We have a remote (like in the woods) client using a VPN connection to connect to our office, using this link we can monitor and operate the remote client without a few hours drive in the wild.
This remote linux client uses a "Cellular" uplink, which means bandwidth is billed by the Mbyte.
We are seeing a large cellular bandwidth usage, incompatible with the usage we make of this remote client. The investigation showed that the office network multicast/broadcast traffic is getting all through the VPN and up to the remote client (a complete waste of bandwidth). We are about up to 600Mbytes a month of cell. data wasted this way, which is getting expensive.
CLIENT>tcpdump -i tap0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tap0, link-type EN10MB (Ethernet), capture size 65535 bytes
10:03:47.582171 IP 192.168.222.22.17500 > 192.168.222.255.17500: UDP, length 130
10:03:47.582390 IP 192.168.222.22.17500 > 255.255.255.255.17500: UDP, length 130
10:03:48.851626 ARP, Request who-has 192.168.222.100 tell 192.168.222.22, length 28
10:03:49.792013 ARP, Request who-has 192.168.222.100 tell 192.168.222.22, length 28
10:03:50.801768 ARP, Request who-has 192.168.222.100 tell 192.168.222.22, length 28
10:03:53.061654 ARP, Request who-has 192.168.222.100 tell 192.168.222.22, length 28
10:03:53.792095 ARP, Request who-has 192.168.222.100 tell 192.168.222.22, length 28
10:03:54.791945 ARP, Request who-has 192.168.222.100 tell 192.168.222.22, length 28
10:03:58.521787 CDPv2, ttl: 180s, Device-ID 'CCD539F222E8', length 92
10:03:59.671763 ARP, Request who-has 192.168.222.100 tell 192.168.222.22, length 28
10:04:00.291688 ARP, Request who-has 192.168.222.100 tell 192.168.222.22, length 28
10:04:01.291826 ARP, Request who-has 192.168.222.100 tell 192.168.222.22, length 28
10:04:06.982023 IP 192.168.222.1.40147 > 239.255.255.250.1900: UDP, length 414
10:04:06.992699 IP 192.168.222.1.40147 > 239.255.255.250.1900: UDP, length 486
10:04:06.992940 IP 192.168.222.1.40147 > 239.255.255.250.1900: UDP, length 482
10:04:06.993177 IP 192.168.222.1.40147 > 239.255.255.250.1900: UDP, length 462
10:04:06.993439 IP 192.168.222.1.40147 > 239.255.255.250.1900: UDP, length 494
10:04:07.121940 IP 192.168.222.1.40147 > 239.255.255.250.1900: UDP, length 476
10:04:07.122242 IP 192.168.222.1.40147 > 239.255.255.250.1900: UDP, length 478
10:04:07.122450 IP 192.168.222.1.40147 > 239.255.255.250.1900: UDP, length 478
10:04:08.301759 ARP, Request who-has 192.168.222.100 tell 192.168.222.22, length 28
10:04:09.291677 ARP, Request who-has 192.168.222.100 tell 192.168.222.22, length 28
10:04:10.291724 ARP, Request who-has 192.168.222.100 tell 192.168.222.22, length 28
10:04:12.212075 ARP, Request who-has 192.168.222.22 tell 192.168.222.2, length 46
10:04:12.381705 ARP, Request who-has 192.168.222.100 tell 192.168.222.22, length 28
10:04:13.291662 ARP, Request who-has 192.168.222.100 tell 192.168.222.22, length 28
On the office side, we are using a RT-N16 loaded with "Tomato Firmware v1.28.7501 MIPSR2Toastman-RT K26 USB VPN". Our OpenVPN setup is as follows:
Interface Type: TAP
Firewall: Automatic
Client Address Pool: 192.168.222.80-90 (same subnet than office subnet)
Allow Client<-->Client: True
Now I tried setting up iptables rules on the RT-N16 to discard multicast/broadcast packets to no avail. Even with these wide-targetting rules, I still receive multicast on the client:
iptables -I FORWARD -d 192.168.222.255 -j DROP
iptables -I FORWARD -d 255.255.255.255 -j DROP
iptables -I FORWARD -d 224.0.0.0/4 -j DROP
iptables -I OUTPUT -d 192.168.222.255 -j DROP
iptables -I OUTPUT -d 255.255.255.255 -j DROP
iptables -I OUTPUT -d 224.0.0.0/4 -j DROP
iptables -I INPUT -d 192.168.222.255 -j DROP
iptables -I INPUT -d 255.255.255.255 -j DROP
iptables -I INPUT -d 224.0.0.0/4 -j DROP
It seems like somehow the routing done by OpenVpn with TAP interfaces is a bit different and not quite controlled by iptables as even ARP packets (which are not IP packets per-say) are routed. Here is the iptables list on my OpenVpn server (RT-N16)
Chain INPUT (policy DROP 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 519 209K DROP all -- * * 0.0.0.0/0 224.0.0.0/4
2 151 28094 DROP all -- * * 0.0.0.0/0 255.255.255.255
3 516 45679 DROP all -- * * 0.0.0.0/0 192.168.222.255
4 0 0 ACCEPT all -- tap21 * 0.0.0.0/0 0.0.0.0/0
5 1744 117K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443
6 0 0 ACCEPT all -- tun22 * 0.0.0.0/0 0.0.0.0/0
7 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1194
8 3 358 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
9 297 27211 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
10 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
11 228 13368 ACCEPT all -- br0 * 0.0.0.0/0 0.0.0.0/0
12 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5
13 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpts:33434:33534 limit: avg 5/sec burst 5
14 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:67 dpt:68
15 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:9999
16 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:2222
17 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:1723
18 0 0 ACCEPT 47 -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy DROP 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 DROP all -- * * 0.0.0.0/0 224.0.0.0/4
2 0 0 DROP all -- * * 0.0.0.0/0 255.255.255.255
3 0 0 DROP all -- * * 0.0.0.0/0 192.168.222.255
4 0 0 ACCEPT all -- tap21 * 0.0.0.0/0 0.0.0.0/0
5 0 0 ACCEPT all -- tun22 * 0.0.0.0/0 0.0.0.0/0
6 8646 2162K all -- * * 0.0.0.0/0 0.0.0.0/0 account: network/netmask: 192.168.222.0/255.255.255.0 name: lan
7 0 0 ACCEPT all -- br0 br0 0.0.0.0/0 0.0.0.0/0
8 2 80 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
9 525 31200 TCPMSS tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU
10 4309 1177K L7in all -- vlan2 * 0.0.0.0/0 0.0.0.0/0
11 7540 2035K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
12 217 28861 wanin all -- vlan2 * 0.0.0.0/0 0.0.0.0/0
13 887 97701 wanout all -- * vlan2 0.0.0.0/0 0.0.0.0/0
14 887 97701 ACCEPT all -- br0 * 0.0.0.0/0 0.0.0.0/0
15 217 28861 upnp all -- vlan2 * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 467 packets, 106K bytes)
num pkts bytes target prot opt in out source destination
1 104 51922 DROP all -- * * 0.0.0.0/0 224.0.0.0/4
2 0 0 DROP all -- * * 0.0.0.0/0 255.255.255.255
3 0 0 DROP all -- * * 0.0.0.0/0 192.168.222.255
Chain L7in (1 references)
num pkts bytes target prot opt in out source destination
1 0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 LAYER7 l7proto skypetoskype
2 0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 LAYER7 l7proto youtube-2012
3 0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 LAYER7 l7proto flash
4 0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 LAYER7 l7proto httpvideo
5 0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 LAYER7 l7proto rtp
6 0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 LAYER7 l7proto rtmp
7 0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 LAYER7 l7proto rtmpt
8 0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 LAYER7 l7proto shoutcast
9 0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 LAYER7 l7proto irc
Chain upnp (1 references)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.222.2 tcp dpt:40626
2 217 28861 ACCEPT udp -- * * 0.0.0.0/0 192.168.222.2 udp dpt:40626
Chain wanin (1 references)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.222.2 tcp dpt:8888
2 0 0 ACCEPT udp -- * * 0.0.0.0/0 192.168.222.2 udp dpt:8888
3 0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.222.2 tcp dpt:8080
4 0 0 ACCEPT udp -- * * 0.0.0.0/0 192.168.222.2 udp dpt:8080
Chain wanout (1 references)
num pkts bytes target prot opt in out source destination
