I'm trying to implement a set of iptables rules for OpenVPN:
- Everything (without exception) goes through OpenVPN
- If OpenVPN is down or inaccessible everything (without exception) cannot access the internet
- Local access is always possible, irrespective of the status of OpenVPN
The best (out of six examples) I've seen so far is this, however it still allows access to the internet when the VPN is down through ipv6:
# Clean down existing rules iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT iptables -t nat -F iptables -t mangle -F iptables -F iptables -X ip6tables -P INPUT ACCEPT ip6tables -P FORWARD ACCEPT ip6tables -P OUTPUT ACCEPT ip6tables -t nat -F ip6tables -t mangle -F ip6tables -F ip6tables -X # Allow loopback device (internal communication) iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT # Allow all local traffic. iptables -A INPUT -s 192.168.0.0/16 -j ACCEPT iptables -A OUTPUT -d 192.168.0.0/16 -j ACCEPT # Allow VPN establishment iptables -A OUTPUT -p udp --dport 1194 -j ACCEPT iptables -A INPUT -p udp --sport 1194 -j ACCEPT # Accept all TUN connections (tun = VPN tunnel) iptables -A OUTPUT -o tun+ -j ACCEPT iptables -A INPUT -i tun+ -j ACCEPT # Set default policies to drop all communication unless specifically allowed iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP
If I try to blanket block all ipv6 traffic (which is what a number of examples suggest) then I cannot connect to anything:
# Set default policies to drop all communication unless specifically allowed ip6tables -P INPUT DROP ip6tables -P OUTPUT DROP ip6tables -P FORWARD DROP
If I try to mirror what is in the ipv4 section then I have this:
# Allow loopback device (internal communication) ip6tables -A INPUT -i lo -j ACCEPT ip6tables -A OUTPUT -o lo -j ACCEPT # Allow all local traffic. # (Skipped as I don't know how to do this) # Allow VPN establishment ip6tables -A OUTPUT -p udp --dport 1194 -j ACCEPT ip6tables -A INPUT -p udp --sport 1194 -j ACCEPT # Accept all TUN connections (tun = VPN tunnel) ip6tables -A OUTPUT -o tun+ -j ACCEPT ip6tables -A INPUT -i tun+ -j ACCEPT
Now I'm unable to connect to anywhere and
curl https://ipinfo.io/ip just hangs.
How can I fix this?