Blocking ipv6 traffic through tunnel, LAN still accessible
Posted: Fri Mar 18, 2022 4:16 pm
Hi, I have an OpenVPN server setup on my LAN, and for the sake of testing I am connecting from another machine that is also on my LAN (I don't currently have hold of a public IPv6 address so I am using my local network for testing IPv6).
I have read this old forum post viewtopic.php?t=22057 which details how I can filter out IPv6 traffic by directing it all through the tunnel and dropping it with a route serverside. Theoretically this would mean I could connect to this server from another device on my network, and I would be unable to ping any IPv6 address on my local network, but that isn't what happens. I push the route of address range "::/0" to the client meaning I should not be able to access anything in the IPv6 range, but I can still access any of my IPv6 addresses.
This is my server config:
This is my client config:
And this is my server log upon connection:
Finally, this is the ip6tables rules on the server, which I've setup to drop 'FORWARD' and 'OUTPUT' traffic:
If I change the 'INPUT' rule to '-P INPUT DROP' then I can no longer ping my server's IPv6 (all others still accessible), although that counts for outside the tunnel as well so it doesn't really solve anything. Is there anything that stands out in my configuration that I'm doing wrong? Thanks.
I have read this old forum post viewtopic.php?t=22057 which details how I can filter out IPv6 traffic by directing it all through the tunnel and dropping it with a route serverside. Theoretically this would mean I could connect to this server from another device on my network, and I would be unable to ping any IPv6 address on my local network, but that isn't what happens. I push the route of address range "::/0" to the client meaning I should not be able to access anything in the IPv6 range, but I can still access any of my IPv6 addresses.
This is my server config:
Code: Select all
local 192.168.0.27
port 69
proto udp
dev tun0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-crypt tc.key
topology subnet
server 10.8.0.0 255.255.254.0
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 1.0.0.1"
push "redirect-gateway def1 ipv6 bypass-dhcp"
push "route 192.168.0.0 255.255.0.0 net_gateway"
server-ipv6 2001:db8:0:123::/64
;tun-ipv6
;push tun-ipv6
;push "route-ipv6 2000::/3"
push "route-ipv6 ::/0"
push "explicit-exit-notify 2"
cipher AES-256-CBC
persist-key
persist-tun
ping-exit 30
status openvpn-status.log
verb 4
crl-verify crl.pem
management localhost 7505
script-security 3
learn-address "/etc/openvpn/server/learn-address.sh"
client-disconnect "/etc/openvpn/server/client-disconnect.sh"
max-clients 100
auth-user-pass-verify /etc/openvpn/server/clientCheck.sh via-env
verify-client-cert noneCode: Select all
client
dev tun
proto udp
remote 192.168.0.27 69
resolv-retry infinite
nobind
persist-key
persist-tun
remote-random
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
ignore-unknown-option block-outside-dns
explicit-exit-notify 2
verb 4
auth-user-pass
pull
ping 30
<ca>
</ca>
<cert>
</cert>
<key>
</key>
<tls-crypt>
</tls-crypt>Code: Select all
>LOG:1647619548,,MULTI: multi_create_instance called
>LOG:1647619548,,192.168.0.33:57199 Re-using SSL/TLS context
>LOG:1647619548,,192.168.0.33:57199 Control Channel MTU parms [ L:1621 D:1156 EF:94 EB:0 ET:0 EL:3 ]
>LOG:1647619548,,192.168.0.33:57199 Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
>LOG:1647619548,,192.168.0.33:57199 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-server'
>LOG:1647619548,,192.168.0.33:57199 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-client'
>LOG:1647619548,,192.168.0.33:57199 TLS: Initial packet from [AF_INET]192.168.0.33:57199, sid=167d9bf9 77168916
>LOG:1647619548,I,192.168.0.33:57199 peer info: IV_VER=2.5.1
>LOG:1647619548,I,192.168.0.33:57199 peer info: IV_PLAT=linux
>LOG:1647619548,I,192.168.0.33:57199 peer info: IV_PROTO=6
>LOG:1647619548,I,192.168.0.33:57199 peer info: IV_NCP=2
>LOG:1647619548,I,192.168.0.33:57199 peer info: IV_CIPHERS=AES-256-GCM:AES-128-GCM:AES-256-CBC
>LOG:1647619548,I,192.168.0.33:57199 peer info: IV_LZ4=1
>LOG:1647619548,I,192.168.0.33:57199 peer info: IV_LZ4v2=1
>LOG:1647619548,I,192.168.0.33:57199 peer info: IV_LZO=1
>LOG:1647619548,I,192.168.0.33:57199 peer info: IV_COMP_STUB=1
>LOG:1647619548,I,192.168.0.33:57199 peer info: IV_COMP_STUBv2=1
>LOG:1647619548,I,192.168.0.33:57199 peer info: IV_TCPNL=1
>LOG:1647619551,,192.168.0.33:57199 TLS: Username/Password authentication succeeded for username 'user'
>LOG:1647619551,,192.168.0.33:57199 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384
>LOG:1647619551,I,192.168.0.33:57199 [] Peer Connection Initiated with [AF_INET]192.168.0.33:57199
>LOG:1647619551,I,192.168.0.33:57199 MULTI_sva: pool returned IPv4=10.8.0.4, IPv6=2001:db8:0:123::1002
>LOG:1647619551,,192.168.0.33:57199 MULTI: Learn: 10.8.0.4 -> 192.168.0.33:57199
>LOG:1647619551,,192.168.0.33:57199 MULTI: primary virtual IP for 192.168.0.33:57199: 10.8.0.4
>LOG:1647619551,,192.168.0.33:57199 MULTI: Learn: 2001:db8:0:123::1002 -> 192.168.0.33:57199
>LOG:1647619551,,192.168.0.33:57199 MULTI: primary virtual IPv6 for 192.168.0.33:57199: 2001:db8:0:123::1002
>CLIENT:ESTABLISHED,2
>CLIENT:ENV,n_clients=1
>CLIENT:ENV,script_type=learn-address
>CLIENT:ENV,time_unix=1647619548
>CLIENT:ENV,time_ascii=Fri Mar 18 16:05:48 2022
>CLIENT:ENV,ifconfig_pool_ip6_netbits=64
>CLIENT:ENV,ifconfig_pool_local_ip6=2001:db8:0:123::1
>CLIENT:ENV,ifconfig_pool_remote_ip6=2001:db8:0:123::1002
>CLIENT:ENV,ifconfig_pool_netmask=255.255.254.0
>CLIENT:ENV,ifconfig_pool_remote_ip=10.8.0.4
>CLIENT:ENV,trusted_port=57199
>CLIENT:ENV,trusted_ip=192.168.0.33
>CLIENT:ENV,untrusted_port=57199
>CLIENT:ENV,untrusted_ip=192.168.0.33
>CLIENT:ENV,username=user
>CLIENT:ENV,IV_TCPNL=1
>CLIENT:ENV,IV_COMP_STUBv2=1
>CLIENT:ENV,IV_COMP_STUB=1
>CLIENT:ENV,IV_LZO=1
>CLIENT:ENV,IV_LZ4v2=1
>CLIENT:ENV,IV_LZ4=1
>CLIENT:ENV,IV_CIPHERS=AES-256-GCM:AES-128-GCM:AES-256-CBC
>CLIENT:ENV,IV_NCP=2
>CLIENT:ENV,IV_PROTO=6
>CLIENT:ENV,IV_PLAT=linux
>CLIENT:ENV,IV_VER=2.5.1
>CLIENT:ENV,remote_port_1=69
>CLIENT:ENV,local_port_1=69
>CLIENT:ENV,local_1=192.168.0.27
>CLIENT:ENV,proto_1=udp
>CLIENT:ENV,daemon_pid=2519
>CLIENT:ENV,daemon_start_time=1647618626
>CLIENT:ENV,daemon_log_redirect=0
>CLIENT:ENV,daemon=0
>CLIENT:ENV,verb=0
>CLIENT:ENV,config=server.conf
>CLIENT:ENV,ifconfig_local=10.8.0.1
>CLIENT:ENV,ifconfig_netmask=255.255.254.0
>CLIENT:ENV,ifconfig_broadcast=10.8.1.255
>CLIENT:ENV,ifconfig_ipv6_local=2001:db8:0:123::1
>CLIENT:ENV,ifconfig_ipv6_netbits=64
>CLIENT:ENV,ifconfig_ipv6_remote=2001:db8:0:123::2
>CLIENT:ENV,script_context=init
>CLIENT:ENV,tun_mtu=1500
>CLIENT:ENV,link_mtu=1621
>CLIENT:ENV,dev=tun0
>CLIENT:ENV,dev_type=tun
>CLIENT:ENV,redirect_gateway=0
>CLIENT:ENV,END
>LOG:1647619552,,192.168.0.33:57199 PUSH: Received control message: 'PUSH_REQUEST'
>LOG:1647619552,,192.168.0.33:57199 SENT CONTROL [UNDEF]: 'PUSH_REPLY,dhcp-option DNS 1.1.1.1,dhcp-option DNS 1.0.0.1,redirect-gateway def1 ipv6 bypass-dhcp,route 192.168.0.0 255.255.0.0 net_gateway,route-ipv6 ::/0,explicit-exit-notify 2,tun-ipv6,route-gateway 10.8.0.1,topology subnet,ifconfig-ipv6 2001:db8:0:123::1002/64 2001:db8:0:123::1,ifconfig 10.8.0.4 255.255.254.0,peer-id 0,cipher AES-256-GCM' (status=1)
>LOG:1647619552,,192.168.0.33:57199 Data Channel: using negotiated cipher 'AES-256-GCM'
>LOG:1647619552,,192.168.0.33:57199 Data Channel MTU parms [ L:1549 D:1450 EF:49 EB:406 ET:0 EL:3 ]
>LOG:1647619552,,192.168.0.33:57199 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
>LOG:1647619552,,192.168.0.33:57199 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit keyCode: Select all
-P INPUT ACCEPT
-P FORWARD DROP
-P OUTPUT DROP
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT