Re: iptables rules required for OpenVPN and Tor

On 22.01.24 12:01, Peter Davis wrote:
> On Monday, January 22nd, 2024 at 10:41 AM, Jochen Bern <[email protected]> wrote:
>> On 20.01.24 07:24, Peter Davis wrote:
>>> When someone connects to this server with OpenVPN and uses the Internet, then all his\her Internet connections are tunneled through Tor.
>>> I want to know which group of iptables rules are sufficient!
>>
>> Neither.
>>
>> If you want ALL his connections to the Internet to get redirected to
>> Tor, then you'll need to either a) remember IP and port he's actually
>> trying to connect to, or b) get the client to "talk proxy" (different
>> protocol) if it didn't yet. Blindly applying "-j DNAT --to 10.8.0.1:..."
>> everywhere erases that information from the actual connection attempt,
>> and does nothing to inform the client of changed requirements.
> 
> Hi,
> Thanks again.
> But it works, and when the user connects to the OpenVPN server, all his\her internet connections are tunneled through Tor. I just want to know which iptables rules are extra!
> 
> What iptables rules do you use for such a scenario?

Well, if it *works* right now, then the first thing you should do is to 
have a look at which rules do or don't get *triggered* by your tests. 
(I.e., use the "-v" option to iptables, but if you haven't done so since 
the last change of the setup, you might want to use "-Z" to reset the 
counters to zero and rerun the tests to get proper counts.)

My *guess* would be that your

> # iptables -A FORWARD -s $YOUR_OPENVPN_SUBNET -o $IF_MAIN -j ACCEPT
> # iptables -t nat -A POSTROUTING -s $YOUR_OPENVPN_SUBNET -o $IF_MAIN -j MASQUERADE

should be replaced by something like

# iptables -A INPUT -s $YOUR_OVPN_SUBNET -p tcp --dport 9040 -j ACCEPT
# iptables -A INPUT -s $YOUR_OVPN_SUBNET -p udp
	-m multiport --dports 9040,53530 -j ACCEPT

and I'd probably add

# iptables -I FORWARD -i $IF_TUNNEL -o $IF_MAIN -j REJECT

to be sure to suppress non-UDP non-TCP traffic going out unTored, but 
it's sure that you need *parts* of *both* blocks (as the second fails to 
make the VPN itself accessible to clients).

Kind regards,
-- 
Jochen Bern
Systemingenieur

Binect GmbH

_______________________________________________
Openvpn-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-users