0

I set up an older laptop as an OpenVPN server for my home network (and a dwarffortress server, but that's beside the point). This is the first time I've set something like this up - I wanted a secure way of being able to ssh into my home network from outside.

In any case, I got it working (finally figured out I needed to port forward 1194 on my router), but I wanted to make sure that I'm not opening up things in the wrong way. Do these iptables-rules look reasonable?:

# Generated by iptables-save v1.4.21 on Sun Dec 28 02:16:10 2014
*nat
:PREROUTING ACCEPT [3:517]
:INPUT ACCEPT [3:517]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 192.168.88.0/24 -o wlp3s0 -j MASQUERADE
COMMIT
# Completed on Sun Dec 28 02:16:10 2014
# Generated by iptables-save v1.4.21 on Sun Dec 28 02:16:10 2014
*filter
:INPUT ACCEPT [323:24107]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [152:13348]
-A INPUT -i tun+ -j ACCEPT
-A FORWARD -i tun+ -j ACCEPT
-A FORWARD -s 192.168.88.0/24 -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Sun Dec 28 02:16:10 2014

Edit: Ok, here are my current rules:

# Generated by iptables-save v1.4.21 on Mon Dec 29 03:36:02 2014
*filter
:INPUT DROP [14:2325]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [2:144]
-A INPUT -i tun+ -j ACCEPT
-A INPUT -i wlp3s0 -p udp -m udp --dport 1194 -m state --state NEW -j ACCEPT
-A INPUT -s 192.168.1.0/24 -i wlp3s0 -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
-A FORWARD -i tun+ -j ACCEPT
-A FORWARD -s 192.168.88.0/24 -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o wlp3s0 -p tcp -m tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
COMMIT
# Completed on Mon Dec 29 03:36:02 2014
# Generated by iptables-save v1.4.21 on Mon Dec 29 03:36:02 2014
*nat
:PREROUTING ACCEPT [389:94808]
:INPUT ACCEPT [1:60]
:OUTPUT ACCEPT [1:72]
:POSTROUTING ACCEPT [1:72]
-A POSTROUTING -s 192.168.88.0/24 -o wlp3s0 -j MASQUERADE
COMMIT
# Completed on Mon Dec 29 03:36:02 2014

I can make SSH connections internal to my network (though it seems slower to connect/ask for password than before), but now I am unable to make an OpenVPN connection from outside.

1

Nope, it's not enough to ACCEPT traffic on tun interface. You will also need to open 1194/udp port in INPUT chain.

-A INPUT -i wlp3s0  -j ACCEPT -m udp -p udp --dport 1194 -m state --state NEW -j ACCEPT

You should also setup a default policy for INPUT chain to DROP. Now you allow all incoming connections!

*filter
:INPUT DROP [323:24107]

HTH

  • So is there a security hole the way I have it now? I have been able to connect successfully to it. – emacsomancer Dec 29 '14 at 3:24
  • 1
    Well, yes. It can be established any connection from outside world to your laptop. It is Ok as far as your router is guarding but if you take laptop outside, it would be better to setup firewall as I described. – Scyld de Fraud Dec 29 '14 at 14:04
  • 1
    Remove first occurence of -j ACCEPT. Sorry for that. – Scyld de Fraud Dec 29 '14 at 16:18
  • 1
    First: iptables -I INPUT 1 -m state --state RELATED,ESTABLISHED -j ACCEPT. Second: iptables -A INPUT -i wlp3s0 -p tcp -m tcp -s 192.168.1.0/24 --dport 22 -m state --state NEW -j ACCEPT. – Scyld de Fraud Dec 29 '14 at 17:37
  • 1
    You can remove the first one. – Scyld de Fraud Dec 29 '14 at 18:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.