iptables, vpn server, routing

Question

I set up my server (let's call it server A) firewall so that no input/output rules be allowed, apart from: - incoming ssh conection - outgoing ssh connection This is working well by now!

Now, i would like to 1. Establish on-demand vpn server connection to a given ip address with the "-w" openssh option (tun interface) 2. When this vpn connection is established, route all outgoing traffic to this new tun interface (so that when I perform a wget , the flows go through the vpn tunnel)

Step 1 is easy and done. However, I mess with step 2.

Here are my firewall rules:

# Allow incoming / outgoing SSH
iptables -I INPUT -j ACCEPT -p tcp --dport 22 --sport 1:65000
iptables -A OUTPUT -j ACCEPT -p tcp --dport 1:65000 --sport 22

###Not working
# VPN flows
iptables -A INPUT -j ACCEPT -s 10.0.0.1
iptables -A OUTPUT -j ACCEPT -d 10.0.0.1

Here is the command line for step 1 (run from my server A):

ssh -o PermitLocalCommand=yes -o LocalCommand="ifconfig eth0 10.0.0.2 pointopoint 10.0.0.1 netmask 255.255.255.0" -o ServerAliveInterval=60 -w 1:1 root@given.ip.add "ifconfig tun1 10.0.0.1 pointopoint 10.0.0.2 netmask 255.255.255.0"

Works like a charm!

Next I try to set the newly VPN IP as the default route:

ip route add default via 10.0.0.1
ip route del default via my.previous.gw

This is not working.

Any idea on what is wrong?

Answer 1

You might have cut the branch you're sitting on. Because you deleted the former default route, chances are there might not be a route to given.ip.add anymore.

You could confirm this by checking the output of ip route get given.ip.add if it's not using via my.previous.gw anymore that's probably the issue. You could probably correct it by adding this, preferably first, before deleting the former default route:

ip route add given.ip.add via my.previous.gw

Now I'm using conditional form sentences everything, because I don't understand this part:

LocalCommand="ifconfig eth0 10.0.0.2 pointopoint 10.0.0.1 netmask 255.255.255.0"

I would have expected this to be applied on the new tun1 interface, not on eth0.

Then, once this is working for 10.0.0.1, if you expect to use any IP through the tunnel, your firewall rules are preventing it (assuming default policy is DROP). You'd best change your rules to allow any traffic throught the VPN tunnel interface, and not just between the two new tunnel IPs with:

iptables -A INPUT -i tun1 -j ACCEPT
iptables -A OUTPUT -o tun1 -j ACCEPT

The remote peer must be configured as router, with NAT enabled (eg with iptables and MASQUERADE).