Route/Allow ONLY internet traffic trough VPN

oggy512

Hey guys,
I'm running an OpenVPN service on my Debian 8 server. Currently I've setup two configurations/services: One for just connection to the internal LAN, internet traffic is going to the internet connection of the client and a second one for routing all traffic, including internet trough my VPN.

Now I would like to have a third option: routing ONLY internet traffic trough my VPN, meaning the internet requests from the client should come over the VPN, but the client should NOT have access to the internal LAN.
I guess this is done via firewalling, but how? can anyone give me a hint?

Thanks!

Here is my current config:

Intranet VPN (no internet trough VPN)

#Main Configuration#
port 1194
proto udp
dev tun
server 10.8.0.0 255.255.255.0

#Encryption#
cipher AES-256-CBC
comp-lzo

#Certificates#
ca ca.crt
cert server.crt
key server.key
tls-auth ta.key 0
dh dh2048.pem

#Networking#
push "route 10.10.0.0 255.255.255.0"
push "dhcp-option DNS 10.10.0.1"
keepalive 10 60
max-clients 3

#Logging#
status openvpn-status.log
log openvpn.log
verb 4
mute 20

#Rights#
persist-key
persist-tun
user nobody
group nogroup

Internet VPN (internet trough VPN)

#Main Configuration#
port 1195
proto udp
dev tun
server 10.9.0.0 255.255.255.0

#Encryption#
cipher AES-256-CBC
comp-lzo

#Certificates#
ca ca.crt
cert server.crt
key server.key
tls-auth ta.key 0
dh dh2048.pem

#Networking#
push "route 10.10.0.0 255.255.255.0"
push "redirect-gateway def1"
push "dhcp-option DNS 10.10.0.1"
push "dhcp-option DNS 85.214.20.141"
keepalive 5 30
max-clients 3

#Logging#
status openvpn-status.log
log openvpn.log
verb 4
mute 20

#Rights#
persist-key
persist-tun
user nobody
group nogroup

rc.local config

# enable IP-Forward
echo 1 > /proc/sys/net/ipv4/ip_forward

# Forwarding
iptables -t nat -F POSTROUTING
iptables -t nat -A POSTROUTING -o eth0 -s 10.8.0.0/24 -j MASQUERADE
iptables -t nat -A POSTROUTING -o eth0 -s 10.9.0.0/24 -j MASQUERADE

oggy512

I solved the problem, here is my solution in case someone has a similar problem...

I'm now running three daemons, with three different subnets/tun devices. One for LAN only (10.8.0.0), one for WAN only (10.7.0.0) and one for LAN and WAN (10.9.0.0).
My local subnet is 10.10.0.0 on eth0, where also my inet gateway is in.
On startup I'm execute the following script, which defines the iptable rules.

#!/bin/sh

# Delete old FW rules
	iptables -F INPUT
	iptables -F OUTPUT
	iptables -F FORWARD
	iptables -t nat -F OUTPUT
	iptables -t nat -F PREROUTING
	iptables -t nat -F POSTROUTING

# Set STD-policy: Drop all
	iptables -P INPUT DROP
	iptables -P FORWARD DROP

# Allow local traffic
	iptables -P OUTPUT ACCEPT

# Enable IP forwarding
	echo 1 > /proc/sys/net/ipv4/ip_forward

# Except localhost
	iptables -A INPUT -i lo -j ACCEPT

# Open TCP ports 22, 5001
	iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Open UDP ports 1194, 1195, 1196
	iptables -A INPUT -p udp --dport 1194 -j ACCEPT
	iptables -A INPUT -p udp --dport 1195 -j ACCEPT
	iptables -A INPUT -p udp --dport 1196 -j ACCEPT

# Allow traffic from LAN to Server
	iptables -A INPUT -s 10.10.0.0/24 -j ACCEPT

# Allow traffic from VPN to LAN only
	iptables -I FORWARD -i tun0 -o eth0 \
        	-s 10.8.0.0/24 -d 10.10.0.0/24 \
	        -m conntrack --ctstate NEW -j ACCEPT

# Allow traffic from VPN to LAN + WAN
	iptables -I FORWARD -i tun1 -o eth0 \
        	-s 10.9.0.0/24 \
	        -m conntrack --ctstate NEW -j ACCEPT		 
		 
# Allow traffic from VPN to WAN only
	iptables -I FORWARD -i tun2 -o eth0 \
        	-s 10.7.0.0/24 \
	        -m conntrack --ctstate NEW -j ACCEPT		 
	iptables -I FORWARD -i tun2 -o eth0 \
        	-s 10.7.0.0/24 -d 10.10.0.0/24 \
	        -j DROP		 

# Allow back&forth traffic
	iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
	iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT