2

I have a dedicated server with Ubuntu 14.10 installed.

The server should connect to an OpenVPN server and the traffic should only go through the VPN, except for SSH traffic.

My idea is to implement this with iptables, but I am not a specialist.

What exactly should be handled with iptables?

Supposing below are the basic conditions:

  1. Allow only traffic through VPN. When my server loses connection to the VPN, there should be no traffic leak.

  2. Allow SSH without VPN. I want to connect to my server with SSH and its normal IP from the server provider (but only SSH traffic).

  3. Since I am not the only user of the VPN, I want to hide my server in the VPN from other computers.

I started to create my iptables rules but it always blocks all my connections:

# flush old rules
iptables -F

# accept SSH traffic with non vpn connection
iptables -A INPUT -d X.X.X.X -p tcp --dport 22 -j ACCEPT 
iptables -A OUTPUT -s X.X.X.X -p tcp --sport 22 -j ACCEPT 

# block everything except my rules
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# allow loopback
iptables -A INPUT  -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# allow vpn
iptables -A INPUT  -j ACCEPT -p udp -s Y.Y.Y.Y --sport 1194
iptables -A OUTPUT -j ACCEPT -p udp -d Y.Y.Y.Y --dport 1194

X.X.X.X is the server IP from the provider.
Y.Y.Y.Y is the IP of the VPN server.

The rules always kick me out of my current SSH connection and I can't create new SSH connection, although it should accept traffic through the port 22.

0

Keep in mind on your -d option, if you wanna apply on all adapters just don't use this option, like iptables -A INPUT -p tcp --dport 22 -j ACCEPT

0

EDIT:

Allow only traffic through VPN. When my server loses connection to the VPN, there should be no traffic leak.

This should care for your VPN application. For instance PIA (Private Internet Access) calls this a Kill Switch, you can simply enable in the application.

Allow SSH without VPN. I want to connect to my server with SSH and its normal IP from the server provider (but only SSH traffic).

Well, this contradicts the Kill Switch above.

As a VPN user myself I solved it with not connecting to its local IP, say 192.168.0.xxx, but to its public address, and enabling a specific port for my server rather than using the 22, because I have several servers at home, so you might want to think about it too. This also means you will need to redirect that port from your router to that server and making iptables rule for this port.

Since I am not the only user of the VPN, I want to hide my server in the VPN from other computers.

As you haven't described your environment, I can only say, that I'd disable some services like samba etc.


ORIGINAL ANSWER:

According to the man page:

--sport is short for --source-port  
--dport is short for --destination-port

In your case, I believe you shall use only --dport option.

0

If you are concerned about leaks, not just making the data available only through vpn available, then the safest way to do it is with separate machines. The machine running openvpn and ssh should be the only one that is directly on the internet; others must use a private address, and use a proxy or gateway through that one.

That way if you misconfigure something, such as dns, it'll just fail instead of going through the wrong network. You can achieve that with virtual machines if you don't want physical ones. But a VM also has more attack surface... a hacked VM might be able to exploit a bug to reach the host easier than another machine on the network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.