2
I have a linux firewall setup as my home network gateway that is correctly leasing IP addresses to devices on my network, and those devices have internet access.
I also setup OpenVPN on the same machine and it's up and running and doling out IP addresses and I'm able to access the VPN from my phone. However, devices on the VPN do not have internet access and I can't figure out why.
Here are the iptables rules I'm using:
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
# enp2s0 is WAN interface, enp1s0 is LAN interface, tun0 is vpn interface
-A POSTROUTING -o enp2s0 -j MASQUERADE
-A POSTROUTING -s 10.8.0.0/8 -o enp2s0 -j MASQUERADE
COMMIT
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
# block invalid packets
-A PREROUTING -m conntrack --ctstate INVALID -j DROP
# block fragmented packets (may be unnecessary)
#-A PREROUTING -f -j DROP
# block new packets that are not SYN
-A PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
# block uncommon MSS values
-A PREROUTING -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP
# block packets with bogus TCP flags
-A PREROUTING -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
-A PREROUTING -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A PREROUTING -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
-A PREROUTING -p tcp --tcp-flags FIN,ACK FIN -j DROP
-A PREROUTING -p tcp --tcp-flags ACK,URG URG -j DROP
-A PREROUTING -p tcp --tcp-flags ACK,FIN FIN -j DROP
-A PREROUTING -p tcp --tcp-flags ACK,PSH PSH -j DROP
-A PREROUTING -p tcp --tcp-flags ALL ALL -j DROP
-A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP
-A PREROUTING -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
-A PREROUTING -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP
-A PREROUTING -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
# block packets from private subnets (spoofing)
-A PREROUTING -s 224.0.0.0/3 -j DROP
-A PREROUTING -s 169.254.0.0/16 -j DROP
-A PREROUTING -s 172.16.0.0/12 -j DROP
-A PREROUTING -s 192.0.2.0/24 -j DROP
#-A PREROUTING -s 192.168.0.0/16 -j DROP
-A PREROUTING -s 10.0.0.0/8 -j DROP
-A PREROUTING -s 0.0.0.0/8 -j DROP
-A PREROUTING -s 240.0.0.0/5 -j DROP
-A PREROUTING -s 127.0.0.0/8 ! -i lo -j DROP
COMMIT
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
# Service rules
# Log all input and forward connections
-A INPUT -j LOG
-A FORWARD -j LOG
# basic global accept rules - ICMP, loopback, traceroute, established all accepted
-A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPT
#-A OUTPUT -o lo -j ACCEPT
-A INPUT -p icmp -j ACCEPT
# the below rule might require ,RELATED if things fail, such as OpenVPN
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#-A INPUT -m conntrack --ctstate RELATED -j ACCEPT
#-A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
# enable traceroute rejections to get sent out
-A INPUT -p udp -m udp --dport 33434:33523 -j REJECT --reject-with icmp-port-unreachable
# DNS - accept from LAN and VPN
-A INPUT -i enp1s0 -p tcp --dport 53 -j ACCEPT
-A INPUT -i enp1s0 -p udp --dport 53 -j ACCEPT
-A INPUT -i tun0 -p tcp --dport 53 -j ACCEPT
-A INPUT -i tun0 -p udp --dport 53 -j ACCEPT
# SSH - accept from LAN and VPN; note that SSH on this machine uses a non-standard port
-A INPUT -i enp1s0 -p tcp --dport 123 -j ACCEPT
-A INPUT -i tun0 -p tcp --dport 123 -j ACCEPT
# OpenVPN - accept from WAN; note that OpenVPN on this machine uses port 443 to try to get past client network filtering
-A INPUT -i enp2s0 -p tcp --dport 443 -j ACCEPT
#-I INPUT -i tun0 -j ACCEPT
-I INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# DHCP client requests - accept from LAN and VPN
-A INPUT -i enp1s0 -p udp --dport 67:68 -j ACCEPT
-A INPUT -i tun0 -p udp --dport 67:68 -j ACCEPT
# drop invalid packets
-A INPUT -m conntrack --ctstate INVALID -j DROP
# drop connections from hosts that have more than 80 established connections (prevents connection attacks)
-A INPUT -p tcp -m connlimit --connlimit-above 80 -j REJECT --reject-with tcp-reset
# limit the new TCP connections that a client can establish per second, reducing connection attacks
-A INPUT -p tcp -m conntrack --ctstate NEW -m limit --limit 60/s --limit-burst 20 -j ACCEPT
-A INPUT -p tcp -m conntrack --ctstate NEW -j DROP
# block port scanning
-N port-scanning
-A port-scanning -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s --limit-burst 2 -j RETURN
-A port-scanning -j DROP
# block HTTPS ads
#-A INPUT -p udp --dport 80 -j REJECT --reject-with icmp-port-unreachable
#-A INPUT -p tcp --dport 443 -j REJECT --reject-with tcp-reset
#-A INPUT -p udp --dport 443 -j REJECT --reject-with icmp-port-unreachable
# drop all other inbound traffic
-A INPUT -j DROP
# Forwarding rules
# forward packets along established/related connections
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
# forward from LAN (enp1s0) to WAN (enp2s0)
-A FORWARD -i enp1s0 -o enp2s0 -j ACCEPT
# forward from VPN (tun0) to WAN (enp2s0)
-A FORWARD -i tun0 -o enp2s0 -j ACCEPT
# drop all other forwarded traffic
-A FORWARD -j DROP
COMMIT
What am I missing that would allow devices on the VPN to access the internet?
I don't think this is a solution to my issue. I have a phone that is able to connect to the VPN via cellular data connection, however once the connection is established, it can no longer reach the internet. – rosstripi – 2018-06-17T16:59:33.413
Just to make things clear. You want your clients to be able to log in from all over in the world (internet) at your vpn-server and from than on be able to browse the internet, with your vpn-server-ip-adress? – AlexOnLinux – 2018-06-18T04:47:11.603
I did just edit my answer. I hope if fits your needs now. – AlexOnLinux – 2018-06-19T00:27:04.257