In the default config of OpenVPN there is this commented blocked at the client-to-client line:

# By default, clients will only see the server.
# To force clients to only see the server, you
# will also need to appropriately firewall the
# server's TUN/TAP interface.

I've been wondering for years what they actually mean with "appropriately" firewall the interface. A quick Google also didn't give any specific iptables rules to execute to 'solve' this.

What does this comment mean, and how can I appropriately firewall it using iptables?

  • Ignore the fact that this is a VPN. If client-to-client is enabled you basically need to treat the VPN interface as if it was any other interface. You set firewall rules based on your requirements. I can't tell you want your requirements are, only you know them. As a general rule though, it is always safe to setup a firewall that blocks everything, and then add rules when you actually need to permit something. – Zoredache Sep 28 '13 at 0:21
  • But with client-to-client commented out, there is no way for VPN users to directly communicate with eachother over de LAN? Comparable to AP isolation? – Tuinslak Sep 28 '13 at 7:11
  • Sure you block access between clients if you comment that out. But they can still access any services running on the OpenVPN server, and anything beyond it. The comment is worded badly. I think you just need to take it as a general reminder to add rules on the OpenVPN server to restrict or permit traffic as needed. – Zoredache Sep 28 '13 at 8:09
  • Aha, okay, but that seemed logic. I understood that comment as to "clients can still access/view other clients if you don't firewall it". Thanks. – Tuinslak Sep 28 '13 at 21:58

i think this just means that once you have the tap/tun device up, with an IP, you want to then firewall it, so as to prevent connections from the remote LAN to which your vpn is connected...

on my mac, i have:

utun0: flags=80d1<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1418<br>
inet --> netmask 0xfffffe00 

as i do not have firewalling in place (on purpose), anyone on the remote lan could connect to ports i have open on my machine. so, for example, it may be "appropriate" to block incoming tcp/80 from remote LAN. on linux that would look something like:

iptables -A INPUT -i tun0 -p tcp --dport 80 -j DROP
  • If I understand correctly, you mean firewalling the clients themselves to prevent the server to connect to local ports? Or what do you mean with remote lan? – Tuinslak Sep 28 '13 at 22:00
  • "you mean firewalling the clients themselves to prevent the server to connect to local ports?" yes, but not only the vpn server, but the "remote lan" or network on the other side of vpn. – nandoP Oct 2 '13 at 3:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.