how to add malware dns file to OpenVPN server via iptables?

Ingber · Post by **Ingber** » Wed Jul 13, 2016 4:47 pm

On my OpenVPN server on my Ubuntu VPS, I regularly update lists from sites like https://lists.blocklist.de/lists/all.txt into my fail2ban scripts which put DROP entries into my iptables, so I thought this might be a good way of also protecting OpenVPN clients.

However, this does not seem to work. I picked a few IPs that are in my DROP list in my server iptables, e.g., `iptables -w -L -v -n`, and my clients that use my OpenVPN server can still access those IPs in their browsers. My clients use headers like:

client
dev tun
proto udp
remote XXX.XXX.XXX.XXX
resolv-retry infinite
nobind
persist-key
persist-tun
ns-cert-type server
comp-lzo
verb 3

TLS certs are used, etc.

Ingber · Post by **Ingber** » Wed Jul 13, 2016 5:02 pm

Note that I already have the `push` line in my server.conf:

# If enabled, this directive will configure
# all clients to redirect their default
# network gateway through the VPN, causing
# all IP traffic such as web browsing and
# and DNS lookups to go through the VPN
# (The OpenVPN server machine may need to NAT
# or bridge the TUN/TAP interface to the internet
# in order for this to work properly).
push "redirect-gateway def1 bypass-dhcp"

TinCanTech · Post by **TinCanTech** » Wed Jul 13, 2016 8:01 pm

See man iptables -t table for the different tables and what they do ..

FAIL2BAN is not going to help at all with your clients access to the internet.

Ingber · Post by **Ingber** » Thu Jul 14, 2016 3:08 pm

TinCanTech:

I've been using scripts modeled after https://gist.github.com/klepsydra/ecf975984b32b1c8291a to populate iptables. Note that these scripts do not really use fail2ban, but rather are an independent method of creating and maintaining these tables. As the author states,
## Actually, runs 100% independently now, without needing fail2ban installed.

Do you mean that using iptables will not work for my purposes, i.e., to maintain a malware bases for client OpenVPN using my OpenVPN server?

Are you saying that I should use "-t nat" or "-t security" for this purpose?

Thanks for your reply.

TinCanTech · Post by **TinCanTech** » Thu Jul 14, 2016 6:28 pm

What I am saying is .. we do not know anything about your iptables rules

Ingber · Post by **Ingber** » Thu Jul 14, 2016 7:28 pm

Hi. I just gave an explicit reference to the rules.

OpenVPN Support Forum

how to add malware dns file to OpenVPN server via iptables?

how to add malware dns file to OpenVPN server via iptables?

Re: how to add malware dns file to OpenVPN server via iptables?

Re: how to add malware dns file to OpenVPN server via iptables?

Re: how to add malware dns file to OpenVPN server via iptables?

Re: how to add malware dns file to OpenVPN server via iptables?

Re: how to add malware dns file to OpenVPN server via iptables?