I set up my server (let's call it server A) firewall so that no input/output rules be allowed, apart from: - incoming ssh conection - outgoing ssh connection This is working well by now!
Now, i would like to 1. Establish on-demand vpn server connection to a given ip address with the "-w" openssh option (tun interface) 2. When this vpn connection is established, route all outgoing traffic to this new tun interface (so that when I perform a wget , the flows go through the vpn tunnel)
Step 1 is easy and done. However, I mess with step 2.
Here are my firewall rules:
# Allow incoming / outgoing SSH iptables -I INPUT -j ACCEPT -p tcp --dport 22 --sport 1:65000 iptables -A OUTPUT -j ACCEPT -p tcp --dport 1:65000 --sport 22 ###Not working # VPN flows iptables -A INPUT -j ACCEPT -s 10.0.0.1 iptables -A OUTPUT -j ACCEPT -d 10.0.0.1
Here is the command line for step 1 (run from my server A):
ssh -o PermitLocalCommand=yes -o LocalCommand="ifconfig eth0 10.0.0.2 pointopoint 10.0.0.1 netmask 255.255.255.0" -o ServerAliveInterval=60 -w 1:1 email@example.com "ifconfig tun1 10.0.0.1 pointopoint 10.0.0.2 netmask 255.255.255.0"
Works like a charm!
Next I try to set the newly VPN IP as the default route:
ip route add default via 10.0.0.1 ip route del default via my.previous.gw
This is not working.
Any idea on what is wrong?