Deny Access to LAN

vedeyn

Hello everyone,

I should preface this by stating that I am familiar with the basics of Linux/Openvpn, but I am by no means an "advanced" user.

I recently set up an openvpn server on Ubuntu 16.04 using this guide:
https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-ubuntu-16-04

Everything is up and running fine but there is one small change I would like to make to it. When connected to the VPN, I would like to make it so clients do not have access to the local network behind the VPN server. Currently I have the VPN server handing out addresses on the 10.9.0.0/8 network and I would like to prevent clients from accessing my local 10.10.10.0/24 network. The only purpose of this VPN server is to allow clients to route internet traffic through my server.

Any help with this would be greatly appreciated. Please let me know if you have any suggestions or questions.

Thanks,
Ved

TinCanTech

Did you see the rules ?

vedeyn

My apologies, here are the server and client configs.

Server:
port 1195
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.9.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
tls-auth ta.key 0
key-direction 0
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3

Client:
client
dev tun
proto udp
remote "MY IP" 1195
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
key-direction 1
remote-cert-tls server
comp-lzo
verb 3

TinCanTech

Use iptables to block access to your server LAN.

vedeyn

TinCanTech wroteUse iptables to block access to your server LAN.

This is where I start to get a little unfamiliar with Linux. I am using ufw (not familiar with the differences) and have tried what you suggested. Either I'm doing it incorrectly or something else is going on. The guide I followed has me paste the following in /etc/ufw/before.rules:

# START OPENVPN RULES
# NAT table rules
*nat
:POSTROUTING ACCEPT [0:0]
# Allow traffic from OpenVPN client to eth0
-A POSTROUTING -s 10.8.0.0/8 -o eth0 -j MASQUERADE
COMMIT
# END OPENVPN RULES

Could this be overriding my attempts to block access to the local network with ufw? I've tried modifying the above code but the VPN stops routing internet traffic every time I do.