VPN: protecting client from server

the_mat · 2010-12-22 20:59:33

Hi,

If I may ask for some clarification..

My company is running an openvpn server to which I can connect from home and access their whole network, which is fine.

However, the vpn server at work is also able to access the PC I'm using to connect to the VPN
While connected to the VPN, I ssh'd into the server and tried to access the apache on my vpn IP, to acertain that.

The question is now, is there a way to prevent that from happening?
i.e. I want to be able to connect to work, but I don't want any machine at work to be able to access my home ressources.

I could of course configure apache (and indeed every other daemon I'm running) to listen only to local connections or interfaces, but I'd like to avoid that..

thx
Mat

CPU Gastronomy · 2010-12-30 01:33:39

There're a lot of things you could do :

-Ask for authentication when trying to connect to your apache;
-Limit the range of IP that can connect;
-etc.

fukawi2 · 2010-12-30 01:52:36

iptables -I INPUT -i tun0 -m state --state NEW -j REJECT

Assuming you're using tun, not tap.

the_mat · 2010-12-30 10:58:50

thanks fukawi, that's exactly what I'm looking for..

my own tries with iptables only led to cutting off all (in and out) vpn traffic.. which was pretty secure though

Mat

fukawi2 · 2010-12-30 12:24:17

Yeah, you only want to block the new connections. You could just block SYN packets too, which would achieve the same thing, but without relying on the kernel's state table

iptables -I INPUT -i tun0 --syn -j REJECT

the_mat · 2010-12-30 12:41:23

SYN packets are TCP only, aren't they? (had to google that )
Since we're using an UDP connection (should have probably mentioned that earlier), your second rule wouldn't work

so, guess the question becomes: is relying on the kernel's state table a bad thing?
I've looked through the iptables manpage and found the INVALID state.. rejecting those packets too should help, right

Mat

cactus · 2010-12-30 20:54:15

generally what you would do is setup a firewall rule to allow in only related/established traffic, and reject/drop everything else.

iptables -I INPUT -i tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -I INPUT -i tun0 -p icmp -j ACCEPT
iptables -I INPUT -i tun0 -j REJECT

EDIT: you should probably also allow icmp packets, so your company network admins can ping your machine and for possible source route updates from internal routers. edited ruleset above.

Last edited by cactus (2010-12-30 21:05:02)

fukawi2 · 2010-12-30 22:40:02

Correct the_mat (about TCP and SYN)... And what cactus said is also sound advice, especially about ICMP

the_mat · 2011-01-03 19:59:47

great guys, I used cactus' rules and they work as advertised

thanks again and Happy nEw Year

Arch Linux

#1 2010-12-22 20:59:33

VPN: protecting client from server

#2 2010-12-30 01:33:39

Re: VPN: protecting client from server

#3 2010-12-30 01:52:36

Re: VPN: protecting client from server

#4 2010-12-30 10:58:50

Re: VPN: protecting client from server

#5 2010-12-30 12:24:17

Re: VPN: protecting client from server

#6 2010-12-30 12:41:23

Re: VPN: protecting client from server

#7 2010-12-30 20:54:15

Re: VPN: protecting client from server

#8 2010-12-30 22:40:02

Re: VPN: protecting client from server

#9 2011-01-03 19:59:47

Re: VPN: protecting client from server

Board footer