I have a Model 3 Raspberry Pi with Raspbian Linux 8.0 set up as a VPN router. It has the following network interfaces:
- eth0 - configured as wired Internet uplink (currently not used)
- wlan0 - wireless Internet uplink (active)
- eth1 (subnet 192.168.5.0/24) - wired client LAN (for my PC)
- wlan1 (subnet 192.168.4.0/24) - client WLAN (for my phone)
- tun0, tun1 - VPN interfaces
Everything is working as I want (client connections go through the VPN), except for one thing: it seems to be routing between eth1 and wlan1, which I don't want. I don't want client machines on wlan1 to be able to connect to machines on eth1, but they can. I also don't want machine on the client WLAN to be able to SSH to the Pi, only machines connected by Ethernet, but currently they can. I have SSH set up to listen only on 192.168.5.1 (not on 192.168.4.1), but if I connect to the client WLAN I can still SSH to 192.168.5.1.
I have IP forwarding enable, of course, since I want it to route between wlan1 and tun0/tun1 and between eth1 and tun0/tun1.
Here are my iptables rules:
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A FORWARD -s 192.168.4.0/24 -i wlan1 -o eth0 -m conntrack --ctstate NEW -m comment --comment "Block traffic from wlan1 (client WiFi) to eth0 (wired uplink)" -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -s 192.168.4.0/24 -i wlan1 -o wlan0 -m conntrack --ctstate NEW -m comment --comment "Block traffic from wlan1 (client WiFi) to wlan0 (WiFi uplink)" -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -s 192.168.4.0/24 -i wlan1 -o tun0 -m conntrack --ctstate NEW -m comment --comment "Allow traffic from wlan1 (client WiFi) to tun0 (VPN)" -j ACCEPT
-A FORWARD -s 192.168.4.0/24 -i wlan1 -o tun1 -m conntrack --ctstate NEW -m comment --comment "Allow traffic from wlan1 (client WiFi) to tun1 (VPN)" -j ACCEPT
-A FORWARD -s 192.168.5.0/24 -i eth1 -o eth0 -m conntrack --ctstate NEW -m comment --comment "Block traffic from eth1 (client LAN) to eth0 (wired uplink)" -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -s 192.168.5.0/24 -i eth1 -o wlan0 -m conntrack --ctstate NEW -m comment --comment "Block traffic from eth1 (client LAN) to wlan0 (WiFi uplink)" -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -s 192.168.5.0/24 -i eth1 -o tun0 -m conntrack --ctstate NEW -m comment --comment "Allow traffic from eth1 (client LAN) to tun0 (VPN)" -j ACCEPT
-A FORWARD -s 192.168.5.0/24 -i eth1 -o tun1 -m conntrack --ctstate NEW -m comment --comment "Allow traffic from eth1 (client LAN) to tun1 (VPN)" -j ACCEPT
-A FORWARD -s 192.168.4.0/24 -i wlan1 -o eth1 -m conntrack --ctstate NEW -m comment --comment "Block traffic from wlan1 (client WiFi) to eth1 (client LAN)" -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -s 192.168.4.0/24 -d 192.168.5.0/24 -m conntrack --ctstate NEW -m comment --comment "Block traffic from client WiFi range to client LAN range" -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -s 192.168.5.0/24 -i eth1 -o wlan1 -m conntrack --ctstate NEW -m comment --comment "Block traffic from eth1 (client LAN) to wlan1 (client WiFi)" -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -s 192.168.5.0/24 -d 192.168.4.0/24 -m conntrack --ctstate NEW -m comment --comment "Block traffic from client LAN range to client WiFi range" -j REJECT --reject-with icmp-port-unreachable
COMMIT
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o eth0 -m comment --comment "Use VPN IP for eth0" -j MASQUERADE
-A POSTROUTING -o wlan0 -m comment --comment "Use VPN IP for wlan0" -j MASQUERADE
-A POSTROUTING -o tun0 -m comment --comment "Use VPN IP for tun0" -j MASQUERADE
-A POSTROUTING -o tun1 -m comment --comment "Use VPN IP for tun1" -j MASQUERADE
COMMIT
