1

I'm following this tutorial in order to setup my openvpn server:

https://linode.com/docs/networking/vpn/set-up-a-hardened-openvpn-server/

When i reached the part to replace the ipv4 configuration, and as soon as I did

iptables-restore < /etc/iptables/rules.v4

I lost connectivity to the server. here is the code I placed inside the file:

*filter

# Allow all loopback (lo) traffic and reject anything
# to localhost that does not originate from lo.
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -s 127.0.0.0/8 -j REJECT
-A OUTPUT -o lo -j ACCEPT

# Allow ping and ICMP error returns.
-A INPUT -p icmp -m state --state NEW --icmp-type 8 -j ACCEPT
-A INPUT -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -p icmp -j ACCEPT

# Allow SSH.
-A INPUT -i eth0 -p tcp -m state --state NEW,ESTABLISHED --dport 22 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m state --state ESTABLISHED --sport 22 -j ACCEPT

# Allow UDP traffic on port 1194.
-A INPUT -i eth0 -p udp -m state --state NEW,ESTABLISHED --dport 1194 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m state --state ESTABLISHED --sport 1194 -j ACCEPT

# Allow DNS resolution and limited HTTP/S on eth0.
# Necessary for updating the server and timekeeping.
-A INPUT -i eth0 -p udp -m state --state ESTABLISHED --sport 53 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m state --state NEW,ESTABLISHED --dport 53 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state ESTABLISHED --sport 80 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state ESTABLISHED --sport 443 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m state --state NEW,ESTABLISHED --dport 80 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m state --state NEW,ESTABLISHED --dport 443 -j ACCEPT

# Allow traffic on the TUN interface so OpenVPN can communicate with eth0.
-A INPUT -i tun0 -j ACCEPT
-A OUTPUT -o tun0 -j ACCEPT

# Log any packets which don't fit the rules above.
# (optional but useful)
-A INPUT -m limit --limit 3/min -j LOG --log-prefix "iptables_INPUT_denied: " --log-level 4
-A FORWARD -m limit --limit 3/min -j LOG --log-prefix "iptables_FORWARD_denied: " --log-level 4
-A OUTPUT -m limit --limit 3/min -j LOG --log-prefix "iptables_OUTPUT_denied: " --log-level 4

# then reject them.
-A INPUT -j REJECT
-A FORWARD -j REJECT
-A OUTPUT -j REJECT

COMMIT

Any idea what is wrong with the above? it seems fine to me!

Thank you

  • So to be clear you can no longer connect to this server via ssh or as a vpn? – kemotep Mar 1 '18 at 4:02
  • What port is your OpenVPN connection running on? I'm guessing it's UDP/1194, but I want to confirm this. – ErikF Mar 1 '18 at 6:43
  • @kemotep yes i can no longer connect via ssh (vpn too early for this stage, haven't setuped the VPN yet, I'm still following the tutorial) – James brown Mar 1 '18 at 13:42
  • @ErikF I still haven't installed OpenVPN – James brown Mar 1 '18 at 13:42
  • @Jamesbrown, Can you still ping or otherwise communicate with the server? Is there a way to bring this back to before you pushed the new iptable rules? I would suggest starting over and making sure you can make changes to your firewall rules without losing connection. Start by just setting ssh rules or blocking ping. If you can line by line add and push the rules from the guide and you lose connection then you will not the heart of the issue. – kemotep Mar 1 '18 at 17:23

protected by Community Mar 1 '18 at 21:33

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Browse other questions tagged or ask your own question.