Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have OpenVPN running on a Linux machine. The VPN server has a public IP address (x.x.x.x) and the VPN clients are assigned addresses on the "tun" device in 10.8.0.0\24. I have an IPTables rule to NAT masquerade 10.8.0.0\24 onto the public IP address.

To get the VPN server running, I had to enable IP forwarding (so I set net.ipv4.conf.default.forwarding=1).

... In other words, it's exactly what the OpenVPN tutorial says to do, with no fancy tricks.

This all works, but I'm worried about the enabling forwarding part. I think the machine will now forward packets from any IP address to any IP address, which doesn't seem suitable. Since it has a publicly accessible IP, this is particularly bad.

Are there any firewall rule suggestions to restrict the unwanted forwarding behaviour? I think any answer will be one or more IPTables rules in the FORWARD chain, but this is where I've got stuck.

thanks!

share|improve this question

2 Answers 2

up vote 2 down vote accepted

If you use these rules for forwarding table, you should be fine.

-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.8.0.0/24 -j ACCEPT
-A FORWARD -j REJECT

You can put the rules in file /etc/sysconfig/iptables and restart firewall. For command line trial first do

 iptables -F

to remove the default rejection of forwarding traffic and add 'iptables ' before each of the above three rules.

share|improve this answer

Here's a subset of what I've got set up on my openvpn gateway:

iptables -A FORWARD -i tun0 -o tun0 -j ACCEPT # vpn to vpn
iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT # vpn to ethernet
iptables -A FORWARD -i eth0 -o tun0 -j ACCEPT # ethernet to vpn

Note that this is just a subset; the rest of the rule do standard NAT things.

share|improve this answer
    
I think this wont restrict unwanted forwarding behavior and connection from public IP address can be initiated towards towards hosts behind VPN. The machine with public IP address would have been configured with routing to send replies to internal machines. Now if someone sends packets to public interface with destination as intranet IP packets can go till hosts behind VPN tunnel. If this VPN tunnel is also default route for hosts so that they can send packets to Internet directly then even a connection can be established from outside to inside. Please review rules once. –  Saurabh Barjatiya Jul 11 '09 at 14:00
    
Since you already have such setup it should not be that hard to test whether my suspicion is correct or not. –  Saurabh Barjatiya Jul 11 '09 at 14:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.