Login or Register to Ask a Question and Join Our Community

Sponsored Content
Full Discussion: Openvpn nat and iptables
Special Forums Cybersecurity Openvpn nat and iptables Post 302985097 by end on Friday 4th of November 2016 07:21:18 PM
Old 11-04-2016
Openvpn nat and iptables
good day good people

hi

first to tell that firewall and vpn is working as expected, but I notice something strange.

I have host system 11.11.11.11(local ip) firewall is blocking everything except port to vpn.
I have vpn on virtualized system 22.22.22.22 (CentOS both host and virtual). They are behind MikroTik router and then to my ISP router. This is a home setup I'm just experimenting.

PREROUTING 11.11.11.11:1194 to 22.22.22.22:1194 all other is blocked by iptables.
POSTROUTING 22.22.22.22 to 11.11.11.11

I noticed with Wireshark from host 11.11.11.11 that while I'm connected to vpn from another pc that 11.11.11.11 is connecting to ip addresses of websites I visit while in same time is connected to vpn. like:

11.11.11.11 XX.XX.XX public ip
11.11.11.11 tcp udp sites i visit

but 11.11.11.11 is unnecessarily making connections to website ip addresses. She cannot make the reqests because DNS and ports for that are blocked. So this is because postrouting command my best guess. Can this somehow be disabled? First this is a security issue, second its unnecessary.

Someone told me that this is because NAT setup. but I believe that this can be disabled somehow, I didn't find solution yet so maybe someone know how.

thanks


Moderator's Comments:
Mod Comment We had to correct a lot of spelling errors. Please put more effort into using proper english
Last edited by Scrutinizer; 11-05-2016 at 04:48 AM.. Reason: Spelling
 

10 More Discussions You Might Find Interesting

1. IP Networking

Iptables/TC: how to make masqueraded traffic go through an openVPN tun0?

Hi all! We have a setup of three computers; Machine A (eth0) -> Machine B (eth0, hso0, tun0) -> Machine C (eth0, tun0) hso0 is the packet interface of a 3G modem, it behaves like a normal network interface. Machine B and C are connected in a VPN using openVPN (TCP). Machine A is a... (2 Replies)
Discussion started by: theVOID
2 Replies

2. UNIX for Advanced & Expert Users

iptables internal NAT with two public IP

Hello Guys, I have a debian machine that work as a firewall (iptables + squid 2.6) with two physical interfaces: eth0 (public interface) and eth1 (internal interface LAN). I have created an alias eth1:1 in order to have two subnets on same physical interface: cat/etc/network/interfaces auto... (0 Replies)
Discussion started by: sincity2006
0 Replies

3. Debian

Iptables Nat forward port 29070

Hello, the Nat and the forward worked on my debian server up to the reboot of machines. The following rules*: /sbin/iptables -t nat -A PREROUTING -p tcp -i eth2 -d xxx.xxx.xxx.xxx --dport 29070 -j DNAT --to-destination 10.0.1.7:29070 /sbin/iptables -A FORWARD -p tcp -i eth2 -o eth0 -d... (0 Replies)
Discussion started by: titoms
0 Replies

4. IP Networking

iptables NAT prerouting & postrouting

Good morning, I'm a newbie of iptables and as far as I've seen on tutorials on the Internet it seems that both prerouting and postrouting NAT chains are undergone both by a packet that goes from an internal LAN to the Internet and of a one that goes in the opposite direction (from the Internet to... (0 Replies)
Discussion started by: giac85
0 Replies

5. Red Hat

NAT Loopback and iptables

Hello, please can you help and explain me. I have two servers. Both are RHEL6. I use the first one like router and the second one for apache. Router forwards 80 port on the second server and I can open that from the internet (mysite.com, for example). But I can not open mysite.com if i try to... (0 Replies)
Discussion started by: 6765656755
0 Replies

6. Cybersecurity

iptables in a NAT scenario

Hi, I am learning IPTables have this question. My server is behind a firewall that does a PAT & NAT to the LAN address. Internet IP: 68.1.1.23 Port: 10022 Server LAN IP: 10.1.1.23 port: 22 Allowed Internet IPs: 131.1.1.23, 132.1.1.23 I want to allow a set of IPs are to be able to... (1 Reply)
Discussion started by: capri_guy84
1 Replies

7. IP Networking

Nat and packet limits with iptables

Hi all, I have a following situation: - I want certain source IPs to be natted to a different destination IP and Port. Following is how I am achieving it: /usr/local/sbin/iptables -t nat -A PREROUTING -p tcp -s 192.168.10.12 --dport 1500 -j DNAT --to-destination 192.168.10.20:2000 ... (3 Replies)
Discussion started by: ahmerin
3 Replies

8. UNIX for Dummies Questions & Answers

iptables for openvpn

Hey all, I'm trying to get openvpn working on DD-WRT router. I can make a connection inside my lan, but outside the connection is yellow. I think yellow means it is close to making a connection, but it never completes the connection. So I believe there is a problem with my iptables since it... (0 Replies)
Discussion started by: sdnix
0 Replies

9. IP Networking

NAT via iptables - Won't work!!

Hi guys I'm running on debian on a small embedded system. I have a ppp interface that is connected to the internet (and works). My unit also has wifi access point (which works and I can connect to it). I want to allow connections to the wifi to be able to use the internet from ppp0... (1 Reply)
Discussion started by: alirezan1
1 Replies

10. Solaris

OpenVPN and NAT

Hi. I am attempting to set up an OpenVPN server on my Solaris 11 box by following all the Linux guides. Thus far I have a working VPN that I can connect to and ssh onto my VPN server over which is great but not what I require long term. I would like to route all VPN client requests for addresses... (0 Replies)
Discussion started by: nickb1976
0 Replies

LEARN ABOUT DEBIAN

ipkungfu

ipkungfu(8)						      System Manager's Manual						       ipkungfu(8)

NAME

       ipkungfu - An iptables-based firewall for Linux

SYNOPSIS

       ipkungfu [ -c ] [ -t ] [ -d ] [ -h ] [ -v ] [ --quiet ] [ --panic ] [ --no-caching

DESCRIPTION

       ipkungfu  is an iptables-based Linux firewall. The primary design goals are security, ease of use, and performance, in that order. It takes
       advantage of advanced features of iptables, tcpwrappers, and the Linux kernel. It also simplifies the configuration of internet	connection
       sharing, advanced routing, and other networking needs.

OPTIONS

       -c  (or	--check)
		   Check whether ipkungfu is loaded, and report any command line options it may have been loaded with.

       -t  (or	--test)
		   Runs  a configuration test, and displays the results.  Note that this does not test or display all configuration options.  This
		   gives you an opportunity to verify that major configuration options are correct before putting them into action.

       -d  (or	--disable)
		   Disables the firewall.  It is important to know exactly what this option does.  All traffic is allowed in and out, and  in  the
		   case  of  a gateway, all NATed traffic is forwarded (the option retains your connection sharing options).  Custom rules are not
		   implemented, and deny_hosts.conf is ignored.

       -f  (or	--flush)
		   Disables the firewall COMPLETELY.  All rules are flushed, all chains are removed.  Any port forwarding or  internet	connection
		   sharing will cease to work.

       -h  (or	--help)
		   Displays brief usage information and exits.

       -v  (or	--version)
		   Displays version information and exits.

       --quiet	   Runs ipkungfu with no standard output

       --panic	   Drops  ALL traffic in all directions on all network interfaces.  You should probably never use this option.	The --panic option
		   is available for the highly unusual situation where you know that an attack is underway but you know of no other  way  to  stop
		   it.

       --failsafe  If  ipkungfu fails, --failsafe will cause all firewall policies to revert to ACCEPT.  This is useful when working with ipkungfu
		   remotely, to prevent loss of remote access due to firewall failure.

       --no-caching
		   Disables rules caching feature.

FILES

       /etc/ipkungfu/ipkungfu.conf
       /etc/ipkungfu/advanced.conf
       /etc/ipkungfu/accept_hosts.conf
       /etc/ipkungfu/deny_hosts.conf
       /etc/ipkungfu/custom.conf
       /etc/ipkungfu/log.conf
       /etc/ipkungfu/redirect.conf
       /etc/ipkungfu/services.conf
       /usr/sbin/ipkungfu
       /usr/share/doc/ipkungfu/AUTHORS
       /usr/share/doc/ipkungfu/README
       /usr/share/doc/ipkungfu/FAQ
       /usr/share/doc/ipkungfu/ChangeLog
       /usr/share/doc/ipkungfu/COPYING

SEE ALSO

       iptables(8).

								   January 2003 						       ipkungfu(8)
All times are GMT -4. The time now is 04:54 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy