Blocking SMTP For Clients

TimmerCA

Hi,

We're running OpenVPN Access Server and we have a situation whereby compromised client computers are sending SPAM through the OpenVPN connection to servers that we have configured to be open relays for our local network.

Before anyone give me the lecture on "open relays are bad": I know this; we need one though because we have "dumb" devices like PDUs and printers that need to be able to relay e-mail out without SMTP AUTH. So, we have an SMTP server to allow relaying from our network, but that network includes the OpenVPN server. Clients, however, should all be configured to use SMTP AUTH on port 587, so we're confident that blocking connections from OpenVPN clients to port 25 anywhere on our network is acceptable.

So what I'd like to do is add something like the following rule to iptables on the OpenVPN server:

--source 192.168.55.0/24 --dest 1.2.3.0/24 -m tcp -p tcp --dport 25 -j REJECT

Where 192.168.55.0/24 is the OpenVPN client NAT network and 1.2.3.0/24 is our public network.

Where is the appropriate place to put this firewall rule? Can I create an /etc/sysconfig/iptables file and place it there? Is there a better way to do this than by mucking with iptables on the OpenVPN server? I couldn't find anything in the admin GUI that seemed to facilitate adding arbitrary firewall rules.

TimmerCA

debbie10t wroteOpenVPN does not support Port filtering therefore iptables is where this work belongs.

Ok, will do, thanks!

I looked in /etc/sysconfig/iptables where I usually put iptables rules, but that file (and even that folder) don't exist, and there also isn't an /etc/init.d/iptables script to run to re-load those rules.

Where is the proper place to put custom iptables rules on an OpenVPN AS server appliance?

rsenio

If you use active directory, make the firewall changes via group policy for restrictions on your VPN subnet

anthonysomerset

rsenio wroteIf you use active directory, make the firewall changes via group policy for restrictions on your VPN subnet

what about those that are not using windows? like the original poster also 😉