1

I have installed https://github.com/Nyr/openvpn-install onto my dedicated machine, and I need to lock down SSH connections to this system. I have attempted to configure /etc/ssh/sshd_config with the Listen Address: 10.8.0.1 address and ListenAddress 10.8.0.0 but unfortunately this does lock down the connection, but I am unable to connect after the VPN is enabled. Unfortunately it throws Connection Refused with SSH connections.

This is the top configuration of my OVPN file, please let me know what I need to edit so I A: Get the VPN to work (It does work and connects sucessfully, but not routing traffic through it I believe, which is why it will not allow me to connect (Basically forcing my connection via the server I think, not too sure though if that's the cause)) and B: Have I got the ListenAddress configured correctly? Which IP do I need to allow? .1 or .0 on the 10.8.0.x address. If I get this correct, I just need to fix the VPN file, and then we are good to connect basically and lock it down to VPN authentication.

Server IP Configuration: (Configured By OVPN I presume) https://jasmeow.pics/CKF7TX.png

dev tun
proto udp
remote <IPREDACTED> <PORTREDACTED>
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
ignore-unknown-option block-outside-dns
block-outside-dns
verb 3
<ca>```
4
  • What exactly do you mean by "locking down SSH"? You want to be able to connect to the RW system using SSH only through the VPN? You want RW to only be able to connect to the VPN server through VPN? Anyway, in both cases you will not achieve this by setting the address where SSH is listening. Binding to some address doesn't limit the source of the connection to be behind that interface. Use a firewall properly for that. Sep 22, 2022 at 11:16
  • Something made me thinking that you believe this ListenAddress directive limits the source of the connection to that address. It doesn't, this is absolutely different thing. Sep 22, 2022 at 11:22
  • Hi Guys - What I mean is I would like to do is basically lock down SSH by connecting first the RW VPN connection, it connects, then I can then SSH into the system. If I don't use the VPN, no connection to the dedicated server via SSH, simple right? What do I do to get this sorted properly? Oct 1, 2022 at 22:25
  • I want to limit the connection to only be allowed via VPN. I can setup the firewall to block SSH connections except from the VPN IP, but how do I do this successfully? How do I allow SSH authentication from only the VPN's IP address is what I am asking. I believed the ListenAddress directive limits the source of the connection, yes, but it seems that's not the case, and thank you for pointing that out to me Nikita. Oct 1, 2022 at 22:25

1 Answer 1

0

If using legacy IPTables, you may use rule like this:

iptables -I INPUT 1 ! -s 10.8.0.0/24 -p tcp --dport 22 -j REJECT

With modern NFTables, you have to use something like this one:

nft insert rule ip filter INPUT ip saddr != 10.8.0.0/24 tcp dport 22 counter reject

(provided that you already instantiated a table filter of type inet and chain INPUT in it).

This is quite generic low-level, and won't persist. To have this to survive the reboot, you need to use some firewall configuration manager; in Debian I usually installed the netfilter-persistent and iptables-persistent. In case you already have firewall manager (firewalld, ufw and so on), you need to use the methods corresponding to these managers instead.


Also notice that SSH itself is no less secure than VPN if properly configured. By proper configuration I mean configuring the RSA/ECDSA/etc. key authentication (which is usually already configured by default, you only need to generate and install keys), and then disabling the password authentication in SSH:

PubkeyAuthentication yes
PasswordAuthentication no

Such setup is much convenient to use and also much simpler than VPN+firewall, but no less secure. Also it is harder to misconfigure. Consider this approach.

1
  • Thank you for this, this does really help. What about UFW? SSH Keys are enabled - Rest assured about that. Oct 3, 2022 at 10:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .