Nftables und openvpn: Unterschied zwischen den Versionen
Zur Navigation springen
Zur Suche springen
| Zeile 15: | Zeile 15: | ||
; Verschlüsselter Verkehr – OpenVPN UDP (input Kette) | ; Verschlüsselter Verkehr – OpenVPN UDP (input Kette) | ||
ct state new iif $WANDEV udp dport $VPNPORT accept | ct state new iif $WANDEV udp dport $VPNPORT accept | ||
| − | ; VPN → DMZ | + | ; VPN → DMZ Pakete aus dem Tunnel ins interne Netz (forward Kette) |
ct state new iif $VPNDEV oif $DMZDEV ip saddr $VPN ip daddr $DMZ accept | ct state new iif $VPNDEV oif $DMZDEV ip saddr $VPN ip daddr $DMZ accept | ||
| − | ; VPN → LAN | + | ; VPN → LAN Pakete aus dem Tunnel ins interne Netz (forward Kette) |
ct state new iif $VPNDEV oif $LANDEV ip saddr $VPN ip daddr $LAN accept | ct state new iif $VPNDEV oif $LANDEV ip saddr $VPN ip daddr $LAN accept | ||
| − | ; VPN → SERVER | + | ; VPN → SERVER Pakete aus dem Tunnel ins interne Netz (forward Kette) |
ct state new iif $VPNDEV oif $SERVERDEV ip saddr $VPN ip daddr $SERVER accept | ct state new iif $VPNDEV oif $SERVERDEV ip saddr $VPN ip daddr $SERVER accept | ||
Version vom 4. August 2026, 06:59 Uhr
Variablen
- WANDEV = enp0s3
- DMZDEV = enp0s8
- LANDEV = enp0s9
- SERVERDEV = enp0s10
- DMZ = 10.88.2XX.0/24
- LAN = 172.26.2XX.0/24
- SERVER = 10.2XX.1.0/24
- VPNDEV = tun0
- VPNPORT = 1194
- VPN = 172.20.2XX.0/24
![Bearbeiten](javascript:editDrawio("102975850", "ipt-openvpn.drawio.png", "png", false, false, false, true, "https://embed.diagrams.net")){kind=link}
Vorausgesetztes Connection Tracking
- Verschlüsselter Verkehr – OpenVPN UDP (input Kette)
ct state new iif $WANDEV udp dport $VPNPORT accept
- VPN → DMZ Pakete aus dem Tunnel ins interne Netz (forward Kette)
ct state new iif $VPNDEV oif $DMZDEV ip saddr $VPN ip daddr $DMZ accept
- VPN → LAN Pakete aus dem Tunnel ins interne Netz (forward Kette)
ct state new iif $VPNDEV oif $LANDEV ip saddr $VPN ip daddr $LAN accept
- VPN → SERVER Pakete aus dem Tunnel ins interne Netz (forward Kette)
ct state new iif $VPNDEV oif $SERVERDEV ip saddr $VPN ip daddr $SERVER accept