samw5
I've just setup an OpenVPN server on my DD-wrt router but I'm having some issues getting my firewall to work properly.
My local net is 192.168.77.0/24
My VPN net is 192.168.66.0/24
Connection gets established but if I try the following commands I losing access to outside as well.
#push "dhcp-option DNS 192.168.77.1"
#push "redirect-gateway def1"
Here is my current firewall rules:
#Enable NAT on the WAN port to correct a bug in builds over 17000
iptables -t nat -I POSTROUTING -o `get_wanface` -j SNAT --to `nvram get wan_ipaddr`
#Allow br1 access to br0, the WAN, and any other subnets (required if SPI firewall is on)
iptables -I FORWARD -i br1 -m state --state NEW -j ACCEPT
iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
#Keep the two wireless networks from talking to each other:
iptables -I FORWARD -i br0 -o br1 -j logdrop
iptables -I FORWARD -i br1 -o br0 -j logdrop
#Keep br1 from accessing the router:
iptables -I INPUT -i br1 -p tcp --dport telnet -j REJECT --reject-with tcp-reset
iptables -I INPUT -i br1 -p tcp --dport ssh -j REJECT --reject-with tcp-reset
iptables -I INPUT -i br1 -p tcp --dport www -j REJECT --reject-with tcp-reset
iptables -I INPUT -i br1 -p tcp --dport https -j REJECT --reject-with tcp-reset
#nat loopback fix
insmod ipt_mark
insmod xt_mark
iptables -t mangle -A PREROUTING -i ! `get_wanface` -d `nvram get wan_ipaddr` -j MARK --set-mark 0xd001
iptables -t mangle -A PREROUTING -j CONNMARK --save-mark
iptables -t nat -A POSTROUTING -m mark --mark 0xd001 -j MASQUERADE
#openVPN server
iptables -I INPUT 1 -p tcp --dport 499 -j ACCEPT
iptables -I FORWARD 1 --source 192.168.66.0/24 -j ACCEPT
#iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
#iptables -I FORWARD -i tun0 -o br0 -j ACCEPT
I have 3 different wireless networks, my guest on br1 that I'm blocking from accessing my 192.168.77.0/24 subnet.
Other than that just standard port forwarding rules.
Any help would be welcome.
