Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I recently enabled IP Forwarding on a production web server that also acts as a VPN server. What, if any, security issues did I just set myself up for? And are there any iptables rules I should set up to limit forwarding to my VPN tunnel?

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

You will only have security issues if your server gets compromised. Anyone/thing that gets into your server will have access to machines on your network, as if it was the server (your machines probably trust your server). You should definitely have some iptables rules! Basically you want iptables to block everything from the outside world to your firewall, except your webserver port(s) and VPN server port(s).

I would recommend something like shorewall http://www.shorewall.net/ to set this up for you, but some people think coming up with the iptables rules yourself if better since you'll understand more about what's going on.

share|improve this answer
1  
I must say that the sentence "You will only have security issues if your server gets compromised." looks funny :) –  rozcietrzewiacz Sep 1 '11 at 6:41
add comment

You should definitely minimize any routing-capability of that server by using iptables (FORWARD).

Which VPN-server do you run? Do you have fixed addresses for your VPN-accounts? I suppose you have basic knowledge how iptables should be called (what option/argument does what)?

Some example-rules might look like that, you have to replace XXXX and variables with sensible values fitting your setup:

IPT=/usr/sbin/iptables
# deactivate FORWARD by default as you only want to grant access with a whitelist.
$IPT -P FORWARD DROP
# allow established connections
$IPT -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
# allow access to your VPN-server from the outside
$IPT -A INPUT -i $OUTER_INTERFACE -p XXXX --dport XXXX -j ACCEPT
# allow access to some host (-d)/protocol (-p)/destination port (--dport) from one VPN-account
$IPT -A FORWARD -i $VPN_INTERFACE -o $LAN_OR_OUTER_INTERFACE -s $IP_FROM_VPN -d $SOME_HOST -p XXXX --dport XXXX
# allow access from your LAN-network/-host to the VPN-clients
$IPT -A FORWARD -i $LAN_INTERFACE -o $VPN_INTERFACE -s $LAN_NET_OR_HOST -j ACCEPT
# allow access from the VPN to the WAN
$IPT -A FORWARD -i $VPN_INTERFACE -o $OUTER_INTERFACE -s $VPN_NET_OR_HOST -j ACCEPT
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.