I am running an ovpn server for my family members and am not experienced in iptables, nor in networking... I was hoping you could help?
I have one machine, in it I have these running: ntop + ssh + multiple ovpn servers. The ovpn servers are used simply for the clients to browse the web, nothing special. (ntop is for me to check that weird things are not happening.)
Basically, I want the machine to be locked down as tightly as possible to the outside. Locking it down so someone who connects to one of the OpenVPNs (e.g. using stolen credentials --I don't think my family members are great in keeping credentials secure) cannot wreck havoc would be great too... What would be the best firewall setup for this?
(I tried using firewallbuilder but could not figure it out...)
Below is my basic configuration (on Debian). Each server uses the same basic conf, while having different proto & port. They all are in the 10.*.8.0 range.
port 1194
proto udp
dev tun
...
server 10.9.8.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
persist-key
persist-tun
client-to-client
push "dhcp-option DOMAIN SERVER-IP"
push "dhcp-option SEARCH SERVER-IP"
push "dhcp-option DNS 10.9.8.1"
push "redirect-gateway def1"
user nobody
group nogroup
chroot /tmp
I set the iptables by googling around for each rule and it probably is very poorly done... And I use rc.local as my iptables rule script/file (is that bad?):
## flush
iptables -F
iptables -X
## set defaults
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
## forwarding for openvpn server 443/tcp
iptables -A FORWARD -i eth0 -o tun0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -s 10.9.8.0/24 -o eth0 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.9.8.0/24 -o eth0 -j MASQUERADE
## forwarding for openvpn server udp 1194
iptables -A FORWARD -i eth0 -o tun1 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -s 10.10.8.0/24 -o eth0 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.10.8.0/24 -o eth0 -j MASQUERADE
## allow ssh at 1000
iptables -A INPUT -p tcp --dport 1000 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 1000 -m state --state ESTABLISHED -j ACCEPT
## allow 443/tcp for openvpn server
iptables -A INPUT -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
## allow 1194/udp for openvpn server
iptables -A INPUT -p udp --dport 1194 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p udp --sport 1194 -m state --state ESTABLISHED -j ACCEPT
## allow 53 on tun for dnsmasq
iptables -A INPUT -i tun0 -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -i tun0 -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -o tun0 -p tcp --sport 53 -j ACCEPT
iptables -A OUTPUT -o tun0 -p udp --dport 53 -j ACCEPT
iptables -A INPUT -i tun1 -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -i tun1 -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -o tun1 -p tcp --sport 53 -j ACCEPT
iptables -A OUTPUT -o tun1 -p udp --dport 53 -j ACCEPT
## open stuff up for ntop at 3000/tcp
iptables -A INPUT -i tun0 -p tcp --dport 3000 -j ACCEPT
iptables -A INPUT -i tun1 -p tcp --dport 3000 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 3000 -j DROP
## end
iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m state --state NEW,ESTABLISHED -j ACCEPT
## done
exit 0
I would really appreciate any and all advice...
