IPTables FORWARD rules not blocking intended IP address

cal-meacham

Hi.

My Setup:

Ubuntu Server 16.04 @ 10.0.77.6

OpenVPN Server address @ 10.0.88.0/24

Client configured with fixed IP 10.0.88.77 (CCD directory)

UFW firewall turned off - Using IPTables.

My IPTables config looks like this:

Chain INPUT (policy DROP 3 packets, 285 bytes)
num   pkts bytes target     prot opt in     out     source               destination
1       16  1344 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
2    13362 1632K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
3       14  1148 ACCEPT     udp  --  ens18  *       0.0.0.0/0            0.0.0.0/0            state NEW,ESTABLISHED udp dpt:1194
4        1    64 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22

Chain FORWARD (policy DROP 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination
1     2122  266K ACCEPT     all  --  tun0   ens18   0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
2     2267 1963K ACCEPT     all  --  ens18  tun0    0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
3        0     0 DROP       all  --  tun0   *       10.0.88.77           10.0.77.4            ctstate NEW
4      189 12257 ACCEPT     all  --  tun0   *       10.0.88.0/24         0.0.0.0/0            ctstate NEW

Chain OUTPUT (policy ACCEPT 4 packets, 632 bytes)
num   pkts bytes target     prot opt in     out     source               destination

and my OPENVPN config looks like so:

port 1194
proto udp
dev tun

topology subnet

ca ca.crt # ca certificate
cert ovpn-rz.crt #ovpn server certificare
key ovpn-rz.key # ovpn private key
dh dh.pem # The Diffe-Hellman signature

server 10.0.88.0 255.255.255.0

ifconfig-pool-persist ipp.txt # Maintain a record of client <-> virtual IP addresses

push "redirect-gateway def1 bypass-dhcp" # force all traffic through VPN
push "dhcp-option DNS 10.0.77.5"

keepalive 10 120

tls-auth ta.key 0 # The HMAC signature file. This file is secret

cipher AES-256-CBC
comp-lzo

user nobody
group nogroup

persist-key
persist-tun

status /var/log/openvpn/openvpn-status.log

log /var/log/openvpn/openvpn.log
# log-append /var/log/openvpn/openvpn.log
verb 3

auth SHA256

client-config-dir ccd

Everything works. I can connect to the OVPN Server, my client recieves the correct fixed IP as configured in the OpenVPN server config and I can browse the web, access servers on the LAN and use my LAN DNS. The only thing that is not working is blocking the VPN client from accessing certain servers on the LAN side of the VPN. I've been at it for days following guides on the official OpenVPN site and no rule I use will block 10.0.88.77 from accessing 10.0.77.4. Here is what I have tried so far:

sudo iptables -I FORWARD 3 -i tun0 -s 10.0.88.77 -d 10.0.77.4 -m conntrack --ctstate NEW -j DROP

sudo iptables -I FORWARD 3 -i tun0 -s 10.0.88.77 -d 10.0.77.4 -j DROP

Is this a rule order issue? It's my understanding that IPTables reads rules top down so I would want my DROP rule before my ALLOW rule. Any help would be appreciated as I have already followed the official guide as well a couple of posts I found on the forums.

Thanks.

cal-meacham

Hi again -

I think I have figured it out (Well, someone on here did 😃 ). I came across this post https://forums.openvpn.net/viewtopic.php?t=25710 and it seems to have made things work in a way that makes sense. One of the things that didn't make sense to me was that (with my openvpn config above) the FORWARD default policy made no difference on wether or not I could contact other clients on the network, for example:

 sudo iptables -P FORWARD DENY

I would not be able to ping hosts on the LAN by name but could ping them by IP. To my mind, the default DENY should,well,deny this particular action. As Pippin stated in the linked post:

So basically, route full networks, then use firewall rules to control access.

The key is to include the option:

 push "route ip_range subnet"

As soon as this option was added, things fell in to place. I restarted the OpenVPN service and reconnected my phone (IPTables FORWARD default policy set to DENY) and although I could connect, the Firewall rule was blocking everything. Changing the default FORWARD policy to ACCEPT allowed access to the LAN and the web. Now it is just a matter of using Firewall rules in the FORWARD chain to control what goes where.
Special thanks to BobAGI for the fantastic detective work.