jorgsmash
Hey guys.
My OpenVPN server is set up to allow my cousin (client) VPN access to my network to access a file server I have on a Windows computer. I got to thinking that I'd like to block the client from accessing my entire LAN and just allow access to the one Windows server, and more specifically, just port 445 to allow access to the file share. I got this configured last night, and I ran some scans using nmap from the client machine, and the client machine can no longer access any other devices on my LAN other than the 192.168.50.10 device and only port 445 on that device.
Router: 192.168.50.1
VPN Server: 192.168.50.3
Samba Server (windows): 192.168.50.10
Client: 10.8.0.3
Now the only other thing I noticed, the client can port scan the ip of the server (192.168.50.3) and can see ssh open. Client can see port 22 (ssh). I would like to use iptables to block the client from accessing any ports that are unnecessary. They don't need to access port 22.
These are the rules I came up with last night, which blocks the client from accessing everything on the LAN except for port 445 on 192.168.50.10. I checked to make sure, and the SMB file share is working. I had to accept udp 53 to the router so the client could access Internet. This is the ruleset I ended up with
# iptables -L --line-numbers
Chain INPUT (policy ACCEPT)
num target prot opt source destination
Chain FORWARD (policy ACCEPT)
num target prot opt source destination
1 ACCEPT udp -- 10.8.0.3 Router udp dpt:domain
2 ACCEPT tcp -- 10.8.0.3 windows tcp dpt:microsoft-ds
3 DROP all -- 10.8.0.3 192.168.50.0/24
----------------------------------------
These are the rules I tried to implement to block the client from accessing specific ports on the server.
# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
DROP tcp -- 10.8.0.3 0.0.0.0 tcp dpt:ssh
Chain FORWARD (policy ACCEPT)
target prot opt source destination
DROP tcp -- 10.8.0.3 localhost.localdomain tcp dpt:ssh
ACCEPT udp -- 10.8.0.3 router udp dpt:domain
ACCEPT tcp -- 10.8.0.3 192.168.50.10 tcp dpt:microsoft-ds
DROP all -- 10.8.0.3 192.168.50.0/24
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
-----------------------------------------
Unfortunately none of these rules accomplished what I was trying to do, which is block the client from seeing port 22 open on the server.
Any ideas? Thanks all!
