access at the same time.
If anyone knows how to proceed correctly, please share with me and those looking for the same solution.
Best regards,
Guillaume
2 answers
-
Hello,
Considering that:
- VPN clients are in the 10.8.0.0/24 network
- The server-side LAN is 192.168.1.0/24
It is then sufficient to write a rule blocking packets "from 10.8.0.0/24 to 192.168.1.0/24".
I leave it to you to translate this into an iptables rule.
If it doesn't work, you can share all your active rules, which you can obtain with "iptables -S".
If you need a complete reference:
https://www.frozentux.net/iptables-tutorial/iptables-tutorial.html-
Hello,
I consulted the tutorial from the link and I don’t really understand how to do it, I’m terrible with firewalls. Under no circumstances do I want to break my system because I don’t know what I’m doing.
That’s why I’m asking you if it’s possible to show me the iptables rule that I need to implement. I would really appreciate it.
I don’t want to try just anything without knowing the outcome.
Thank you,
Guillaume
-
Hello,
I want to break my system because I don't know what I'm doing.
The iptables rules added from the "iptables" tool are not permanent. In case of an error, you just need to restart your system.
Once the rule is validated, you will have to make it permanent. During the installation of OpenVPN, you must have certainly configured somewhere a list of iptables rules that apply at system or OpenVPN server startup.
You will find examples close to what you need here:
https://www.cyberciti.biz/faq/how-to-use-iptables-with-multiple-source-destination-ips-addresses/ -
Hello,
I'm trying this:
iptables -A INPUT -s 10.8.0.0/24 -d 192.168.2.0/24 -p tcp --dport 8006 -j DROPbut what is on port 8006 still loads.
This is the end of /etc/ufw/before.rules
# START OPENVPN RULES # NAT table rules *nat :POSTROUTING ACCEPT [0:0] # Allow traffic from OpenVPN client to eth0 (change to the interface you discovered!) -A POSTROUTING -s 10.8.0.0/8 -o ens18 -j MASQUERADE COMMIT # END OPENVPN RULESGuillaume
-
Hello,
Ideally, your firewall should also control the redirections between interfaces in the "filter" table. Also, the order of the rules is important; if a packet is accepted (-j ACCEPT) by a rule, the following rules will not be considered.
You can use "-I" instead of "-A" to insert a rule above the others, or specify its number.
This should work if "tun0" is the OpenVPN interface on the server:
sudo iptables -I FORWARD -i tun0 -p tcp --dport 8006 -j REJECT
-
Hello,
The first rule is simply invalid; what is "192.168.2.2" doing after DROP?
And yes, you can block based on the destination IP; in that case, there's no need to load the TCP matches.
-
