Nftables und openvpn: Unterschied zwischen den Versionen
Zur Navigation springen
Zur Suche springen
| Zeile 1: | Zeile 1: | ||
= Variablen = | = Variablen = | ||
*WANDEV = enp0s3 | *WANDEV = enp0s3 | ||
| + | *DMZDEV = enp0s8 | ||
| + | *LANDEV = enp0s9 | ||
*SERVERDEV = enp0s10 | *SERVERDEV = enp0s10 | ||
| − | * | + | *DMZ = 10.88.2XX.0/24 |
| + | *LAN = 172.26.2XX.0/24 | ||
*SERVER = 10.2XX.1.0/24 | *SERVER = 10.2XX.1.0/24 | ||
| − | |||
| − | |||
*VPNDEV = tun0 | *VPNDEV = tun0 | ||
*VPNPORT = 1194 | *VPNPORT = 1194 | ||
Version vom 4. August 2026, 06:56 Uhr
Variablen
- WANDEV = enp0s3
- DMZDEV = enp0s8
- LANDEV = enp0s9
- SERVERDEV = enp0s10
- DMZ = 10.88.2XX.0/24
- LAN = 172.26.2XX.0/24
- SERVER = 10.2XX.1.0/24
- VPNDEV = tun0
- VPNPORT = 1194
- VPN = 172.20.2XX.0/24
![Bearbeiten](javascript:editDrawio("1739353951", "ipt-openvpn.drawio.png", "png", false, false, false, true, "https://embed.diagrams.net")){kind=link}
Vorausgesetztes Connection Tracking
- Verschlüsselter Verkehr – OpenVPN UDP (input Kette)
ct state new iif $WANDEV udp dport $VPNPORT accept
- VPN → SERVER
- Pakete aus dem Tunnel ins interne Netz (forward Kette)
ct state new iif $VPNDEV oif $SERVERDEV ip saddr $VPN ip daddr $SERVER accept
- VPN → DMZ
- Pakete aus dem Tunnel ins interne Netz (forward Kette)
ct state new iif $VPNDEV oif $DMZDEV ip saddr $VPN ip daddr $DMZ accept