iptables: How to allow only SSH and VPN traffic?

Question

I have a dedicated server with Ubuntu 14.10 installed.

The server should connect to an OpenVPN server and the traffic should only go through the VPN, except for SSH traffic.

My idea is to implement this with iptables, but I am not a specialist.

What exactly should be handled with iptables?

Supposing below are the basic conditions:

1. Allow only traffic through VPN. When my server loses connection to the VPN, there should be no traffic leak.

2. Allow SSH without VPN. I want to connect to my server with SSH and its normal IP from the server provider (but only SSH traffic).

3. Since I am not the only user of the VPN, I want to hide my server in the VPN from other computers.

I started to create my iptables rules but it always blocks all my connections:

# flush old rules
iptables -F

# accept SSH traffic with non vpn connection
iptables -A INPUT -d X.X.X.X -p tcp --dport 22 -j ACCEPT 
iptables -A OUTPUT -s X.X.X.X -p tcp --sport 22 -j ACCEPT 

# block everything except my rules
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# allow loopback
iptables -A INPUT  -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# allow vpn
iptables -A INPUT  -j ACCEPT -p udp -s Y.Y.Y.Y --sport 1194
iptables -A OUTPUT -j ACCEPT -p udp -d Y.Y.Y.Y --dport 1194

X.X.X.X is the server IP from the provider.
Y.Y.Y.Y is the IP of the VPN server.

The rules always kick me out of my current SSH connection and I can't create new SSH connection, although it should accept traffic through the port 22.

Answer 1

Keep in mind on your -d option, if you wanna apply on all adapters just don't use this option, like iptables -A INPUT -p tcp --dport 22 -j ACCEPT

Answer 2

EDIT:

Allow only traffic through VPN. When my server loses connection to the VPN, there should be no traffic leak.

This should care for your VPN application. For instance PIA (Private Internet Access) calls this a Kill Switch, you can simply enable in the application.

Allow SSH without VPN. I want to connect to my server with SSH and its normal IP from the server provider (but only SSH traffic).

Well, this contradicts the Kill Switch above.

As a VPN user myself I solved it with not connecting to its local IP, say 192.168.0.xxx, but to its public address, and enabling a specific port for my server rather than using the 22, because I have several servers at home, so you might want to think about it too. This also means you will need to redirect that port from your router to that server and making iptables rule for this port.

Since I am not the only user of the VPN, I want to hide my server in the VPN from other computers.

As you haven't described your environment, I can only say, that I'd disable some services like samba etc.

---

ORIGINAL ANSWER:

According to the man page:

--sport is short for --source-port  
--dport is short for --destination-port

In your case, I believe you shall use only --dport option.

Answer 3

If you are concerned about leaks, not just making the data available only through vpn available, then the safest way to do it is with separate machines. The machine running openvpn and ssh should be the only one that is directly on the internet; others must use a private address, and use a proxy or gateway through that one.

That way if you misconfigure something, such as dns, it'll just fail instead of going through the wrong network. You can achieve that with virtual machines if you don't want physical ones. But a VM also has more attack surface... a hacked VM might be able to exploit a bug to reach the host easier than another machine on the network.

Answer 4

There are several issues here.

First off, you need to allow a few more things.

• Traffic over the VPN. It will be a specific named device, or class of named devices. If the VPN is up, you should see it in the output of ip link or ifconfig. This otherwise looks like your "allow loopback" entries.
• Related packets. This allows ICMP messages for your connections.

You are probably better off allowing, in the first rule, the established connections. This makes testing faster. Combined with the second point above, that would be:

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

This also has the advantage that it will prevent your existing SSH connection being shut down.

While testing, don't set the policy rules until things seem to work. Also, add a LOG rule to record what isn't being accepted:

iptables -A INPUT -j LOG
iptables -A OUTPUT -j LOG

You will see this output on the console, via dmesg, and via the system log. These rules aren't needed once everything works. (But they can show you how much you are being attacked.)

Once you can make a new SSH connection without getting anything logged, then it is time to set the policy rules.

---

The one other thing you may need to do is some careful routing work. If the VPN is to the internet at large (not impossible), then the SSH and VPN data exceptions can become hairy. Your VPN software should document or handle this for you.