{"id":4085,"date":"2021-08-17T15:51:14","date_gmt":"2021-08-17T10:21:14","guid":{"rendered":"https:\/\/opstree.com\/blog\/\/?p=4085"},"modified":"2021-08-17T17:20:52","modified_gmt":"2021-08-17T11:50:52","slug":"openvpn-a-custom-iptables-journey","status":"publish","type":"post","link":"https:\/\/opstree.com\/blog\/2021\/08\/17\/openvpn-a-custom-iptables-journey\/","title":{"rendered":"OpenVPN – A Custom Iptables journey"},"content":{"rendered":"\n

During this lockdown period, people are usually working from home which means they all are contributing to work by staying at home. So, if someone wants to work on something online, such as on a particular private or public server of a company, depending on the scenario, will need a network route to that server.<\/p>\n\n\n\n

\"\"
makes sense?<\/figcaption><\/figure><\/div>\n\n\n\n

Meaning, they first need access to that particular server either via a public network or using VPN. These things have their own set of complexities. Therefore, we will discuss a few aspects of network access & their drawbacks:<\/p>\n\n\n\n\n\n\n\n

1. In some cases companies allow users to access servers via the internet without any specific condition which means servers have public IP & are publicly available. But what if websites don’t need to open globally or do not need public access?<\/p>\n\n\n\n

Solution:<\/strong> In that case, we can disable public access & use firewall rules or security groups to manage users’ public IP’s. If someone wants to access a server, they’ll have to contact the server administrator and provide them their public IP address. Then the server administrator can whitelist that IP address providing access to the user.<\/p>\n\n\n\n

2. By disabling public access and using firewall rules, managing users’ public IP can be really hectic because users usually don’t stick to a specific network. This means their public IP will change whenever they switch networks. There is no static IP for a normal broadband connection. So, IP will always rotate as users will have to contact server administrators each time they change network.<\/p>\n\n\n\n

Solution:<\/strong> In this case, we can use a VPN server to gain access to a company network. Server administrators would need to manage a VPN server and client configuration for each user.

So, OpenVPN is a good option for setting up a VPN server because it’s open-source. Users can easily get installation instructions for Linux\/Unix. OpenVPN uses the Iptables firewall for its routing rules. Community forums like stack-overflow, OpenVPN official help site, etc are present for support.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

3. With minimal configuration and basic restriction policies in the OpenVPN server, users can easily access company servers without issues of IP address management but there is another issue with this configuration. If server administrator sets up an OpenVPN server for the management team or any team which only has access to private or public websites of the company which means a user using VPN would need only internet or only port 80 & 443 access but with normal configuration, user can easily use other ports via VPN like user can use SSH, connect to the database or can connect to any other application via any port. To overcome this, OpenVPN comes with the idea of restricting rules policy using iptables.<\/p>\n\n\n\n

Iptables is a firewall tool for Linux machines and it comes with very extensive features. Iptables works along with OpenVPN and anyone can modify it.<\/p>\n\n\n\n

With OpenVPN setup, generally, users use iptables rules to masquerade OpenVPN private subnet to the main Ethernet. So, users can use network features using the OpenVPN server which means there are no specific rules applied for OpenVPN.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

For checking iptables rules using iptables command [Both NAT table & Filter table ]<\/p>\n\n\n\n

# iptables -L<\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
In the above iptables output, it shows that there are no rules specified for any port, interface, subnet, or IP address. It just shows the empty output that we configured with OpenVPN.<\/p>\n\n\n\n
# iptables -t nat -L<\/pre>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
In the above iptables output, it shows POSTROUTING rules to masquerade OpenVPN subnet to main Ethernet which is eth0. It means any traffic that comes from mentioned and specified subnet [ OpenVPN subnet] is allowed to go through eth0.<\/p>\n\n\n\n
So, basically from the above iptables command, we get to know that there are no specified rules allowed in the filter table & there is one rule for NAT table which masquerades the traffic to the main ethernet.<\/p>\n\n\n\n
Let\u2019s connect with any rules and see if we are able to connect to different resources using the OpenVPN client.<\/p>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
After that, it will assign you an IP address from the OpenVPN subnet.<\/p>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
Now, connect to different resources.<\/p>\n\n\n\n
You can check internet connection by web browse<\/p>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
We can test by SSH to any resource,<\/p>\n\n\n\n
\"\"
Putty access<\/figcaption><\/figure><\/div>\n\n\n\n
Once you fill-out the information, try to connect to the server.<\/p>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
To make things right with iptables and to know more about iptable rules with OpenVPN, we will allow users to use only SSH through OpenVPN but not let users access the internet or any other resource.<\/p>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
For that, we need to create iptables rules.<\/p>\n\n\n\n
  1. First, we will drop or disable any access through OpenVPN for the OpenVPN subnet using a filter table FORWARD.<\/li>
  2. We will append rules to allow SSH access using a filter table FORWARD.<\/li><\/ol>\n\n\n\n
    NOTE: In iptables, rules are read from top to bottom. Hence, if there is a rule specified in iptables to deny resources and there is a same rule to allow resources on top of it, iptables will allow that rule whether you drop or deny in below that.<\/p>\n\n\n\n
    There are three options in iptables for filter table which is:<\/p>\n\n\n\n
    1. Insert<\/li>
    2. Append<\/li>
    3. Delete<\/li><\/ol>\n\n\n\n
      For this scenario, we will only use insert & append tags to write our rules. Delete option is also important but we are not going to use the delete tag in iptables for this case.<\/p>\n\n\n\n
      1. Append in iptables will put a rule at the end of the table which means if we want to drop everything except few resources, we will have to use the Append tag to create a rule at the end of the filter table to drop everything.<\/p>\n\n\n\n
      2. Insert in iptables will put a rule at the beginning of the table which means if after dropping everything using the \u201c-A\u201d tag in iptables, we can use insert a tag to allow specific resources.<\/p>\n\n\n\n
      \"\"<\/figure><\/div>\n\n\n\n
      Let\u2019s break down this diagram,<\/p>\n\n\n\n
      In the above, diagram, we are trying to add four rules with the different tags as shown in the diagram [-A & -I ].<\/p>\n\n\n\n
      First, we are using an append tag which means it will be set at the end of the table whether there is already a rule present or not. After that, we use an insert tag which means it will be set at the beginning of the table whether any rule is present or not. So, this is the basic concept of append & insert tag. Check the below diagram for more details.<\/p>\n\n\n\n
      \"\"<\/figure><\/div>\n\n\n\n
      So, according to this, we run two rules to specify or need.<\/p>\n\n\n\n
      1. Block all connection<\/strong><\/li><\/ol>\n\n\n\n
        # iptables -A FORWARD -s X.X.X.X\/8 -i tun0 -j DROP<\/pre>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        1. Allow specific rule<\/li><\/ol>\n\n\n\n
          # iptables -I FORWARD -p tcp -s X.X.X.X\/X --destination-port 22 -i tun0 -j ACCEPT<\/em><\/pre>\n\n\n\n
          \"\"<\/figure>\n\n\n\n
          You can see that rule with an insert tag at the beginning of the table and a rule with append at the end of the table.<\/p>\n\n\n\n
          NOTE: After setting up rules, you can check whether the rules are working fine or not. If it is working fine, you can use the net-filter command to save the specific rules.<\/p>\n\n\n\n
          Now, we will check whether the rules are working fine or not.<\/p>\n\n\n\n
          For now, we are unable to access the internet because we dropped all connections for the OpenVPN subnet,<\/p>\n\n\n\n
          \"\"<\/figure><\/div>\n\n\n\n
          But we can easily connect to SSH.<\/p>\n\n\n\n
          \"\"<\/figure><\/div>\n\n\n\n
          We can check other resources like Database connections or other port connections to make sure that everything is working properly.<\/p>\n\n\n\n
          \"\"<\/figure><\/div>\n\n\n\n
          We checked only with database connection but you can test this option with any kind of protocol other than the allowed one. We used the telnet command to check the connection, you can use any other tool to make sure that everything is working fine.<\/p>\n\n\n\n
          Conclusion<\/h4>\n\n\n\n
          We discussed a few of the rules provided by Iptables, their workflow and use-cases. Iptables is a very powerful firewall tool that is very flexible and useful in many aspects. Not only external traffic, but it can also help control, route and redirect using a set of rules. For OpenVPN and other tools, iptables gives you options to make things work as you want.<\/p>\n\n\n\n
          Let us know in the comment section about your experience where you used iptables and how iptables it helped you in managing resources. <\/p>\n\n\n\n
          Let’s keep away negative things from life just like we block or drop things using iptables :).<\/p>\n\n\n\n
          Keep exploring!<\/p>\n\n\n\n
            GIF References<\/a> <\/p>\n\n\n\n
           Blog Pundit:<\/strong> Naveen Verma<\/a> &  <\/a>Adeel Ahmad<\/a><\/p>\n\n\n\n
          Opstree is an End to End DevOps solution provider<\/p>\n\n\n\n
          \n
          CONTACT US<\/a><\/div>\n<\/div>\n\n\n\n
          Connect Us <\/strong><\/p>\n\n\n\n