Most of your requirements are clear, e. g.:
- the Debian VPS must be able to send emails
- the Debian VPS must be able to query DNS servers
- block scanners from the Debian VPS
- your computer must be able to establish SSH sessions to the VPS
- your computer must be able to establish openVPN sessions to the VPS
Unclear to me is "once connected then be able to browse the Internet". I have an assumption, though. ;)
send emails
Depending on which protocol you want to use to send emails, open the respective port (e. g. TCP port 25 or TCP port 587; I'll use 25 in the below example):
iptables -I OUTPUT -p tcp -m tcp --dport 25 -j ACCEPT
Then, you need to allow incoming return traffic from the remote mail server:
iptables -I INPUT -p tcp -m tcp --sport 25 -j ACCEPT
or better:
iptables -I INPUT -p tcp -m state --state ESTABLISHED,RELATED --sport 25 -j ACCEPT
(allowing all tcp return traffic from port 25 in a connection established by your Debian VPS).
DNS queries
This is very similar to sending emails:
iptables -I OUTPUT -p udp --dport 53 -j ACCEPT
iptables -I INPUT -p udp -m state --state ESTABLISHED,RELATED --sport 53 -j ACCEPT
SSH and openVPN
this is what you already configured yourself
browse the Internet
I assume that you want to
- connect to the Debian VPS via openVPN
- browse the Internet via the Debian VPS
- so that your PC at home appears as it was the Debian VPS (in terms of public IP address)
So you want to
enable kernel forwarding on the Debian VPS:
$ sudo sysctl -w net.ipv4.ip_forward=1
and additionally
$ sudo nano /etc/sysctl.conf
and ensure that there is an uncommented (without #
in front) line which reads
net.ipv4.ip_forward=1
enable iptables forwarding
Also, you want to enable forwarding in iptables:
I assume that you use openVPN in routing mode using a tun
device (as opposed to bridging mode using a tap
device, and that you use 10.8.0.0/24 (openVPN's default) as IP address range.
iptables -A INPUT -i tun+ -j ACCEPT
iptables -A OUTPUT -o tun+ -j ACCEPT
iptables -A FORWARD -o eth0 -i tun+ -s 10.8.0.0/24 -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
blocking scanners
Well, scanners usually look at frequently used ports like 80, 22, 1194. So I personally like to use different ports. I wrote about using different methods in this superuser post here, using atd
to help you not lock yourself out of the remote Debian VPS. In short, you could
- use SSH and openVPN each on a different port
- use port knocking to open the ports upon request