Openvpn nat and iptables Post: 302985097

Sponsored Content

Special Forums Cybersecurity Openvpn nat and iptables Post 302985097 by end on Friday 4th of November 2016 07:21:18 PM

11-04-2016

Registered User

Openvpn nat and iptables

good day good people

hi

first to tell that firewall and vpn is working as expected, but I notice something strange.

I have host system 11.11.11.11(local ip) firewall is blocking everything except port to vpn.
I have vpn on virtualized system 22.22.22.22 (CentOS both host and virtual). They are behind MikroTik router and then to my ISP router. This is a home setup I'm just experimenting.

PREROUTING 11.11.11.11:1194 to 22.22.22.22:1194 all other is blocked by iptables.
POSTROUTING 22.22.22.22 to 11.11.11.11

I noticed with Wireshark from host 11.11.11.11 that while I'm connected to vpn from another pc that 11.11.11.11 is connecting to ip addresses of websites I visit while in same time is connected to vpn. like:

11.11.11.11 XX.XX.XX public ip
11.11.11.11 tcp udp sites i visit

but 11.11.11.11 is unnecessarily making connections to website ip addresses. She cannot make the reqests because DNS and ports for that are blocked. So this is because postrouting command my best guess. Can this somehow be disabled? First this is a security issue, second its unnecessary.

Someone told me that this is because NAT setup. but I believe that this can be disabled somehow, I didn't find solution yet so maybe someone know how.

thanks

Moderator's Comments:

We had to correct a lot of spelling errors. Please put more effort into using proper english

Last edited by Scrutinizer; 11-05-2016 at 04:48 AM.. Reason: Spelling

end

View Public Profile for end

Find all posts by end

10 More Discussions You Might Find Interesting

1. IP Networking

Iptables/TC: how to make masqueraded traffic go through an openVPN tun0?

Hi all! We have a setup of three computers; Machine A (eth0) -> Machine B (eth0, hso0, tun0) -> Machine C (eth0, tun0) hso0 is the packet interface of a 3G modem, it behaves like a normal network interface. Machine B and C are connected in a VPN using openVPN (TCP). Machine A is a...

2. UNIX for Advanced & Expert Users

iptables internal NAT with two public IP

Hello Guys, I have a debian machine that work as a firewall (iptables + squid 2.6) with two physical interfaces: eth0 (public interface) and eth1 (internal interface LAN). I have created an alias eth1:1 in order to have two subnets on same physical interface: cat/etc/network/interfaces auto...

3. Debian

Iptables Nat forward port 29070

Hello, the Nat and the forward worked on my debian server up to the reboot of machines. The following rules*: /sbin/iptables -t nat -A PREROUTING -p tcp -i eth2 -d xxx.xxx.xxx.xxx --dport 29070 -j DNAT --to-destination 10.0.1.7:29070 /sbin/iptables -A FORWARD -p tcp -i eth2 -o eth0 -d...

4. IP Networking

iptables NAT prerouting & postrouting

Good morning, I'm a newbie of iptables and as far as I've seen on tutorials on the Internet it seems that both prerouting and postrouting NAT chains are undergone both by a packet that goes from an internal LAN to the Internet and of a one that goes in the opposite direction (from the Internet to...

5. Red Hat

NAT Loopback and iptables

Hello, please can you help and explain me. I have two servers. Both are RHEL6. I use the first one like router and the second one for apache. Router forwards 80 port on the second server and I can open that from the internet (mysite.com, for example). But I can not open mysite.com if i try to...

6. Cybersecurity

iptables in a NAT scenario

Hi, I am learning IPTables have this question. My server is behind a firewall that does a PAT & NAT to the LAN address. Internet IP: 68.1.1.23 Port: 10022 Server LAN IP: 10.1.1.23 port: 22 Allowed Internet IPs: 131.1.1.23, 132.1.1.23 I want to allow a set of IPs are to be able to...

7. IP Networking

Nat and packet limits with iptables

Hi all, I have a following situation: - I want certain source IPs to be natted to a different destination IP and Port. Following is how I am achieving it: /usr/local/sbin/iptables -t nat -A PREROUTING -p tcp -s 192.168.10.12 --dport 1500 -j DNAT --to-destination 192.168.10.20:2000 ...

8. UNIX for Dummies Questions & Answers

iptables for openvpn

Hey all, I'm trying to get openvpn working on DD-WRT router. I can make a connection inside my lan, but outside the connection is yellow. I think yellow means it is close to making a connection, but it never completes the connection. So I believe there is a problem with my iptables since it...

9. IP Networking

NAT via iptables - Won't work!!

Hi guys I'm running on debian on a small embedded system. I have a ppp interface that is connected to the internet (and works). My unit also has wifi access point (which works and I can connect to it). I want to allow connections to the wifi to be able to use the internet from ppp0...

10. Solaris

OpenVPN and NAT

Hi. I am attempting to set up an OpenVPN server on my Solaris 11 box by following all the Linux guides. Thus far I have a working VPN that I can connect to and ssh onto my VPN server over which is great but not what I require long term. I would like to route all VPN client requests for addresses...

LEARN ABOUT DEBIAN

arno-iptables-firewall

ARNO-IPTABLES-FIREWALL(8)												 ARNO-IPTABLES-FIREWALL(8)

NAME

       arno-iptables-firewall - Single- & multi-homed firewall script with DSL/ADSL support.

SYNOPSIS

       /etc/init.d/arno-iptables-firewall [start|stop|status|force-reload|restart]

DESCRIPTION

       arno-iptables-firewall  is  an  iptables configuration script with support for both IPv4 & IPv6.  While it is extremely easy to use one can
       nevertheless use it in quite complicated environments.

       All available options are explained in the extensively documented configuration file.

       The external interface of the system needs to be set up properly in the firewalls configuration file (EXT_IF).  The default behavior of the
       firewall is to deny all incoming connections.

       For  additional	requirements not covered by the configuration file custom iptables rules can be placed in /etc/arno-iptables-firewall/cus-
       tom-rules.  This file is automatically parsed by the service script.

       See the README file (eg. in /usr/(local/)share/doc/arno-iptables-firewall) for an example how to manage logging of firewall events  through
       syslogd.

       The arno-fwfilter script can be used to make the firewall logs more readable for humans (see manpage).

       Several plugins for the firewall script are available online. Plugins can be downloaded from http://rocky.eld.leidenuniv.nl/ Please see the
       README file for more information.

FILES

       /etc/init.d/arno-iptables-firewall	       system service script
       /etc/arno-iptables-firewall/firewall.conf       firewall configuration
       /etc/arno-iptables-firewall/conf.d/	       firewall configuration directory
       /etc/arno-iptables-firewall/custom-rules        custom iptables rules
       /etc/arno-iptables-firewall/blocked-hosts       host blacklist
       /etc/arno-iptables-firewall/mac-addresses       mac filter list

       Please note, that the last two files do exist in the initial configuration and their use is disabled  in  /etc/arno-iptables-firewall/fire-
       wall.conf

SEE ALSO

       iptables(8), arno-fwfilter(1), syslog.conf(5)

       The http://rocky.eld.leidenuniv.nl/ web site.

AUTHOR

       arno-iptables-firewall was written by Arno van Amersfoort <arnova@rocky.eld.leidenuniv.nl>.

       This manual page was written by Michael Hanke <michael.hanke@gmail.com>, for the Debian project (but may be used by others).

Michael Hanke							  March 14, 2012					 ARNO-IPTABLES-FIREWALL(8)

10 More Discussions You Might Find Interesting

1. IP Networking

Iptables/TC: how to make masqueraded traffic go through an openVPN tun0?

Discussion started by: theVOID

2. UNIX for Advanced & Expert Users

iptables internal NAT with two public IP

Discussion started by: sincity2006

3. Debian

Iptables Nat forward port 29070

Discussion started by: titoms

4. IP Networking

iptables NAT prerouting & postrouting

Discussion started by: giac85