Eu configurei o servidor openvpn no openwrt. Quando tento conectar-me ao servidor vpn, o ufw bloqueia o tráfego do meu roteador:
Sep 29 19:22:58 debian nm-openvpn[11139]: OpenVPN 2.4.3 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jun 30 2017
Sep 29 19:22:58 debian nm-openvpn[11139]: library versions: OpenSSL 1.0.2l 25 May 2017, LZO 2.08
Sep 29 19:22:59 debian nm-openvpn[11139]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sep 29 19:22:59 debian nm-openvpn[11139]: TCP/UDP: Preserving recently used remote address: [AF_INET]my-public-ip:1194
Sep 29 19:22:59 debian nm-openvpn[11139]: UDP link local: (not bound)
Sep 29 19:22:59 debian nm-openvpn[11139]: UDP link remote: [AF_INET]my-public-ip:1194
Sep 29 19:22:59 debian nm-openvpn[11139]: NOTE: chroot will be delayed because of --client, --pull, or --up-delay
Sep 29 19:22:59 debian nm-openvpn[11139]: NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Sep 29 19:22:59 debian kernel: [352532.393466] [UFW BLOCK] IN=wlan0 OUT= MAC=mac-address SRC=10.0.10.1 DST=10.0.10.100 LEN=54 TOS=0x00 PREC=0x00 TTL=64 ID=9547 DF PROTO=UDP SPT=1194 DPT=53955 LEN=34
Sep 29 19:23:01 debian kernel: [352534.424641] [UFW BLOCK] IN=wlan0 OUT= MAC=mac-address SRC=10.0.10.1 DST=10.0.10.100 LEN=42 TOS=0x00 PREC=0x00 TTL=64 ID=9708 DF PROTO=UDP SPT=1194 DPT=53955 LEN=22
Sep 29 19:23:01 debian kernel: [352534.545230] [UFW BLOCK] IN=wlan0 OUT= MAC=mac-address SRC=10.0.10.1 DST=10.0.10.100 LEN=50 TOS=0x00 PREC=0x00 TTL=64 ID=9709 DF PROTO=UDP SPT=1194 DPT=53955 LEN=30
Sep 29 19:23:05 debian kernel: [352538.484704] [UFW BLOCK] IN=wlan0 OUT= MAC=mac-address SRC=10.0.10.1 DST=10.0.10.100 LEN=42 TOS=0x00 PREC=0x00 TTL=64 ID=9838 DF PROTO=UDP SPT=1194 DPT=53955 LEN=22
Sep 29 19:23:05 debian kernel: [352538.902302] [UFW BLOCK] IN=wlan0 OUT= MAC=mac-address SRC=10.0.10.1 DST=10.0.10.100 LEN=50 TOS=0x00 PREC=0x00 TTL=64 ID=9872 DF PROTO=UDP SPT=1194 DPT=53955 LEN=30
O que não entendo é quando me conecto à nossa empresa openvpn. Eu me conecto sem nenhum problema. Aqui estão as regras:
# iptables -L
Chain INPUT (policy DROP)
target prot opt source destination
ufw-before-logging-input all -- anywhere anywhere
ufw-before-input all -- anywhere anywhere
ufw-after-input all -- anywhere anywhere
ufw-after-logging-input all -- anywhere anywhere
ufw-reject-input all -- anywhere anywhere
ufw-track-input all -- anywhere anywhere
Chain FORWARD (policy DROP)
target prot opt source destination
ufw-before-logging-forward all -- anywhere anywhere
ufw-before-forward all -- anywhere anywhere
ufw-after-forward all -- anywhere anywhere
ufw-after-logging-forward all -- anywhere anywhere
ufw-reject-forward all -- anywhere anywhere
ufw-track-forward all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ufw-before-logging-output all -- anywhere anywhere
ufw-before-output all -- anywhere anywhere
ufw-after-output all -- anywhere anywhere
ufw-after-logging-output all -- anywhere anywhere
ufw-reject-output all -- anywhere anywhere
ufw-track-output all -- anywhere anywhere
Chain ufw-after-forward (1 references)
target prot opt source destination
Chain ufw-after-input (1 references)
target prot opt source destination
ufw-skip-to-policy-input udp -- anywhere anywhere udp dpt:netbios-ns
ufw-skip-to-policy-input udp -- anywhere anywhere udp dpt:netbios-dgm
ufw-skip-to-policy-input tcp -- anywhere anywhere tcp dpt:netbios-ssn
ufw-skip-to-policy-input tcp -- anywhere anywhere tcp dpt:microsoft-ds
ufw-skip-to-policy-input udp -- anywhere anywhere udp dpt:bootps
ufw-skip-to-policy-input udp -- anywhere anywhere udp dpt:bootpc
ufw-skip-to-policy-input all -- anywhere anywhere ADDRTYPE match dst-type BROADCAST
Chain ufw-after-logging-forward (1 references)
target prot opt source destination
LOG all -- anywhere anywhere limit: avg 3/min burst 10 LOG level warning prefix "[UFW BLOCK] "
Chain ufw-after-logging-input (1 references)
target prot opt source destination
LOG all -- anywhere anywhere limit: avg 3/min burst 10 LOG level warning prefix "[UFW BLOCK] "
Chain ufw-after-logging-output (1 references)
target prot opt source destination
Chain ufw-after-output (1 references)
target prot opt source destination
Chain ufw-before-forward (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT icmp -- anywhere anywhere icmp destination-unreachable
ACCEPT icmp -- anywhere anywhere icmp source-quench
ACCEPT icmp -- anywhere anywhere icmp time-exceeded
ACCEPT icmp -- anywhere anywhere icmp parameter-problem
ACCEPT icmp -- anywhere anywhere icmp echo-request
ufw-user-forward all -- anywhere anywhere
Chain ufw-before-input (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ufw-logging-deny all -- anywhere anywhere ctstate INVALID
DROP all -- anywhere anywhere ctstate INVALID
ACCEPT icmp -- anywhere anywhere icmp destination-unreachable
ACCEPT icmp -- anywhere anywhere icmp source-quench
ACCEPT icmp -- anywhere anywhere icmp time-exceeded
ACCEPT icmp -- anywhere anywhere icmp parameter-problem
ACCEPT icmp -- anywhere anywhere icmp echo-request
ACCEPT udp -- anywhere anywhere udp spt:bootps dpt:bootpc
ufw-not-local all -- anywhere anywhere
ACCEPT udp -- anywhere 224.0.0.251 udp dpt:mdns
ACCEPT udp -- anywhere 239.255.255.250 udp dpt:1900
ufw-user-input all -- anywhere anywhere
Chain ufw-before-logging-forward (1 references)
target prot opt source destination
Chain ufw-before-logging-input (1 references)
target prot opt source destination
Chain ufw-before-logging-output (1 references)
target prot opt source destination
Chain ufw-before-output (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ufw-user-output all -- anywhere anywhere
Chain ufw-logging-allow (0 references)
target prot opt source destination
LOG all -- anywhere anywhere limit: avg 3/min burst 10 LOG level warning prefix "[UFW ALLOW] "
Chain ufw-logging-deny (2 references)
target prot opt source destination
RETURN all -- anywhere anywhere ctstate INVALID limit: avg 3/min burst 10
LOG all -- anywhere anywhere limit: avg 3/min burst 10 LOG level warning prefix "[UFW BLOCK] "
Chain ufw-not-local (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere ADDRTYPE match dst-type LOCAL
RETURN all -- anywhere anywhere ADDRTYPE match dst-type MULTICAST
RETURN all -- anywhere anywhere ADDRTYPE match dst-type BROADCAST
ufw-logging-deny all -- anywhere anywhere limit: avg 3/min burst 10
DROP all -- anywhere anywhere
Chain ufw-reject-forward (1 references)
target prot opt source destination
Chain ufw-reject-input (1 references)
target prot opt source destination
Chain ufw-reject-output (1 references)
target prot opt source destination
Chain ufw-skip-to-policy-forward (0 references)
target prot opt source destination
DROP all -- anywhere anywhere
Chain ufw-skip-to-policy-input (7 references)
target prot opt source destination
DROP all -- anywhere anywhere
Chain ufw-skip-to-policy-output (0 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
Chain ufw-track-forward (1 references)
target prot opt source destination
Chain ufw-track-input (1 references)
target prot opt source destination
Chain ufw-track-output (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere ctstate NEW
ACCEPT udp -- anywhere anywhere ctstate NEW
Chain ufw-user-forward (1 references)
target prot opt source destination
Chain ufw-user-input (1 references)
target prot opt source destination
Chain ufw-user-limit (0 references)
target prot opt source destination
LOG all -- anywhere anywhere limit: avg 3/min burst 5 LOG level warning prefix "[UFW LIMIT BLOCK] "
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
Chain ufw-user-limit-accept (0 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
Chain ufw-user-logging-forward (0 references)
target prot opt source destination
Chain ufw-user-logging-input (0 references)
target prot opt source destination
Chain ufw-user-logging-output (0 references)
target prot opt source destination
Chain ufw-user-output (1 references)
target prot opt source destination
e aqui estão as regras adicionadas:
# ufw show added
Added user rules (see 'ufw status' for running firewall):
(None)
Mais uma vez, posso me conectar com sucesso a outro servidor VPN. Quando desabilito o ufw posso me conectar ao meu openvpn sem dns, a menos que eu ative o ufw e adicione as seguintes regras:
# ufw allow proto udp from 10.0.10.1
# ufw allow dns
Mas ainda estou me perguntando por que funciona com um servidor openvpn e não funciona com o outro?
Estou executando o debian stretch:
# lsb_release -a
No LSB modules are available.
Distributor ID: Debian
Description: Debian GNU/Linux stable-updates (sid)
Release: stable-updates
Codename: sid
# uname -a
Linux debian 4.12.8 #1 SMP Sat Aug 19 16:04:08 CEST 2017 x86_64 GNU/Linux
Alguém tem uma explicação? Obrigado