vpn working, how to firewall ccd clients to lan hosts?

m.ardito

hi!

I have an ubuntu 12.04 server freshly installed (vm) just for openvpn tests
I want to allow clients to access my lan but only to access selected lan hosts

here is actual server.conf

management localhost 7505
port 3333
proto tcp
dev tun0
ca keys/ca.crt
cert keys/server.crt
key keys/server.key  # This file should be kept secret
dh keys/dh2048.pem
server 10.8.0.0 255.255.255.0
push "route 192.168.3.0 255.255.255.0"
client-config-dir ccd
keepalive 10 120
cipher AES-128-CBC   # AES
comp-lzo
persist-key
persist-tun
status openvpn-status.log
log openvpn-tun.log
verb 3

ccd/client is like:

ifconfig-push 10.8.0.5 10.8.0.6

I set up ip forwarding:

 $cat /proc/sys/net/ipv4/ip_forward
1

and I've set a "return" (static) route to the vpn box on the main gateway (192.168.3.1, a firewall box)

now, from client I can ping and access any host on the lan, wonderful!

but I wish to be able to limit specific clients only to some hosts on the lan.

i could of course push only routes to those hosts but is it secure? I fear not enough...

i would like to have firewall rules!

if I enable ufw, from client i can't access anything on the lan! and no "allow" rule allows me to access any host!

only if I enable in ufw.conf

DEFAULT_FORWARD_POLICY="ACCEPT"

from client I can ping and access any host on the lan, but no "deny" rule allows me to block access only to specific hosts (or deny some others)!

how can I do? What am I missing? Thanks!

how can I restrict, say, 10.8.0.5 to access only 192.168.3.8 on this vpn box?
Should I use ufw, or directly iptables, or what else?

Thanks for the help!
Marco

janjust

that's indeed a firewalling issues ; I'd use iptables but ufw probably also can do the trick.

OpenVPN normally is about allowing access, not about restricting it 😉

m.ardito

hi,

yes I know it's firewalling, it was in the thread title :-)

i know a bit of ufw, iptables and firewalling in general, but it seems that
- if I enable DEFAULT_FORWARD_POLICY="ACCEPT" (or disable ufw itself) I am not able to stop anything through the vpn box
- if I disable DEFAULT_FORWARD_POLICY="ACCEPT" (but enable ufw itself) I am not able to allow anything through the vpn box

I feel it's having something to to with the traffic being forwarded between tun0 and eth0 (and back), and I don't know how to set ufw, or iptables directly, to allow/deny what I need to... I know openvpn is working perfectly here, but I hoped that someone could help me with a bit more experience... nobody ever did this?

?

Marco

janjust

it depends a bit on whether you're using masquerading on the vpn server or not; if you are NOT using masquerading then you can use iptables like this:

iptables -I FORWARD -s source-ip -d dest-ip -j ACCEPT
iptables -I FORWARD -s !source-ip -d dest-ip -j DROP

where 'source-ip' would be the VPN IP of the client and 'dest-ip' is the IP address of the service you want to reach. You can also use subnets here.

m.ardito

hi, thanks.

I think it's better to clearly explain my setup I don't know if this can help

this is my setup

                               --<vpnbox>
                              |
<client>---<firewall/gateway> -
                              |
                               --<lan>
                              |
                               --<special host>

where <vpnbox>, <special host> and all the <lan> are in the same IP class: 192.168.x.0/24

* <vpnbox> has 192.168.x.26 on its eth0 and 10.8.0.1 on its tun0
* <vpnbox> has ip forwarding enabled ( /proc/sys/net/ipv4/ip_forward = 1)
* openvpn on <vpnbox> routes all the 192.168.x.0/24 IP class to the client
* <client> (10.8.0.5) connects with openvpn to <vpnbox> (10.8.0.1)

an example of what i want to achieve is:
to let <vpnbox> allow <client> to only access <special host> on port 80 (lan web app), denying all the rest

ultimately, i would like to set up a "simple" setup to allow any specific <client> to access anly a set of "special" hosts/ports on the lan

i am experimenting with ufw because of the "simple" setup target i have, but if is not possible, i will switch to directly manage iptables rules. up to now i tried, without any specific firewalling rule applied:

if ufw on <vpnbox> is off, then
* <vpnbox> can connect to all hosts on <lan>
if ufw on <vpnbox> is on, without DEFAULT_FORWARD_POLICY="ACCEPT", then
* <vpnbox> can NOT connect to any host on <lan>
if ufw on <vpnbox> is on, with DEFAULT_FORWARD_POLICY="ACCEPT", then
* <vpnbox> can connect to any host on <lan>
if ufw on <vpnbox> is on, with DEFAULT_FORWARD_POLICY="ACCEPT" but with "default deny outgoing" (ufw comes with default deny incoming, allow outgoing), then
* <vpnbox> cannot connect to any host on <lan>

what is the best approach I could take to have simple rules allowing my intended target setup?

I don't really understand how to relate requests coming from tun0 to firewall rules on the 192.168.x.0/24 ip class of the lan, on <vpnbox>...

Thanks,
Marco

m.ardito

continuing my previous post (I am not allowed to edit it anymore...)

I am now in this state:
ufw on <vpnbox> is on, with DEFAULT_FORWARD_POLICY="ACCEPT" but with "default deny outgoing" (ufw comes with default deny incoming, allow outgoing), then
* <vpnbox> cannot connect to any host on <lan>

well, of course openvpn too can not connect anymore

but if I now enable

ufw allow 1194/tcp

then openvpn can again connect to <vpnbox> and see all other <lan> hosts, while <vpnbox> itself can not!

is "forwarding" skipping ufw rules now?

what is the best approach I could take..?

Marco

m.ardito

i made some progress...

1) uninstalled ufw (apt-get remove/purge)
2) removed allow all ufw iptable tules that were still there (save iptable rules to file, remove ufw crap, reload iptables rules from file)
3) inserted new iptable rules

#iptables -L --line-numbers
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination
1    ACCEPT     all  --  10.8.0.0/24          192.168.x.y
2    REJECT     all  --  10.8.0.0/24          192.168.x.0/24       reject-with icmp-port-unreachable

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

where 192.168.x.y is the special host...

and now it works as expected...

now i can play with ports on that hosts and others...

i have another question now... but will open another thread as it is about routing between different client-specific subnets

Marco