Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I’m still quite a newbie to Linux in general and I want to learn by establishing useful projects. My actual project is for a vpn-server to get rid of ads, cookies etc. for all clients. Meaning: No matter which browser settings or add-ons are used by vpn-clients, everyone should profit from http cleansing that is done by privoxy. Privoxy works as localhost proxy on the openvpn-server.

How can I route all openvpn client traffic through that proxy?
How will https traffic be affected?
Thanks for your help!

 

OpenVPN server.conf:

port 443
proto udp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
tls-auth ta.key 0
dh /etc/openvpn/dh2048.pem
server 10.8.0.0 255.255.255.0
cipher AES-256-CBC
comp-lzo
persist-key
persist-tun
user nobody
group nogroup
status openvpn-status.log
verb 3
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 60
mute 20

 

iptables rules:

LOOP=127.0.0.1
iptables -P OUTPUT DROP
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -F
iptables -P OUTPUT ACCEPT
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -A INPUT -i venet0 -s $LOOP -j DROP
iptables -A FORWARD -i venet0 -s $LOOP -j DROP
iptables -A INPUT -i venet0 -d $LOOP -j DROP
iptables -A FORWARD -i venet0 -d $LOOP -j DROP
iptables -A FORWARD -i venet0 -s 192.168.0.0/16 -j DROP
iptables -A FORWARD -i venet0 -s 172.16.0.0/12 -j DROP
iptables -A FORWARD -i venet0 -s 10.0.0.0/8 -j DROP
iptables -A INPUT -i venet0 -s 192.168.0.0/16 -j DROP
iptables -A INPUT -i venet0 -s 172.16.0.0/12 -j DROP
iptables -A INPUT -i venet0 -s 10.0.0.0/8 -j DROP
iptables -A FORWARD -p tcp --sport 137:139 -o venet0 -j DROP
iptables -A FORWARD -p udp --sport 137:139 -o venet0 -j DROP
iptables -A OUTPUT -p tcp --sport 137:139 -o venet0 -j DROP
iptables -A OUTPUT -p udp --sport 137:139 -o venet0 -j DROP
iptables -A INPUT -s $LOOP -j ACCEPT
iptables -A INPUT -d $LOOP -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 25 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 110 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 143 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 389 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 465 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 587 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 636 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 993 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 995 -j ACCEPT
iptables -A FORWARD -s "10.8.0.0/24" -j ACCEPT
iptables -A INPUT -p udp --dport 443 -j ACCEPT
iptables -A INPUT -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -j ACCEPT
iptables -A INPUT -i tap+ -j ACCEPT
iptables -A FORWARD -i tap+ -j ACCEPT
iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT --to-ports 8118
iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner --uid-owner privoxy -j ACCEPT
iptables -A OUTPUT -m state --state NEW -o venet0 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -j REJECT --reject-with icmp-host-prohibited
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o venet0 -j MASQUERADE
share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.