Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to restrict all traffic from my ubuntu-machine to come or go from the local network (eth0) or from or to my VPN (tun0). It should be possible to connect the router in the local network but not possible to leave the local network not using the VPN.

Since i have no experience with iptables and i couldn't find some how-to i tried ufw but i did not succeed.

Thank you for some hints or code snippets how to come closer!

share|improve this question

1 Answer 1

You will want to operate on the filter table's INPUT chain with a default action of DROP, and then set ACCEPT rules for packets incoming (-i) on each interface. To improve security, you could also enforce the subnet of the source host, but the rules below will suffice.

iptables -t filter -p INPUT DROP
iptables -t filter -A INPUT -i eth0 -j ACCEPT
iptables -t filter -A INPUT -i tun0 -j ACCEPT
iptables -t filter -A INPUT -i lo -j ACCEPT

If you also want to enforce the same thing for traffic leaving the host, also do these:

iptables -t filter -p OUTPUT DROP
iptables -t filter -A OUTPUT -o eth0 -j ACCEPT
iptables -t filter -A OUTPUT -o tun0 -j ACCEPT
iptables -t filter -A OUTPUT -o lo -j ACCEPT

Though, if you do this, you really may as well not have the other interfaces. Also, lo is in there because it is the loopback interface; without those rules loopback would no longer work.

Note that if your host is a router, these rules will not apply to traffic it is routing (only to traffic it generates itself or that is destined to it rather than through it).

share|improve this answer
    
Thank you for your help! I got an error for your first line iptables -t filter -p INPUT DROP and it seemed the it should be iptables -t filter -P INPUT DROP. But after executing this (changed) line, traffic to this machine is interrupted :) How should i execute this commands to not lose my ssh-connection? –  Piezo Pea Aug 27 '12 at 10:11
    
I updated my question since i was a little unclear. - i think i have to restrict the traffic to the subnet of my machine and to the VPN. @falcon-momot can you help again? –  Piezo Pea Aug 27 '12 at 20:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.