I have VPN access using OpenVPN and try to create a safe machine that does not leak traffic over non-VPN interfaces. Using the firewall UFW I try to achieve the following:

  • Allow Access from LAN to the machine's web-interface
  • Otherwise only allow Traffic on tun0 (OpenVPN-Tunnel interface when established)
  • Reject (or forward?) any traffic over other interfaces

Currently I am using the following rules (sudo ufw status):

To                         Action      From
--                         ------      ---- 9999/tcp     ALLOW       Anywhere           # allow web-interface
Anywhere on tun0           ALLOW       Anywhere           # out only thru tun0
Anywhere                   ALLOW OUT   Anywhere on tun0   # in only thru tun0

My problem is that the machine is initially not able to establish the OpenVPN-connection since only tun0 is allowed, which is not yet established (chicken-egg-problem)

How do I allow creating the OpenVPN connection and from this point onward force every single packet to go thru the VPN-tunnel?

  • Add a rule that explicitly permits traffic to the OpenVPN server(s) for the port/protocol you have configured OpenVPN to use. – Zoredache Dec 19 '12 at 22:45

Allow access by service application. I don't have an OpenVPN box available at the moment, but I think you should be able to allow access based with a command such as:

ufw allow OpenVPN

You can see if you can use open VPN like this by running:

ufw app list

Which will show those service applications which ufw is aware of.

In the case of no OpenVPN profile, you could try using ufw to only allow outbound connections on that interface to port 1194 (or whatever port the OpenVPN server is accepting connections on.) Something like:

sudo ufw deny out to any
sudo ufw allow out 1194/udp 

(assuming a stock OpenVPN setup.)

This wouldn't limit it to just OpenVPN...but the only leak possibility would be something else using that port and UDP....and the chances of that are pretty low.

To get more secure that port filtering, you would have to use something more substantial than ufw. AppArmor or SELinux, I believe, would be your next step, without having to step up to true Layer 7 firewall appliances.

  • My install does not ship any profiles except cups and I can't find any OpenVPN profiles on the internetz. But thanks for mentioning that ufw has application profiles – hotzen Dec 19 '12 at 23:51
  • You could mark it as an answer. – woodsbw May 13 '13 at 18:13
  • Yeah, not sure I would have marked this as my answer as I'm looking to do the same exactly thing (only reason I'm here is due to Google search rank). This person seems to have a more comprehensive ruleset based on 'iptables': gist.github.com/superjamie/ac55b6d2c080582a3e64 – rdev5 Oct 21 '16 at 4:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.