~fkooman/vpn-documentation

vpn-documentation/resources/firewall/iptables -rw-r--r-- 1.8 KiB
cc407873François Kooman update supported versions 6 days ago
                                                                                
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
##########
# FILTER #
##########
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

#########
# INPUT #
#########
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT

# SSH
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
# HTTP
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
# HTTPS
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
# OpenVPN
-A INPUT -p udp -m state --state NEW -m udp --dport 1194 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 1194 -j ACCEPT
# More OpenVPN ports
#-A INPUT -p udp -m state --state NEW -m udp --dport 1194:1197 -j ACCEPT
#-A INPUT -p tcp -m state --state NEW -m tcp --dport 1194:1197 -j ACCEPT
# Local DNS for VPN clients
#-A INPUT -s 10.0.0.0/8 -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT
#-A INPUT -s 10.0.0.0/8 -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT

-A INPUT -j REJECT --reject-with icmp-host-prohibited

###########
# FORWARD #
###########
-A FORWARD -i tun+ ! -o tun+ -j ACCEPT
-A FORWARD ! -i tun+ -o tun+ -j ACCEPT

# Be more specific through which interfaces routing is allowed
#-A FORWARD -i tun+ -o eth0 -j ACCEPT
#-A FORWARD -i eth0 -o tun+ -j ACCEPT

# Do not allow VPN clients to be contacted from the outside
#-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
#-A FORWARD -i tun+ -o eth0 -j ACCEPT

-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

#######
# NAT #
#######
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]

-A POSTROUTING -s 10.0.0.0/8 -j MASQUERADE
#-A POSTROUTING -s 10.0.0.0/8 -j SNAT --to-source 192.0.2.1
# Distribute NAT over IPs between 192.0.2.1 and 192.0.2.8 (inclusive)
#-A POSTROUTING -s 10.0.0.0/8 -j SNAT --to-source 192.0.2.1-192.0.2.8
COMMIT