Nftables und openvpn

Variablen

• WANDEV = enp0s3
• DMZDEV = enp0s8
• LANDEV = enp0s9
• SERVERDEV = enp0s10
• DMZ = 10.88.2XX.0/24
• LAN = 172.26.2XX.0/24
• SERVER = 10.2XX.1.0/24
• VPNDEV = tun0
• VPNPORT = 1194
• VPN = 172.20.2XX.0/24

[Bearbeiten]

Vorausgesetztes Connection Tracking

Verschlüsselter Verkehr – OpenVPN UDP (input Kette)

ct state new iif $WANDEV udp dport $VPNPORT accept

VPN → DMZ Pakete aus dem Tunnel ins interne Netz (forward Kette)

ct state new iif $VPNDEV oif $DMZDEV ip saddr $VPN ip daddr $DMZ accept

VPN → LAN Pakete aus dem Tunnel ins interne Netz (forward Kette)

ct state new iif $VPNDEV oif $LANDEV ip saddr $VPN ip daddr $LAN accept

VPN → SERVER Pakete aus dem Tunnel ins interne Netz (forward Kette)

ct state new iif $VPNDEV oif $SERVERDEV ip saddr $VPN ip daddr $SERVER accept