0

I've gone through all the possible threads and answers and still I'm not sure how to achieve this. Is following scenario even possible in the first place?

I've ubuntu 16.04 server which has OpenVPN installed and running. I can connect to this VPN through Windows client. The server also hosts some files that I need an access to, and I would like to use FTP for time being (SFTP is better, I know). Can I make it so, that the FTP port is only accessible through my VPN connection?

Because I'm not sure and this same question has been asked hundreths of times, could someone point me in the right direction?

2

You have several options.

  1. Configure your FTP server to listen only your OpenVPN interface/address.

  2. Use iptables to filter out traffic from other than OpenVPN interface. If your default policy is DROP and your OpenVPN interface name is tun0 to accept all traffic from OpenVPN interface:

    iptables -A INPUT -i tun0 -j ACCEPT
    

    or alternatively accept matching by your OpenVPN network, for example in case your OpenVPN configuration uses addresses in 10.8.0.0/24 network:

    iptables -A INPUT -s 10.8.0.0/24 -j ACCEPT
    

    If you want more specific rules to limit the rules for only FTP, you need to match FTP ports and for passive FTP also use RELATED target. Quite good explanation is provided by this answer on server fault. Configuring matching rule by port number is simpler for SSH (and SFTP) since it doesn't use any other incoming ports.

    When your default policy for OUTPUT chain is DROP you need to also have similar rules to allow outgoing traffic (-A OUTPUT -o tun0 -j ACCEPT and -A OUTPUT -d 10.8.0.0/24 -j ACCEPT respectively)

  • Thank you for this! Great response and exactly what I asked. Because I'm really new with Linux and the iptables seems just so daunting, is it possible to do the same with ufw? Something like: sudo ufw allow out on tun0 to any port 21 – dvalinn Aug 19 '17 at 18:56
  • I am not familiar with uwf, however something like that should work (your example missing proto tcp) if I read the man page correctly. – sebasth Aug 20 '17 at 10:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.