Nftables und openvpn

Variablen

• define WANDEV = enp0s3
• define DMZDEV = enp0s8
• define LANDEV = enp0s9
• define SERVERDEV = enp0s10
• define DMZ = 10.88.2XX.0/24
• define LAN = 172.26.2XX.0/24
• define SERVER = 10.2XX.1.0/24
• define VPNDEV = tun0
• define VPNPORT = 1194
• define VPN = 172.20.2XX.0/24

[Bearbeiten]

Vorausgesetztes Connection Tracking

Verschlüsselter Verkehr – OpenVPN UDP (input Kette)

ct state new iif $WANDEV udp dport $VPNPORT accept

VPN → DMZ Pakete aus dem Tunnel ins interne Netz (forward Kette)

ct state new iif $VPNDEV oif $DMZDEV ip saddr $VPN ip daddr $DMZ accept

VPN → LAN Pakete aus dem Tunnel ins interne Netz (forward Kette)

ct state new iif $VPNDEV oif $LANDEV ip saddr $VPN ip daddr $LAN accept

VPN → SERVER Pakete aus dem Tunnel ins interne Netz (forward Kette)

ct state new iif $VPNDEV oif $SERVERDEV ip saddr $VPN ip daddr $SERVER accept