1

I have a Model 3 Raspberry Pi with Raspbian Linux 8.0 set up as a VPN router. It has the following network interfaces:

  • eth0 - configured as wired Internet uplink (currently not used)
  • wlan0 - wireless Internet uplink (active)
  • eth1 (subnet 192.168.5.0/24) - wired client LAN (for my PC)
  • wlan1 (subnet 192.168.4.0/24) - client WLAN (for my phone)
  • tun0, tun1 - VPN interfaces

Everything is working as I want (client connections go through the VPN), except for one thing: it seems to be routing between eth1 and wlan1, which I don't want. I don't want client machines on wlan1 to be able to connect to machines on eth1, but they can. I also don't want machine on the client WLAN to be able to SSH to the Pi, only machines connected by Ethernet, but currently they can. I have SSH set up to listen only on 192.168.5.1 (not on 192.168.4.1), but if I connect to the client WLAN I can still SSH to 192.168.5.1.

I have IP forwarding enable, of course, since I want it to route between wlan1 and tun0/tun1 and between eth1 and tun0/tun1.

Here are my iptables rules:

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

-A FORWARD -s 192.168.4.0/24 -i wlan1 -o eth0 -m conntrack --ctstate NEW -m comment --comment "Block traffic from wlan1 (client WiFi) to eth0 (wired uplink)" -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -s 192.168.4.0/24 -i wlan1 -o wlan0 -m conntrack --ctstate NEW -m comment --comment "Block traffic from wlan1 (client WiFi) to wlan0 (WiFi uplink)" -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -s 192.168.4.0/24 -i wlan1 -o tun0 -m conntrack --ctstate NEW -m comment --comment "Allow traffic from wlan1 (client WiFi) to tun0 (VPN)" -j ACCEPT
-A FORWARD -s 192.168.4.0/24 -i wlan1 -o tun1 -m conntrack --ctstate NEW -m comment --comment "Allow traffic from wlan1 (client WiFi) to tun1 (VPN)" -j ACCEPT

-A FORWARD -s 192.168.5.0/24 -i eth1 -o eth0 -m conntrack --ctstate NEW -m comment --comment "Block traffic from eth1 (client LAN) to eth0 (wired uplink)" -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -s 192.168.5.0/24 -i eth1 -o wlan0 -m conntrack --ctstate NEW -m comment --comment "Block traffic from eth1 (client LAN) to wlan0 (WiFi uplink)" -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -s 192.168.5.0/24 -i eth1 -o tun0 -m conntrack --ctstate NEW -m comment --comment "Allow traffic from eth1 (client LAN) to tun0 (VPN)" -j ACCEPT
-A FORWARD -s 192.168.5.0/24 -i eth1 -o tun1 -m conntrack --ctstate NEW -m comment --comment "Allow traffic from eth1 (client LAN) to tun1 (VPN)" -j ACCEPT

-A FORWARD -s 192.168.4.0/24 -i wlan1 -o eth1 -m conntrack --ctstate NEW -m comment --comment "Block traffic from wlan1 (client WiFi) to eth1 (client LAN)" -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -s 192.168.4.0/24 -d 192.168.5.0/24 -m conntrack --ctstate NEW -m comment --comment "Block traffic from client WiFi range to client LAN range" -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -s 192.168.5.0/24 -i eth1 -o wlan1 -m conntrack --ctstate NEW -m comment --comment "Block traffic from eth1 (client LAN) to wlan1 (client WiFi)" -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -s 192.168.5.0/24 -d 192.168.4.0/24 -m conntrack --ctstate NEW -m comment --comment "Block traffic from client LAN range to client WiFi range" -j REJECT --reject-with icmp-port-unreachable

COMMIT

*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o eth0 -m comment --comment "Use VPN IP for eth0" -j MASQUERADE
-A POSTROUTING -o wlan0 -m comment --comment "Use VPN IP for wlan0" -j MASQUERADE
-A POSTROUTING -o tun0 -m comment --comment "Use VPN IP for tun0" -j MASQUERADE
-A POSTROUTING -o tun1 -m comment --comment "Use VPN IP for tun1" -j MASQUERADE
COMMIT
0

Prevent SSH access from wlan1:

iptables -A INPUT -i wlan1 -p tcp --dport 22 -j REJECT --reject-with icmp-port-unreachable

A general remark: I do not see the sense in using

-s 192.168.4.0/24 -i wlan1 -o eth1

instead of

-i wlan1 -o eth1

as you want to block all packets not just those with valid source address, I guess.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.