0

I want to estable a openVPN connection on one of my computers. But I want to make sure that the connection is secure by filtering everything except for openVPN. Therefore openVPN will be the only way to access the internet.

What would be the best way to do this? iptables?

Secure in the way that if there is no openVPN connection, there is no access to the internet.

3
  • 1
    Why by mac address? Why not just block everything through your firewall except connections to the OpenVPN server?
    – Zoredache
    Apr 2, 2013 at 18:13
  • for example, this would be for a torrent box. my ISP is anti torrent, its easy to get a notification within minutes if torrenting without VPN and end up paying a fine. So I suppose this is best done on the router side? or it could be done client side, but if I ever format I'd have to reconfigure.
    – trizuken
    Apr 2, 2013 at 20:02
  • You could always simply remove your default gateway on the client machine, and add a static route for the VPM server address only.
    – Zoredache
    Apr 2, 2013 at 20:21

1 Answer 1

1

VPN connections are secure "by definition". Otherwise you would not call it a VPN. Security is reached by crypto keys. Looking at MAC addresses in this context does not make sense.

It is not clear what the connection shall look like but I assume that no routing is intended. So you need at least four rules in your firewall (for the physical interface, say eth0):

iptables -P OUTPUT DROP
iptables -A OUTPUT -o eth0 -d $OPENVPN_DESTIP -j ACCEPT
iptables -P INPUT DROP
iptables -A INPUT -i eth0 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Furthermore you need rules for the VPN interface, say tun0:

iptables -A OUTPUT -o tun0 -j ACCEPT
iptables -A INPUT -i tun0 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Not the answer you're looking for? Browse other questions tagged .