LinuxQuestions.org
Register a domain and help support LQ
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Closed Thread
 
Search this Thread
Old 08-09-2011, 08:57 PM   #1
dschuett
Member
 
Registered: Aug 2010
Posts: 40

Rep: Reputation: 1
Force all internet traffic through tun0 (Vpn Interface)


I am trying to configure iptables on one of my computers to ONLY be allowed to do the following:

1. The computer IS allowed to be accessed by other computers on the LOCAL network.

2. ALL internet traffic (IN and OUT) MUST use the tun0 (OpenVPN tunnel) interface.

3. ALL other traffic that doesn't apply to the above two rules MUST be DROPPED.

My iptables script seems to be working the way I want it to, but I wanted another set of eyes to see if they can catch any "security holes" I may be missing regarding the rules I described above. It is very important that this computer can only be allowed these specific rules.

I will take any suggestions that anyone may have.

Thanks for your time!

Code:
#!/bin/bash

#Set variables
IPT=/sbin/iptables
VPN=x.x.x.x
LAN=192.168.0.0/24

#Flush rules
$IPT -F
$IPT -X

#Default policies and define chains
$IPT -P OUTPUT DROP
$IPT -P INPUT DROP
$IPT -P FORWARD DROP

#Allow input from LAN and tun0 ONLY
$IPT -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A INPUT -i tun0 -m conntrack --ctstate NEW -j ACCEPT
$IPT -A INPUT -s $LAN -m conntrack --ctstate NEW -j ACCEPT
$IPT -A INPUT -j DROP

#Allow output from lo and tun0 ONLY
$IPT -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT
$IPT -A OUTPUT -o tun0 -m conntrack --ctstate NEW -j ACCEPT
$IPT -A OUTPUT -d $VPN -m conntrack --ctstate NEW -j ACCEPT
$IPT -A OUTPUT -j DROP
exit 0
 
Old 08-09-2011, 09:01 PM   #2
corp769
Guru
 
Registered: Apr 2005
Posts: 5,807

Rep: Reputation: 996Reputation: 996Reputation: 996Reputation: 996Reputation: 996Reputation: 996Reputation: 996Reputation: 996
Hello,

Please post your thread in only one forum. Posting a single thread in the most relevant forum will make it easier for members to help you and will keep the discussion in one place. This thread should be closed because it is a duplicate of: https://www.linuxquestions.org/quest...erface-896457/

Cheers,

Josh
 
Old 08-10-2011, 12:24 AM   #3
win32sux
Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 371Reputation: 371Reputation: 371Reputation: 371
Quote:
Originally Posted by corp769 View Post
Posting a single thread in the most relevant forum will make it easier for members to help you and will keep the discussion in one place.
Agreed. Closed.
 
  


Closed Thread

Tags
filter, iptables, vpn


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Force all internet traffic through tun0 (Vpn Interface) dschuett Linux - Security 3 08-10-2011 08:36 AM
tun0 traffic divyashree Linux - Newbie 0 12-18-2010 05:55 AM
Force TCP traffic out over specific interface when IP is bound to another local NIC yeager Linux - Networking 7 08-17-2010 09:16 AM
[SOLVED] How do I route my internet traffic over tun0? FireRaven Linux - Networking 21 03-30-2010 04:38 PM
passing internet traffic through a vpn granduke Linux - Networking 1 10-03-2008 02:52 PM


All times are GMT -5. The time now is 09:33 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration