[Solved]Control traffic using iptables

thecajun

I am trying to set up a system like topic

Using routing and OpenVPN not running on the default gateway

at https://community.openvpn.net/openvpn/wiki/BridgingAndRouting.

I have my router routing port 1194 to the LAN at server address. From there I wish to control traffic using iptables. Without running iptables, I can connect to OpenVPN server from client. But when I add iptable rules mentioned in the topic, the connection never occurs. The iptable rules I start with come from a working machine. I stripped out all unneeded rules just so I can get the basic connection to begin with. Ultimately, I wish to establish connection from client, through VPN server, back out the router (a VPN router) via VPN connection to another private subnet. I know it sounds a bit reckless, but there is no server at destination, other wise I would install OpenVPN there. I'd appreciate any advice.

Thank you,

Durwin

===SERVER.CONF

port 1194
proto tcp
dev tun
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh.pem
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 172.23.93.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
plugin /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so login

===CLIENT.CONF

client
dev tun
proto tcp
remote host.mydomain.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client2.crt
key client2.key
remote-cert-tls server
comp-lzo
verb 3
auth-user-pass

IPTABLE

#!/bin/bash

#------
# Initialiaze all the chains by removing all the rules tied to them
#------
iptables --flush
iptables -t nat --flush
iptables -t mangle --flush

#------
# Delete user defined chains
#------
iptables --delete-chain
iptables -t nat --delete-chain
iptables -t mangle --delete-chain

#------
# Set default policy
#------
iptables --policy INPUT DROP
iptables --policy OUTPUT ACCEPT
iptables --policy FORWARD DROP
iptables -t nat --policy POSTROUTING ACCEPT
iptables -t nat --policy PREROUTING ACCEPT

#------
# Loop back accepts all traffic
#------
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

#------
# Define user chains
#------
iptables -N User-Firewall

#------
# Allow bidirectional traffic to internal network
#------
iptables -A INPUT -p all -s 172.23.93.0/24 -j ACCEPT
iptables -A INPUT -p all -s 10.8.0.0/24 -j ACCEPT

#------
# VPN
#------
## Allow traffic initiated from VPN to access LAN
iptables -A FORWARD -i tun0 -o enp0s25 -s 10.8.0.0/24 -d 172.23.93.0/24 -m conntrack --ctstate NEW -j ACCEPT
## Allow established traffic to pass back and forth
iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

iptables -A User-Firewall -j REJECT --reject-with icmp-host-prohibited

maikcat

But when I add iptable rules mentioned in the topic, the connection never occurs.

where exactly is the input rule which allows traffic to openvpn service itself?

for testing try to switch your default INPUT chain to allow...

Michael.

thecajun

Thank you for your reply.

I set the default to allow and traffic came through. So I looked at the other rules I had tried (some I did not post) and found this one that was incomplete.

iptables -A INPUT -p tcp --dport 1194 -m state --state NEW -j ACCEPT

I got this from one site. But after looking at others with rule to pass 1194, I realized it was missing something. I corrected it to look like this.

iptables -A INPUT -p tcp --dport 1194 -m state --state NEW,ESTABLISHED -j ACCEPT

It now passes the port through.

Thank you. Now I believe I can proceed to route traffic.