0

I followed the guide here: https://gist.github.com/GAS85/4e40ece16ffa748e7138b9aa4c37ca52

I've added a couple more rules for local traffic, but my setup is still leaking udp packets, on ports not specifically allowed by my firewall (6881), to the standard network and not properly directing the traffic through to the VPN.

# Generated by iptables-save v1.8.7 on Tue Mar 28 08:17:46 2023
*mangle
:PREROUTING ACCEPT [815888:3446674394]
:INPUT ACCEPT [815869:3446672358]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [291767:5488397080]
:POSTROUTING ACCEPT [291835:5488406564]
-A OUTPUT -j CONNMARK --restore-mark --nfmask 0xffffffff --ctmask 0xffffffff
-A OUTPUT ! -d 192.168.50.13/32 -m owner --uid-owner 1050 -j MARK --set-xmark 0x1/0xffffffff
-A OUTPUT -d 192.168.50.13/32 -p udp -m udp --dport 53 -m owner --uid-owner 1050 -j MARK --set-xmark 0x1/0xffffffff
-A OUTPUT -d 192.168.50.13/32 -p tcp -m tcp --dport 53 -m owner --uid-owner 1050 -j MARK --set-xmark 0x1/0xffffffff
-A OUTPUT -s 192.168.50.13/32 -p tcp -m tcp -m multiport --sports 6800,58846 -m owner --uid-owner 1050 -j MARK --set-xmark 0x0/0xffffffff
-A OUTPUT ! -s 192.168.50.13/32 -j MARK --set-xmark 0x1/0xffffffff
-A OUTPUT -j CONNMARK --save-mark --nfmask 0xffffffff --ctmask 0xffffffff
COMMIT
# Completed on Tue Mar 28 08:17:47 2023
# Generated by iptables-save v1.8.7 on Tue Mar 28 08:17:47 2023
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i tun0 -m conntrack --ctstate ESTABLISHED -j ACCEPT
-A INPUT -i tun0 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --sport 53 -j ACCEPT
-A INPUT -p udp -m udp --sport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 58846 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 7878 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8989 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 111 -m state --state ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --sport 2049 -m state --state ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --sport 4045 -m state --state ESTABLISHED -j ACCEPT
-A INPUT -p udp -m udp --sport 1110 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -o lo -m owner --uid-owner 1050 -j ACCEPT
-A OUTPUT -o tun0 -m owner --uid-owner 1050 -j ACCEPT
-A OUTPUT ! -s 192.168.50.13/32 -o ens3 -j REJECT --reject-with icmp-port-unreachable
-A OUTPUT -p tcp -m tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 58846 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 7878 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 8989 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 111 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 2049 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 4045 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 1110 -j ACCEPT
COMMIT
# Completed on Tue Mar 28 08:17:47 2023
# Generated by iptables-save v1.8.7 on Tue Mar 28 08:17:47 2023
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o tun0 -j MASQUERADE
COMMIT
# Completed on Tue Mar 28 08:17:47 2023

This is really strange, because testing using TCP as user 1050 results in correct behavior. All tcp traffic is passed through to the VPN and not the standard network.So why is my firewall or gateway leaking UDP traffic to the standard network?

2
  • You know you can just bind Deluge to a given interface right? Mar 29, 2023 at 3:52
  • You'd think that would be enough, but alas, wire-shark tells me a different story with lot's of UDP packets going out eth0. I'm not sure you can trust deluge when you tell it to bind to a single device. Mar 29, 2023 at 5:07

0

You must log in to answer this question.

Browse other questions tagged .