Есть сервер с Debian 6.0 на борту.
На нём OpenVPN и iptables.
Подключены два клиента (IP выдаются через ccd openvpn'a):
10.24.10.20
и
10.24.11.10
Почему при такой конфигурации пакеты от клиента 10.24.10.20 доходят до клиента 10.24.11.10?
Вроде бы политика по умолчанию везде выставлена в drop.
OpenVPN конфиг:
local 93.***.***.***
port 1194
proto udp
dev tun0
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
dh /etc/openvpn/keys/dh2048.pem
server 10.24.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir /etc/openvpn/ccd
route 10.24.10.0 255.255.255.0
push «route 10.24.0.0 255.255.0.0»
client-to-client
keepalive 10 40
comp-lzo
user openvpn
group openvpn
persist-key
persist-tun
status /var/log/openvpn-status.log
log /var/log/openvpn.log
log-append /var/log/openvpn.log
verb 3
mute 20
iptables:
Chain INPUT (policy DROP 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 1427 181K ACCEPT all — lo any anywhere anywhere
2 0 0 REJECT all — !lo any anywhere loopback/8 reject-with icmp-port-unreachable
3 461 43543 ACCEPT tcp — any any anywhere anywhere tcp dpt:ssh
4 1413 203K ACCEPT udp — any any anywhere anywhere udp dpt:openvpn
5 0 0 ACCEPT tcp — any any anywhere anywhere tcp dpt:www
6 0 0 ACCEPT tcp — any any anywhere anywhere tcp dpt:https
7 10 526 LOG all — any any anywhere anywhere limit: avg 5/min burst 5 LOG level debug prefix `iptables denied: '
8 10 526 REJECT all — any any anywhere anywhere reject-with icmp-port-unreachable
Chain FORWARD (policy DROP 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 REJECT all — tun0 any 10.24.10.0/24 10.24.11.0/24 reject-with icmp-port-unreachable
2 0 0 REJECT udp — any any anywhere anywhere udp spt:openvpn reject-with icmp-port-unreachable
3 0 0 LOG all — any any anywhere anywhere limit: avg 5/min burst 5 LOG level debug prefix `iptables denied: '
4 0 0 REJECT all — any any anywhere anywhere reject-with icmp-port-unreachable
Chain OUTPUT (policy DROP 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 1427 181K ACCEPT all — any lo anywhere anywhere
2 0 0 REJECT all — any !lo anywhere loopback/8 reject-with icmp-port-unreachable
3 312 63412 ACCEPT tcp — any any anywhere anywhere tcp spt:ssh
4 1415 203K ACCEPT udp — any any anywhere anywhere udp spt:openvpn
5 0 0 ACCEPT tcp — any any anywhere anywhere tcp spt:www
6 0 0 ACCEPT tcp — any any anywhere anywhere tcp spt:https
7 26 1954 REJECT all — any any anywhere anywhere reject-with icmp-port-unreachable
Iptables конфиг:
*filter
-F INPUT
-F OUTPUT
-F FORWARD
# Allows all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT
-A OUTPUT ! -o lo -d 127.0.0.0/8 -j REJECT
# SSH
-A INPUT -p tcp --dport 22 -j ACCEPT
-A OUTPUT -p tcp --sport 22 -j ACCEPT
# OpenVPN
-A INPUT -p udp --dport 1194 -j ACCEPT
-A OUTPUT -p udp --sport 1194 -j ACCEPT
-A FORWARD -p udp --sport 1194 -j REJECT
# Nginx
-A INPUT -p tcp --dport 80 -j ACCEPT
-A OUTPUT -p tcp --sport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT
-A OUTPUT -p tcp --sport 443 -j ACCEPT
# log iptables denied calls (access via 'dmesg' command)
-A INPUT -m limit --limit 5/min -j LOG --log-prefix «iptables denied: » --log-level 7
-A FORWARD -m limit --limit 5/min -j LOG --log-prefix «iptables denied: » --log-level 7
-A INPUT -j REJECT
-A OUTPUT -j REJECT
-A FORWARD -j REJECT
-P INPUT DROP
-P OUTPUT DROP
-P FORWARD DROP
COMMIT
