i have openvpn server on old pc, that was connected to my isp router till now (i bought mikrotik), and everithyng is working great. now i whant put mikrotik beatwen isp router and openvpn server.
on old pc i have host system that acts as router to kvm virtualized os that contains openvpn, with strict iptables rules.
#!/bin/bash
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
#allow ssh
iptables -A OUTPUT -o enp2s0 -p tcp --sport 4378 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.0.12 --dport 4378 -j ACCEPT
iptables -A PREROUTING -t nat -d 192.168.0.15 -p udp --dport 1194 -j DNAT --to 192.168.122.100:1194
iptables -A FORWARD -i enp2s0 -o virbr0 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i virbr0 -o enp2s0 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A POSTROUTING -t nat -s 192.168.122.100 -j SNAT --to 192.168.0.15
this is rules on host system. vpn server is on 192.168.122.100 host ip is 192.168.0.15.
10.0.0.253 is ip address of dhcp server on mikrotik.
my isp router is on 192.168.0.0 subnet
from host system connected to mikrotik i can ping outside masquerade is set.
so hove to set up firewall on mikrotik so i can acces vpn server. or for start hove to setup access to ssh on host 10.0.0.253 from 192.168.0.12 my laptop.
It’s almost the same as iptables, the only important difference is that you can’t set default policy to DROP, so you need to add drop rule at the end of chain.
If you allow new and established without further conditions, you’re allowing pretty much everything, you don’t want that. If you allow new and established for only two udp ports, then browsing on two different tcp ports doesn’t have a chance.
What I think you want as starting point is something like this:
First rule allows all established and related connections (related are e.g. data connections for ftp). There’s no danger having this broad rule, because connection won’t become established by itself, without you allowing it first. Second rule drops all packets deemed invalid by conntrack. Packets that get beyond this point should be new connections (or untracked, if you play with raw table). Third rule is a handy shortcut, it allows all dstnatted connections. You just need to forward a port and don’t need to add specific exception to forward chain. Last rule drops the rest. To allow something else (web browsing, …) add additional exceptions before the last rule, e.g.:
And if something doesn’t work while the last drop rule is active, enable logging for the rule and see what exactly gets dropped, and add additional exceptions if needed.
have an issue ,i blocked one MAC of a user with this method but it is not working:
On the “Firewall” window, select the “+” sign (add).
On the “Firewall Rule” window, select the tab “General” and set the “chain” to “forward”.
IF you want to block MAC, go to “Advanced” tab and add the MAC to the “Scr. MAC Address” field.
Then, on the “Action” tab, set the “Action” to “drop”.
Finally, click “Apply” to save the new rule.
But when i check again , this person is again connected with the same MAC Address . Why need your help,