Openvpn and pihole on OVH VPS Server FAQ

Extra tips following my post about how to install your VPN server with Pi-hole on OVH VPS server in 30 min. ( http://blog.inforeseau.com/2019/04/install-your-vpn-server-with-pi-hole-on-ovh-vps-in-30-min )

The article describe how to install openvpn with a configuration that will allow client to client communication, which might be good in some cases, but if the goal is to just provide internet access through the tunnel with pi-hole filtering, then you might not want you clients to see each other.

Here is how to modify the configuration :

In openvpn server configuration, we’ll edit the server config under /etc/openvpn/server.conf
Identify the line like this :

client-to-client

And make it a comment adding a « # » in front so as it looks like this :

#client-to-client

This will disable the client to client communication at openvpn level, BUT, this is not enough, now than openvpn no longer allows communication between client, our default firewall rules still allows this through IP forwarding.

Therefore, we want to block this too. The original iptables rules.v4 looked like this :

#Generated by ourselves for pivpn and pi-hole
*filter
:INPUT ACCEPT [663907:41179802]
:FORWARD ACCEPT [57036644:76048011107]
:OUTPUT ACCEPT [5009068:528571183]
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
#Don t change the port 443 in the 3 lines below, this is for pihole performance
-A INPUT -i tun0 -p tcp -m tcp --dport 443 -j REJECT --reject-with tcp-reset
-A INPUT -i tun0 -p udp -m udp --dport 80 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -i tun0 -p udp -m udp --dport 443 -j REJECT --reject-with icmp-port-unreachable
#End of don t change these
#Port allowed for VPN, change if you decide to use another port for your VPN server (replace 443 below by whatever you chose)
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p udp -m udp --dport 443 -j ACCEPT VPN to use another port
#End of port to change if you get your VPN server to run on another port
-A INPUT -i lo -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i lo -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i tun0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i tun0 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -j DROP
COMMIT
#Completed on Sat Apr 27 16:18:39 2019
#Generated by iptables-save v1.6.0 on Sat Apr 27 16:18:39 2019
*nat
:PREROUTING ACCEPT [496992:46323248]
:INPUT ACCEPT [335723:24234770]
:OUTPUT ACCEPT [486171:32444728]
:POSTROUTING ACCEPT [491702:32816107]
#if you need to use 1 or more other port(s), just add as many line as below, whitout the # so it is actually loaded, ens3 is the NIC of the VPS, adjust if yours differ
#Below will allow to connect to port 8080 aside of 443.

#- A PREROUTING -i ens3 -p udp -m udp --dport 8080 -j REDIRECT --to-port 443
COMMIT
#Completed certainly after 2019 Apr 27t

We are going to modify it by allowing a line that will disallow communication (FORWARD) between clients on the VPN interface « tun0 ». If you are not using default setup, or run on another distribution, check which interface host the VPN (/sbin/ifconfig and identify the one with IP 10.8.0.1).

We’ll add the following line :

-A FORWARD -i tun0 -o tun0 -j DROP

So as the full content of /etc/iptables/rules.v4 look like this :

#Generated by iptables-save v1.6.0 on a date after Apr 28 15:39:36 2019
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
#if you need to use 1 or more other port(s), just add as many line as below, whitout the # so it is actually loaded, ens3 is the NIC of the VPS, adjust if yours differ
#Below will allow to connect to port 8080 aside of 443.
# -A PREROUTING -i ens3 -p udp --dport 8080 -j REDIRECT --to-port 4443
COMMIT
Completed on Sun Apr 28 15:39:36 2019
Generated by iptables-save v1.6.0 on Sun Apr 28 15:39:36 2019
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [10705:786452]
blocking openvpn client to client communication out of openvpn config
-A FORWARD -i tun0 -o tun0 -j DROP
end of blocking
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
#Don t change the port 443 in the 3 lines below, this is for pihole performance
-A INPUT -i tun0 -p tcp -m tcp --dport 443 -j REJECT --reject-with tcp-reset
-A INPUT -i tun0 -p udp -m udp --dport 80 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -i tun0 -p udp -m udp --dport 443 -j REJECT --reject-with icmp-port-unreachable
#End of don t change these
#Port allowed for VPN, change if you decide to use another port for your VPN server (replace 443 below by whatever you chose)
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p udp -m udp --dport 443 -j ACCEPT
#End of port to change if you get your VPN server to run on another port
-A INPUT -i lo -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i lo -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i tun0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i tun0 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -j DROP
COMMIT
#Completed certainly after Sun Apr 28 15:39:36 2019

Apply the change and make sure you have no errors :

iptables-restore < /etc/iptables/rules.v4

Then reboot your VPS. Openvpn will restart with client-to-client disabled and IP FORWARD will no longer be allowed between clients.

Not f'd — you won't find me on Facebook
mai 2019
L M M J V S D
« Avr    
 12345
6789101112
13141516171819
20212223242526
2728293031  
 

 
Suivez moi sur twitter - follow me on twitter
[FSF Associate Member]
 
Free Software, Free Society
VIRTUALISATION :
Compacter une image virtualbox VDI
Bon petit tutoriel esxi
Marche d'appliances vmware
Installer ESXi sur un disque IDE
Installer ESXi 3.5 sur un disque USB
Installer proxmox avec DRBD et migration / réplication à chaud
Installer OSSEC avec VMware
Information sur le VDI
SECURITE - FIREWALL :
Ouvrir des ports dynamiquement iptables - knockd
Autre tres bon tuto knockd
Docs Arp poisoning - Anglais
Metasploit test de pénétration
Zone H - sites piratés en temps réel
Blog invisible things
Tips protection sécurité wordpress
Pfsense - distribution firewall opensource - adsl internet failover
Iproute 2 mini how to - linux advanced routing
ClearOS - la passerelle sécuritaire lan - wan
HAUTE DISPONIBILITE :
CDN - Accélération de la distribution de données
drbd iscsi ocfs2 dm multipath tutoriel
Load balancing LVS
Load balancing opensource list
HA-Proxy :
HAproxy - http load balancer
Simple tutoriel HAproxy
HAproxy - debian tutoriel
Centos - Ip failover
Configuratoin DM-Multipath Redhat
VMware Doubletake - continuité
Quelques liens sur la réplication MySQL : Manuel MySQL, chapitre sur la réplication
Manuel MySQL, Tutoriel clair sur la mise en place
Autre tuto sur la mise en place de la réplication MySQL
Références pour optimisation du serveur MySQL
Utilisation de EXPLAIN mysql pour optimiser vos bases
optimiser vos bases - requetes et index
STOCKAGE RESEAU :
Un outil de clonage disque en reseau
Internet NAS 250Go 250 accès VPN
Server ISCSI avec Ubuntu tuto
ISCSI centos redhat tutoriel
Gérer et étendre un LVM
Créer sa piratebox ! trop cool
Deaddrops, les clés USB dans les murs, aussi cool !
OPTIMISATION WORDPRESS :
Télécharger Xenu
Comment utiliser Xenu
optimisation hébergement wordpress
Super howto wordpress (En)
Test de charge serveur web - Load impact
VPN - ROUTEUR - LAN:
Zeroshell - le mini-routeur wifi tout en un
Retroshare, votre réseau d'échange crypté!
Openvpn sur centos redhat
Intégrer Linux dans active directory
Routage inter-vlan avec Linux
Routage avec OSPF
Network Weathermap
TENDANCES - WEB:
Boutons twitter
Analyser les tendances des recherches Google
Protocole sitemap - robots.txt
Creer des animations CSS3
Code php pour interagir avec twitter
E reputation
Jquery
TRUCS ET ASTUCES GNU/LINUX :
Tuxmachines.org - Actus et tips linux
Configurer GRUB2 et grub2 ici
Panoet - en anglais - tips & tricks
Readylines tips and trick pertinents
Squid Clamav - proxy antivirus
Apprendre Unix en 10 minutes
13 tips sur les expressions régulières
IE Sous linux IES
LDAP 2.4 Quickstart guide
Tutoriel LDAP
Installation annuaire LDAP
Serveur Mail Postfix - Dovecot - LDAP - MDS
Créer un linux personnalisé en ligne - custom linux
Super site sur linux - en
Capistrano - déploiement automatisé
MONITORING :
Nagios tutoriel et doc
Nagios plugin NRPE tuto
Nagios plugin NRPE autre tuto
Nagios plugin NRPE officiel
Zabbix - fonctionnalités
Zabbix - installation
Guide MRTGsys - grapher la charge locale
MRTGsys - ajouter des graphs
MRTGsys - interpréter les données
Shinken - Monitoring
Thruk Monitoring webinterface
Shinken - Tutoriel
Shinken - Référence chez Nicolargo
AUTRES LIENS :
RemixJobs IT jobs
USB Multiboot
Reset mot de passe windows
Java python et autres tips, intéressant !
Forum inforeseau
Open Clipart
Excellent comic en ligne
Inforeseau.fr
 
Contrat Creative Commons
This création is licensed under a Creative Commons Paternité - Pas d'Utilisation Commerciale - Partage des Conditions Initiales à l'Identique 2.0 France License.