iptables not filtering client with static IP

brunobronosky

With this combination I was expecting that testuser with IP 172.141.127.1 would be prevented from reaching my servers on 172.31.x.x

/etc/openvpn $ cat ccd/testuser
ifconfig-push 172.141.127.1 172.141.127.2

/etc/openvpn $ sudo iptables -nL --line-numbers
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination
1    LOG        all  --  172.141.127.0/24     0.0.0.0/0           LOG flags 0 level 4 prefix `** ONO **'
2    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:1194
3    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:22
4    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination
1    ACCEPT     tcp  --  172.141.127.1        172.128.1.0/24      tcp
2    REJECT     tcp  --  172.141.127.0/24     0.0.0.0/0           tcp reject-with icmp-host-prohibited
3    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
4    ACCEPT     all  --  172.31.0.0/16        0.0.0.0/0
5    ACCEPT     tcp  --  172.127.0.0/20       172.31.6.110        tcp dpt:22
6    REJECT     tcp  --  172.127.0.0/20       0.0.0.0/0           tcp dpt:22 reject-with icmp-host-prohibited
7    ACCEPT     all  --  172.127.0.0/20       0.0.0.0/0
8    ACCEPT     tcp  --  172.141.0.0/17       172.31.6.110        tcp dpt:22
9    REJECT     tcp  --  172.141.0.0/17       0.0.0.0/0           tcp dpt:22 reject-with icmp-host-prohibited
10   ACCEPT     all  --  172.141.0.0/17       0.0.0.0/0
11   REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-port-unreachable

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

What am I missing?

TinCanTech

brunobronosky wrote/etc/openvpn $ cat ccd/testuser
ifconfig-push 172.141.127.1 172.141.127.2

Are you sure that is what you want ? :geek:

TiTex

your rules are evaluated in order they appear in the chain (if first rule accepts the connection , and the second one doesn't ... the connection will be allowed) so you should put them in a manner that make sense

these are not private IP ranges 🙂
172.141.0.0/17
172.128.1.0/24
172.127.0.0/20

brunobronosky

TiTex wrote your rules are evaluated in order they appear in the chain (if first rule accepts the connection , and the second one doesn't ... the connection will be allowed) so you should put them in a manner that make sense

Doesn't this make sense?

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination
1    ACCEPT     tcp  --  172.141.127.1        172.128.1.0/24      tcp
2    REJECT     tcp  --  172.141.127.0/24     0.0.0.0/0           tcp reject-with icmp-host-prohibited

To me this means:
Rule 1 will accept connections from 172.141.127.1 to 172.128.1.0-172.128.1.255. If that doesn't match the condition...
Rule 2 will reject connections from 172.141.127.1 (or any other 172.141.127.0-172.141.127.255) to any other destination.

brunobronosky

Somehow, just changing the IPs to the actual RFC1918 private space, and removing the CIDR masks fixed it.

ACCEPT     tcp  --  172.30.127.9         172.29.0.1          tcp
REJECT     tcp  --  172.30.127.9         0.0.0.0/0           tcp reject-with icmp-host-prohibited

Now the client with 172.30.127.9 can only reach the machine 172.29.0.1. I also confirmed that when you put

ifconfig-push 172.30.127.9 172.30.127.10

in a CCD file, it is the first IP that you use for filtering.