5

I have OpenVPN running on a Linux machine. The VPN server has a public IP address (x.x.x.x) and the VPN clients are assigned addresses on the "tun" device in 10.8.0.0\24. I have an IPTables rule to NAT masquerade 10.8.0.0\24 onto the public IP address.

To get the VPN server running, I had to enable IP forwarding (so I set net.ipv4.conf.default.forwarding=1).

... In other words, it's exactly what the OpenVPN tutorial says to do, with no fancy tricks.

This all works, but I'm worried about the enabling forwarding part. I think the machine will now forward packets from any IP address to any IP address, which doesn't seem suitable. Since it has a publicly accessible IP, this is particularly bad.

Are there any firewall rule suggestions to restrict the unwanted forwarding behaviour? I think any answer will be one or more IPTables rules in the FORWARD chain, but this is where I've got stuck.

thanks!

Improve this question

2 Answers 2

Reset to default
6

If you use these rules for forwarding table, you should be fine.

-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.8.0.0/24 -j ACCEPT
-A FORWARD -j REJECT

You can put the rules in file /etc/sysconfig/iptables and restart firewall. For command line trial first do

 iptables -F

to remove the default rejection of forwarding traffic and add 'iptables ' before each of the above three rules.

Improve this answer
1
  • Quick question: when using /24 shouldn't we specify 3 octets? Something like 10.8.8.0/24? Tx
    – DrBeco
    Feb 21, 2017 at 16:26
0

Here's a subset of what I've got set up on my openvpn gateway:

iptables -A FORWARD -i tun0 -o tun0 -j ACCEPT # vpn to vpn
iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT # vpn to ethernet
iptables -A FORWARD -i eth0 -o tun0 -j ACCEPT # ethernet to vpn

Note that this is just a subset; the rest of the rule do standard NAT things.

Improve this answer
2
  • I think this wont restrict unwanted forwarding behavior and connection from public IP address can be initiated towards towards hosts behind VPN. The machine with public IP address would have been configured with routing to send replies to internal machines. Now if someone sends packets to public interface with destination as intranet IP packets can go till hosts behind VPN tunnel. If this VPN tunnel is also default route for hosts so that they can send packets to Internet directly then even a connection can be established from outside to inside. Please review rules once.
    – Saurabh Barjatiya
    Jul 11, 2009 at 14:00
  • Since you already have such setup it should not be that hard to test whether my suspicion is correct or not.
    – Saurabh Barjatiya
    Jul 11, 2009 at 14:01

You must log in to answer this question.