Re: Perfect iptables for OpenVPN
Jörg Jellissen <[email protected]> Sun, 26 Dec 2021 14:02:19 +0100
| Newsgroups | gmane.linux.debian.devel.firewall |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
--------------bxQ0JWjUnJB1ZVpzNSiB8GHT
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Hello,
I'm using nftables with wireguard and it runs perfectly.
Don't forget the forward chain if your server runs as a router and you
have a private network behind your firewall.
openVPN is for me
Am 26.12.2021 um 00:09 schrieb linux_forum1:
> Hello, I'm trying to make the most specific, secure and restrictive
> iptables possible for a simple VPN connection on Debian. Could you
> have a quick look if those are OK? Thanks so much!
>
> VPN Server Port:1194
>
> VPN Server IP: 189.174.135.110
>
>
> -P INPUT DROP
> -P FORWARD DROP
> -P OUTPUT DROP
>
> #no fragmented packets
> -A INPUT -f -j DROP
> #localhost
> -A INPUT -s 127.0.0.0/8 ! -i lo -j DROP
> -A INPUT -i lo -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
> -A OUTPUT -o lo -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
> # first packet has to be TCP syn
> -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
> #drop sop icmp
> -A INPUT -p icmp --icmp-type address-mask-request -j DROP
> -A INPUT -p icmp --icmp-type timestamp-request -j DROP
> #Ping from inside to outside
> -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
> -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
> #drop broadcast, multicast anycast
> -A INPUT -m addrtype --dst-type BROADCAST -j DROP
> -A INPUT -m addrtype --dst-type MULTICAST -j DROP
> -A INPUT -m addrtype --dst-type ANYCAST -j DROP
> -A INPUT -d 224.0.0.0/4 -j DROP
> #drop invalid
> -A INPUT -m state --state INVALID -j DROP
> #drop spoofed packets
> -A INPUT -s 0.0.0.0/8 -j DROP
> -A INPUT -d 0.0.0.0/8 -j DROP
> -A INPUT -d 239.255.255.0/24 -j DROP
> -A INPUT -d 255.255.255.255 -j DROP
> # DROP RFC1918 PACKETS
> -A INPUT -s 10.0.0.0/8 -j DROP
> -A INPUT -s 172.16.0.0/12 -j DROP
> -A INPUT -s 192.168.0.0/16 -j DROP
> #Allow VPN
>
> - A INPUT -i eth0 -p udp -m udp -s 189.174.135.110
> <https://189.174.135.110/> -d 192.168.1.0/24
> <https://192.168.1.0/24> --sport 1194 --dport 32768:65535 -m conntrack
> --ctstate ESTABLISHED -j ACCEPT
>
> -A OUTPUT -o eth0 -p udp -m udp -s 192.168.1.0/24
> <https://192.168.1.0/24> -d 189.174.135.110
> <https://189.174.135.110/> --dport 1194 -m conntrack --ctstate
> NEW,ESTABLISHED -j ACCEPT
>
>
>
--------------bxQ0JWjUnJB1ZVpzNSiB8GHT
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hello,</p>
<p>I'm using nftables with wireguard and it runs perfectly.</p>
<p>Don't forget the forward chain if your server runs as a router
and you have a private network behind your firewall.</p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<p>openVPN is for me <br>
</p>
<div class="moz-cite-prefix">Am 26.12.2021 um 00:09 schrieb
linux_forum1:<br>
</div>
<blockquote type="cite"
cite="mid:4jq_HOXOHcD2jq71IS2YzN83YsH_mEqbDznbSQAKHdr_EtsQsjq830QIej3PqSpYk4oeEyWDYgaC5lQpdHnRQrG9EGU0dyg07v02T_i8hrQ=@protonmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div>Hello, I'm trying to make the most specific, secure and
restrictive iptables possible for a simple VPN connection on
Debian. Could you have a quick look if those are OK? Thanks so
much!<br>
</div>
<div><br>
</div>
<div>VPN Server Port:1194<br>
</div>
<p style="box-sizing: border-box; overflow-wrap: break-word;
word-break: break-word; margin: 0px 0px 10px; color: rgb(26, 26,
27); font-family: -apple-system, system-ui, BlinkMacSystemFont,
"Segoe UI", Roboto, "Helvetica Neue", Arial,
sans-serif; font-size: 14px; font-style: normal;
font-variant-ligatures: normal; font-variant-caps: normal;
font-weight: 400; letter-spacing: normal; orphans: 2;
text-align: start; text-indent: 0px; text-transform: none;
white-space: normal; widows: 2; word-spacing: 0px;
-webkit-text-stroke-width: 0px; background-color: rgb(255, 255,
255); text-decoration-thickness: initial; text-decoration-style:
initial; text-decoration-color: initial;">VPN Server IP:
189.174.135.110<br>
</p>
<div><br>
</div>
<div>-P INPUT DROP<br>
</div>
<div>-P FORWARD DROP<br>
</div>
<div>-P OUTPUT DROP<br>
</div>
<div><br>
</div>
<div>#no fragmented packets<br>
</div>
<div>-A INPUT -f -j DROP<br>
</div>
<div>#localhost<br>
</div>
<div>-A INPUT -s 127.0.0.0/8 ! -i lo -j DROP<br>
</div>
<div>-A INPUT -i lo -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT<br>
</div>
<div>-A OUTPUT -o lo -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT<br>
</div>
<div># first packet has to be TCP syn<br>
</div>
<div>-A INPUT -p tcp ! --syn -m state --state NEW -j DROP<br>
</div>
<div>#drop sop icmp<br>
</div>
<div>-A INPUT -p icmp --icmp-type address-mask-request -j DROP<br>
</div>
<div>-A INPUT -p icmp --icmp-type timestamp-request -j DROP<br>
</div>
<div>#Ping from inside to outside<br>
</div>
<div> -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT<br>
</div>
<div> -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT<br>
</div>
<div>#drop broadcast, multicast anycast<br>
</div>
<div>-A INPUT -m addrtype --dst-type BROADCAST -j DROP<br>
</div>
<div>-A INPUT -m addrtype --dst-type MULTICAST -j DROP<br>
</div>
<div>-A INPUT -m addrtype --dst-type ANYCAST -j DROP<br>
</div>
<div>-A INPUT -d 224.0.0.0/4 -j DROP<br>
</div>
<div>#drop invalid<br>
</div>
<div>-A INPUT -m state --state INVALID -j DROP<br>
</div>
<div>#drop spoofed packets<br>
</div>
<div>-A INPUT -s 0.0.0.0/8 -j DROP<br>
</div>
<div>-A INPUT -d 0.0.0.0/8 -j DROP<br>
</div>
<div>-A INPUT -d 239.255.255.0/24 -j DROP<br>
</div>
<div>-A INPUT -d 255.255.255.255 -j DROP<br>
</div>
<div># DROP RFC1918 PACKETS<br>
</div>
<div>-A INPUT -s 10.0.0.0/8 -j DROP<br>
</div>
<div>-A INPUT -s 172.16.0.0/12 -j DROP<br>
</div>
<div>-A INPUT -s 192.168.0.0/16 -j DROP<br>
</div>
<div>#Allow VPN<br>
</div>
<p dir="ltr">- A INPUT -i eth0 -p udp -m udp -s <a
href="https://189.174.135.110/" rel="noopener noreferrer"
target="_blank" moz-do-not-send="true">189.174.135.110</a> -d <a
href="https://192.168.1.0/24" rel="noopener noreferrer"
target="_blank" moz-do-not-send="true">192.168.1.0/24</a> --sport
1194 --dport 32768:65535 -m conntrack --ctstate ESTABLISHED -j
ACCEPT <br>
</p>
<div dir="ltr">-A OUTPUT -o eth0 -p udp -m udp -s <a
href="https://192.168.1.0/24" rel="noopener noreferrer"
target="_blank" moz-do-not-send="true">192.168.1.0/24</a> -d <a
href="https://189.174.135.110/" rel="noopener noreferrer"
target="_blank" moz-do-not-send="true">189.174.135.110</a> --dport
1194 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT <br>
</div>
<p style="box-sizing: border-box; overflow-wrap: break-word;
word-break: break-word; margin: 0px 0px 10px; font-size: 14px;
font-style: normal; font-variant-ligatures: normal;
font-variant-caps: normal; font-weight: 400; letter-spacing:
normal; orphans: 2; text-align: start; text-indent: 0px;
text-transform: none; white-space: normal; widows: 2;
word-spacing: 0px; -webkit-text-stroke-width: 0px;
text-decoration-thickness: initial; text-decoration-style:
initial; text-decoration-color: initial;"><br>
</p>
<div><br>
</div>
</blockquote>
</body>
</html>
--------------bxQ0JWjUnJB1ZVpzNSiB8GHT--