0

i do have a debian VPS that i need to protect. I would like the server to have only access through ssh and openvpn. once connected then no restrictions apply. Also, block scanners and ping to the server. Since i am stuck with the set of iptables commands i would like some help, please. At the moment the iptables are:

iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -F
iptables -X
iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 1194 -j ACCEPT
iptables -P INPUT DROP
iptables -A OUTPUT -p tcp -m tcp --sport 22 -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --sport 1194 -j ACCEPT
iptables -P OUTPUT DROP

once connected then be able to browse the Internet. Also i would like the system to be able to send emails, dns requests.

1 Answer 1

2

Most of your requirements are clear, e. g.:

  • the Debian VPS must be able to send emails
  • the Debian VPS must be able to query DNS servers
  • block scanners from the Debian VPS
  • your computer must be able to establish SSH sessions to the VPS
  • your computer must be able to establish openVPN sessions to the VPS

Unclear to me is "once connected then be able to browse the Internet". I have an assumption, though. ;)

send emails

Depending on which protocol you want to use to send emails, open the respective port (e. g. TCP port 25 or TCP port 587; I'll use 25 in the below example):

iptables -I OUTPUT -p tcp -m tcp --dport 25 -j ACCEPT

Then, you need to allow incoming return traffic from the remote mail server:

iptables -I INPUT -p tcp -m tcp --sport 25 -j ACCEPT

or better:

iptables -I INPUT -p tcp -m state --state ESTABLISHED,RELATED --sport 25 -j ACCEPT

(allowing all tcp return traffic from port 25 in a connection established by your Debian VPS).

DNS queries

This is very similar to sending emails:

iptables -I OUTPUT -p udp --dport 53 -j ACCEPT
iptables -I INPUT -p udp -m state --state ESTABLISHED,RELATED --sport 53 -j ACCEPT

SSH and openVPN

this is what you already configured yourself

browse the Internet

I assume that you want to

  • connect to the Debian VPS via openVPN
  • browse the Internet via the Debian VPS
  • so that your PC at home appears as it was the Debian VPS (in terms of public IP address)

So you want to

enable kernel forwarding on the Debian VPS:

$ sudo sysctl -w net.ipv4.ip_forward=1

and additionally

$ sudo nano /etc/sysctl.conf

and ensure that there is an uncommented (without # in front) line which reads

net.ipv4.ip_forward=1

enable iptables forwarding

Also, you want to enable forwarding in iptables: I assume that you use openVPN in routing mode using a tun device (as opposed to bridging mode using a tap device, and that you use 10.8.0.0/24 (openVPN's default) as IP address range.

iptables -A INPUT -i tun+ -j ACCEPT
iptables -A OUTPUT -o tun+ -j ACCEPT
iptables -A FORWARD -o eth0 -i tun+ -s 10.8.0.0/24 -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

blocking scanners

Well, scanners usually look at frequently used ports like 80, 22, 1194. So I personally like to use different ports. I wrote about using different methods in this superuser post here, using atd to help you not lock yourself out of the remote Debian VPS. In short, you could

  • use SSH and openVPN each on a different port
  • use port knocking to open the ports upon request
1
  • Did that help you, @john?
    – stueja
    Aug 3, 2016 at 3:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .