8

I'm using IPredator VPN with openVPN and I want to make sure that if the connection is dropped, I won't submit data from the internet without the VPN. I heard that I could do that with iptables and a range. How can I do that? And how can I find out the ranges of IP's my VPN is assigning me?

Improve this question

1 Answer 1

Reset to default
7

Before you start your VPN take a copy of netstat -rn and ifconfig -a. Start your VPN, and the differences in those two commands will tell you what networks the VPN creates in terms of routes, and what IP you've been assigned to gain visibility of those networks. You will also need to get the IP of the server providing your VPN (or traffic to the VPN server will not reach it). I've also assumed your VPN server uses udp and not tcp, if it does use tcp you will need to update the 2nd rule to reflect that.

Once you have these you add OUTPUT rules in iptables to set what your host is allowed to see

 iptables -F OUTPUT
 iptables -I OUTPUT -d VPNSERVER -p udp -j ACCEPT -m comment --comment "Allow traffic to VPN SERVER"
 iptables -I OUTPUT -s VPNIP -d VPNNETWORK/CIDR -j ACCEPT -m comment --comment "Allow all traffic to VPN newtork"
 iptables -I OUTPUT -j DROP -m comment --comment "Drop all other traffic"

iptables -F OUTPUT flushes your existing rules, please be aware of that, but is required to do what your original question asked.

VPNSERVER would be the ip of your vpn server. VPNIP would be the IP the VPN assigned to you. VPNNETWORK/CIDR would be the routed network that appeared in netstat -rn something like 10.1.0.0/24

When debugging these rules it may be handy to log what is being dropped as some protocols may need some extra massaging:

 iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables-Dropped: " --log-level 4

That should be sufficient to stop traffic OUTBOUND from your PC to the internet, and only allow traffic to the VPN server and the network it provides.

The OP has pointed out that Arch Linux does not ship with a netstat or ifconfig. In which case the alternatives are:

ip addr show will show you interfaces and ip route show will show you what routes you have.

Improve this answer
5
  • First of all thanks for your help. ifconfig and netstat appear not to exist in Arch. Also iptables -X OUTPUT returns me a "iptables: Invalid argument. Run `dmesg' for more information. "
    – Paul Woitaschek
    Aug 24, 2013 at 17:29
  • I've updated my answer, iptables should also be using -F not -X my bad! :)
    – Drav Sloan
    Aug 24, 2013 at 20:00
  • It seems the IP of the VPN is changing from time to time. How can I find out, which ones are used?
    – Paul Woitaschek
    Sep 6, 2013 at 18:39
  • 1
    Actually, -I adds the rule to the top of the stack (making it the first rule), while -A adds them to the bottom. Therefore, these commands are in inverse order (iptables -F should be followed by iptables -I OUTPUT -j DROP, then others)
    – Anuj Gupta
    Apr 30, 2014 at 19:43
  • @AnujGupta indeed, I used -A parameter which also works and seems more logical to drop rules at the end. I also added rules to allow private networks without VPN (localhost adapter, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). By the way, the -p, -s, -m and --comment parameters are not necessary. Another solution to prevent leaking real IP address if the VPN disconnects is to remove the previous default rule with command route del default gw x.x.x.x (gateway found with command ip route) but the firewall solution is better since it prevents leaks on local network connection/disconnection.
    – baptx
    Nov 10, 2018 at 20:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .