Nftables und openvpn: Unterschied zwischen den Versionen
Zur Navigation springen
Zur Suche springen
| Zeile 7: | Zeile 7: | ||
*define LAN = 172.26.2XX.0/24 | *define LAN = 172.26.2XX.0/24 | ||
*define SERVER = 10.2XX.1.0/24 | *define SERVER = 10.2XX.1.0/24 | ||
| − | *#Neu | + | *<nowiki>#Neu</nowiki> |
*define VPNDEV = tun0 | *define VPNDEV = tun0 | ||
*define VPNPORT = 1194 | *define VPNPORT = 1194 | ||
Version vom 29. September 2026, 08:31 Uhr
Variablen
- define WANDEV = enp0s3
- define DMZDEV = enp0s8
- define LANDEV = enp0s9
- define SERVERDEV = enp0s10
- define DMZ = 10.88.2XX.0/24
- define LAN = 172.26.2XX.0/24
- define SERVER = 10.2XX.1.0/24
- #Neu
- define VPNDEV = tun0
- define VPNPORT = 1194
- define VPN = 172.20.2XX.0/24
![Bearbeiten](javascript:editDrawio("754072948", "ipt-openvpn.drawio.png", "png", false, false, false, true, "https://embed.diagrams.net")){kind=link}
Vorausgesetztes Connection Tracking
- Verschlüsselter Verkehr – OpenVPN UDP (input Kette)
ct state new iif $WANDEV udp dport $VPNPORT accept
- VPN → DMZ Pakete aus dem Tunnel ins interne Netz (forward Kette)
ct state new iif $VPNDEV oif $DMZDEV ip saddr $VPN ip daddr $DMZ accept
- VPN → LAN Pakete aus dem Tunnel ins interne Netz (forward Kette)
ct state new iif $VPNDEV oif $LANDEV ip saddr $VPN ip daddr $LAN accept
- VPN → SERVER Pakete aus dem Tunnel ins interne Netz (forward Kette)
ct state new iif $VPNDEV oif $SERVERDEV ip saddr $VPN ip daddr $SERVER accept