Traffic--synology dsm 5.1 2nd server issue

dgermann

Traffic--

Tried to reply to your last post here: https://forums.openvpn.net/topic18183-15.html but for some reason the topic is locked. Maybe you or someone has the ability to reopen it and move this post back there.

Yes, all those things still seem to be true, except that we can connect using a password. I want to change that to ssh keys for security. So at the moment the connection is disabled.

Not sure what you expected had changed. Am I missing your question, Traffic?

Traffic

dgermann wroteTried to reply to your last post here: topic18183-15.html

The previous issue has been closed by a mod as it is easier to start over.

We have a lot of experience helping people and during the course of solving most issues a lot of things change from the initial setup. Often things change which are never documented until we ask for people to check. So the simple and most effective solution is to start a new thread.

Please clearly state your question and post your new configs and logs.

dgermann

Traffic--

Not sure that the configs or logs would be relevant here, since this is a general firewall question: what should be the firewall rules to allow openvpn to get through?

The firewall rules I have on the server are:

1. Allow all ports and all protocols from within the local network 192.168.x.x
2. Allow vpn port to be accessed for any protocol from anywhere.
3. Allow vpn server to be accessed udp from the remote source 10.8.x.x
4. Deny all other traffic.

With these rules I can connect the remote vpn client to the local vpn nas server.

I am concerned that rule #2 is a security risk. Is it? How to tighten it and still let the desired traffic through?

If needed the conf files are in post 1 here: https://forums.openvpn.net/topic18183.html They have not changed.

Thanks!

Traffic

dgermann wroteI am concerned that rule #2 is a security risk

dgermann wrote2. Allow vpn port to be accessed for any protocol from anywhere.

As your description is ambiguous i will just suggest this:

2. Allow vpn port to be accessed for the protocol you have configured OVPN-serv to use, from IPs you trust.

dgermann

Traffic--

Sorry to be ambiguous. Not sure what I left out. These are the rules currently set in the nas:

Ports	  Protocol	Source ip	                        action
All	  All	192.168.0.1 to 192.168.0.254	                 Allow
All	  All	10.8.1.1 to 10.8.1.254	                         Allow
1xxxx	  All	All	                                                 Allow
VPN Server
	  UDP	10.8.1.0 to 10.8.1.254	                  Allow
All	All	All	                                                          Deny

Now in the other vpn server, I have ufw disabled. If I enable it, I have these rules

     To                         Action      From
     --                         ------      ----
[ 1] 22/tcp                     ALLOW IN    192.168.0.0/24
[ 2] 1194/tcp                   ALLOW IN    192.168.0.0/24
[ 3] 3551/tcp                   ALLOW IN    192.168.0.0/24
[ 4] 21/tcp                     ALLOW IN    192.168.0.0/24
[ 5] 135/tcp                    ALLOW IN    192.168.0.0/24
[ 6] 139/tcp                    ALLOW IN    192.168.0.0/24
[ 7] 445/tcp                    ALLOW IN    192.168.0.0/24
[ 8] 137/udp                    ALLOW IN    192.168.0.0/24
[ 9] 138/udp                    ALLOW IN    192.168.0.0/24
[10] 1yyyy                       ALLOW IN    Anywhere
[11] 1yyyy                       ALLOW IN    Anywhere (v6)

If this is enabled, the vpn cannot connect. It is set to go through port 1yyyy. (Yes it has real numbers; I have disguised the numbers in this post.)

So I am totally relying on the router firewall for the older vpn. The newer vpn allows all traffic in through the 1xxxx port.

A. How to allow the VPN traffic at all for the older vpn?

B. How to lock down the newer VPN to certain addresses, as you suggest in your response.

Thanks for helping me Traffic.

:- Doug.

dgermann

Hi Traffic--

Hope I did not anger you with my post in some way. 🙁

Would really like to know how to set up the firewalls to allow openvpn connections, but only the ones I want.

Thanks!