Blog Inforeseau.com – Alexandre Blanc Cyber Security

Openvpn and pihole on OVH VPS Server FAQ

Extra tips following my post about how to install your VPN server with Pi-hole on OVH VPS server in 30 min. ( http://blog.inforeseau.com/2019/04/install-your-vpn-server-with-pi-hole-on-ovh-vps-in-30-min )

The article describe how to install openvpn with a configuration that will allow client to client communication, which might be good in some cases, but if the goal is to just provide internet access through the tunnel with pi-hole filtering, then you might not want you clients to see each other.

Here is how to modify the configuration :

In openvpn server configuration, we’ll edit the server config under /etc/openvpn/server.conf
Identify the line like this :

client-to-client

And make it a comment adding a « # » in front so as it looks like this :

#client-to-client

This will disable the client to client communication at openvpn level, BUT, this is not enough, now than openvpn no longer allows communication between client, our default firewall rules still allows this through IP forwarding.

Therefore, we want to block this too. The original iptables rules.v4 looked like this :

#Generated by ourselves for pivpn and pi-hole
 *filter
 :INPUT ACCEPT [663907:41179802]
 :FORWARD ACCEPT [57036644:76048011107]
 :OUTPUT ACCEPT [5009068:528571183]
 -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
#Don t change the port 443 in the 3 lines below, this is for pihole performance
 -A INPUT -i tun0 -p tcp -m tcp --dport 443 -j REJECT --reject-with tcp-reset
 -A INPUT -i tun0 -p udp -m udp --dport 80 -j REJECT --reject-with icmp-port-unreachable
 -A INPUT -i tun0 -p udp -m udp --dport 443 -j REJECT --reject-with icmp-port-unreachable
#End of don t change these
#Port allowed for VPN, change if you decide to use another port for your VPN server (replace 443 below by whatever you chose)
 -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
 -A INPUT -p udp -m udp --dport 443 -j ACCEPT VPN to use another port
#End of port to change if you get your VPN server to run on another port
 -A INPUT -i lo -p udp -m udp --dport 53 -j ACCEPT
 -A INPUT -i lo -p tcp -m tcp --dport 53 -j ACCEPT
 -A INPUT -i tun0 -p udp -m udp --dport 53 -j ACCEPT
 -A INPUT -i tun0 -p tcp -m tcp --dport 53 -j ACCEPT
 -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
 -A INPUT -p icmp -j ACCEPT
 -A INPUT -j DROP
 COMMIT
 #Completed on Sat Apr 27 16:18:39 2019
 #Generated by iptables-save v1.6.0 on Sat Apr 27 16:18:39 2019
 *nat
 :PREROUTING ACCEPT [496992:46323248]
 :INPUT ACCEPT [335723:24234770]
 :OUTPUT ACCEPT [486171:32444728]
 :POSTROUTING ACCEPT [491702:32816107]
 #if you need to use 1 or more other port(s), just add as many line as below, whitout the # so it is actually loaded, ens3 is the NIC of the VPS, adjust if yours differ
 #Below will allow to connect to port 8080 aside of 443. 

 #- A PREROUTING -i ens3 -p udp -m udp --dport 8080 -j REDIRECT --to-port 443
 COMMIT
 #Completed certainly after 2019 Apr 27t

We are going to modify it by allowing a line that will disallow communication (FORWARD) between clients on the VPN interface « tun0 ». If you are not using default setup, or run on another distribution, check which interface host the VPN (/sbin/ifconfig and identify the one with IP 10.8.0.1).

We’ll add the following line :

-A FORWARD -i tun0 -o tun0 -j DROP

So as the full content of /etc/iptables/rules.v4 look like this :

#Generated by iptables-save v1.6.0 on a date after Apr 28 15:39:36 2019
 *nat
 :PREROUTING ACCEPT [0:0]
 :INPUT ACCEPT [0:0]
 :OUTPUT ACCEPT [0:0]
 :POSTROUTING ACCEPT [0:0]
 #if you need to use 1 or more other port(s), just add as many line as below, whitout the # so it is actually loaded, ens3 is the NIC of the VPS, adjust if yours differ
 #Below will allow to connect to port 8080 aside of 443. 
# -A PREROUTING -i ens3 -p udp --dport 8080 -j REDIRECT --to-port 4443 
 COMMIT
 Completed on Sun Apr 28 15:39:36 2019
 Generated by iptables-save v1.6.0 on Sun Apr 28 15:39:36 2019
 *filter
 :INPUT ACCEPT [0:0]
 :FORWARD ACCEPT [0:0]
 :OUTPUT ACCEPT [10705:786452]
 blocking openvpn client to client communication out of openvpn config
 -A FORWARD -i tun0 -o tun0 -j DROP
 end of blocking
 -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
#Don t change the port 443 in the 3 lines below, this is for pihole performance
 -A INPUT -i tun0 -p tcp -m tcp --dport 443 -j REJECT --reject-with tcp-reset
 -A INPUT -i tun0 -p udp -m udp --dport 80 -j REJECT --reject-with icmp-port-unreachable
 -A INPUT -i tun0 -p udp -m udp --dport 443 -j REJECT --reject-with icmp-port-unreachable
#End of don t change these
#Port allowed for VPN, change if you decide to use another port for your VPN server (replace 443 below by whatever you chose)
 -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
 -A INPUT -p udp -m udp --dport 443 -j ACCEPT
#End of port to change if you get your VPN server to run on another port
 -A INPUT -i lo -p udp -m udp --dport 53 -j ACCEPT
 -A INPUT -i lo -p tcp -m tcp --dport 53 -j ACCEPT
 -A INPUT -i tun0 -p udp -m udp --dport 53 -j ACCEPT
 -A INPUT -i tun0 -p tcp -m tcp --dport 53 -j ACCEPT
 -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
 -A INPUT -p icmp -j ACCEPT
 -A INPUT -j DROP
 COMMIT
 #Completed certainly after Sun Apr 28 15:39:36 2019

Apply the change and make sure you have no errors :

iptables-restore < /etc/iptables/rules.v4

Then reboot your VPS. Openvpn will restart with client-to-client disabled and IP FORWARD will no longer be allowed between clients.