WiVM
Hi,
I originally asked my question on the CentOS forums, but no answer is coming so I expect it to be a bit too OpenVPN related.
I notice that most OpenVPN guides disable firewalld and use IPtables instead, but I want to stick to firewalld as it is default on CentOS. My setup consists of two CentOS 7.7 systems that enable a site-to-site OpenVPN tunnel between two offices.
One of the two servers has two NICs, of which one is connected to the internet (and protected by hardware firewall) and the other one is connected to a private network. The other server has only one NIC connected to a private network and connects via NAT to the internet (hardware firewall not in this scope). The idea is that the server with the one NIC has a permanent connection to the server with the two NICs, with as goal to reach the private network on that remote network. OpenVPN is working fine. I can make connections without any problems, also to devices on that private network.
The question is: how can I protect the private range from connecting to my devices on the remote network apart from specific services that I allow?
SERVER1 = eth0 = 123.123.123.123 (NAT: 10.20.20.0/23) <=== UDP 9999 OpenVPN Tunnel ===> SERVER2 = eth0 = 231.231.231.213/32 + eth1 = 10.10.10.0/23
All interfaces are in the default public zone. Masquerade is disabled. At the moment I only have SSH and my OpenVPN UDP port open between both sides:
SERVER1:
sudo firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="231.231.231.213" port port=9999 protocol=udp accept' --permanent
sudo firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="231.231.231.213" port port=22 protocol=tcp accept' --permanent
SERVER2:
sudo firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="123.123.123.123" port port=9999 protocol=udp accept' --permanent
sudo firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="123.123.123.123" port port=22 protocol=tcp accept' --permanent
I enabled 'net.ipv4.ip_forward = 1' on both CentOS servers.
So basically 10.10.10.0/23 should have limited access to devices on 10.20.20.0/23 over the VPN tunnel connection. I do control access on the devices itself, but want it as an extra filter just in case as those local firewalls are sometimes default Windows firewalls that I don't trust.
Update:
It actually looks like I am only able to ping all the devices over the VPN tunnel in both directions, but nothing more. When I test on the OpenVPN host 10.10.10.10 in the remote network it is able to connect to remote ports on any device in the 10.10.10.0/23 range, but when I try the same thing from a host on the 10.20.20.0/23 network (over the VPN tunnel), it isn't able to connect to any device on 10.10.10.0/23 except the remote VPN server itself.
I tried to add port on the remote SERVER1 (10.10.10.10) but that doesn't seem to change anything.
sudo firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="10.10.10.11" port port=22 protocol=tcp accept' --permanent
I did save and reload firewalld.
Thanks!
