Nftables und openvpn: Unterschied zwischen den Versionen
Zur Navigation springen
Zur Suche springen
| (4 dazwischenliegende Versionen desselben Benutzers werden nicht angezeigt) | |||
| Zeile 1: | Zeile 1: | ||
= Variablen = | = Variablen = | ||
| − | *WANDEV = enp0s3 | + | *define WANDEV = enp0s3 |
| − | * | + | *define DMZDEV = enp0s8 |
| − | + | *define LANDEV = enp0s9 | |
| − | * | + | *define SERVERDEV = enp0s10 |
| − | * | + | *define DMZ = 10.88.2XX.0/24 |
| − | * | + | *define LAN = 172.26.2XX.0/24 |
| − | * | + | *define SERVER = 10.2XX.1.0/24 |
| − | *VPN = 172.20.2XX.0/24 | + | *define VPNDEV = tun0 |
| + | *define VPNPORT = 1194 | ||
| + | *define VPN = 172.20.2XX.0/24 | ||
{{#drawio:ipt-openvpn}} | {{#drawio:ipt-openvpn}} | ||
| Zeile 13: | Zeile 15: | ||
; Verschlüsselter Verkehr – OpenVPN UDP (input Kette) | ; Verschlüsselter Verkehr – OpenVPN UDP (input Kette) | ||
ct state new iif $WANDEV udp dport $VPNPORT accept | ct state new iif $WANDEV udp dport $VPNPORT accept | ||
| − | ; VPN → SERVER | + | ; VPN → DMZ Pakete aus dem Tunnel ins interne Netz (forward Kette) |
| + | ct state new iif $VPNDEV oif $DMZDEV ip saddr $VPN ip daddr $DMZ accept | ||
| + | ; VPN → LAN Pakete aus dem Tunnel ins interne Netz (forward Kette) | ||
| + | ct state new iif $VPNDEV oif $LANDEV ip saddr $VPN ip daddr $LAN accept | ||
| + | ; VPN → SERVER Pakete aus dem Tunnel ins interne Netz (forward Kette) | ||
ct state new iif $VPNDEV oif $SERVERDEV ip saddr $VPN ip daddr $SERVER accept | ct state new iif $VPNDEV oif $SERVERDEV ip saddr $VPN ip daddr $SERVER accept | ||
| − | |||
| − | |||
Aktuelle Version vom 4. August 2026, 07:06 Uhr
Variablen
- define WANDEV = enp0s3
- define DMZDEV = enp0s8
- define LANDEV = enp0s9
- define SERVERDEV = enp0s10
- define DMZ = 10.88.2XX.0/24
- define LAN = 172.26.2XX.0/24
- define SERVER = 10.2XX.1.0/24
- define VPNDEV = tun0
- define VPNPORT = 1194
- define VPN = 172.20.2XX.0/24
![Bearbeiten](javascript:editDrawio("777845380", "ipt-openvpn.drawio.png", "png", false, false, false, true, "https://embed.diagrams.net")){kind=link}
Vorausgesetztes Connection Tracking
- Verschlüsselter Verkehr – OpenVPN UDP (input Kette)
ct state new iif $WANDEV udp dport $VPNPORT accept
- VPN → DMZ Pakete aus dem Tunnel ins interne Netz (forward Kette)
ct state new iif $VPNDEV oif $DMZDEV ip saddr $VPN ip daddr $DMZ accept
- VPN → LAN Pakete aus dem Tunnel ins interne Netz (forward Kette)
ct state new iif $VPNDEV oif $LANDEV ip saddr $VPN ip daddr $LAN accept
- VPN → SERVER Pakete aus dem Tunnel ins interne Netz (forward Kette)
ct state new iif $VPNDEV oif $SERVERDEV ip saddr $VPN ip daddr $SERVER accept