Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to lock down my VPS but still allow PPTP-VPN access and am running into a snag. Hoping someone may be able to offer input. Basically trying to figure out what part of my iptables is preventing multiple clients from tunneling out into the web. My iptables are currently set to the following.

*filter

#  Allow all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT

#  Accept all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#  Allow all outbound traffic - you can modify this to only allow certain traffic
-A OUTPUT -j ACCEPT

#  Allow PPTP connection.
-A INPUT -p tcp --dport 1723 -j ACCEPT
-A INPUT -p 47 -j ACCEPT

# Allow Tunneling
-A FORWARD -i ppp0 -o venet0 -j ACCEPT
-A FORWARD -i venet0 -o ppp0 -j ACCEPT

#  Allow SSH connections
#
#  The -dport number should be the same port number you set in sshd_config
#
-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT

#  Allow ping
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT

#  Log iptables denied calls
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

#  Reject all other inbound - default deny unless explicitly allowed policy
-A INPUT -j REJECT
-A FORWARD -j REJECT

COMMIT

I basically modified the suggested iptables settings from this article http://library.linode.com/securing-your-server#sph_creating-a-firewall

Then adding the following code to /etc/rc.local allows all traffic to be forwarded and I'm able to access the web through my VPN, but it is limited to only one client. All other clients can't tunnel.

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source x.x.x.x

If I reset the iptables and run the following ONLY, then all clients are able to tunnel out.

iptables -t nat -A POSTROUTING -j SNAT --to-source x.x.x.x

Any advice from someone who understands iptables would be greatly appreciated!

share|improve this question
    
Figured it out. It was so glaringly obvious too. Need to change ppp0 to ppp+ –  filmoreha Jun 14 '12 at 1:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.