Score:0

Server

Limiting routing only from specific ip

fig314

3/9/24, 10:53 AM

Currently I run an openvpn server that pushes a route on per client basis (different clients receive different routes and static ips).

ccd/client1
push "route 172.16.236.0 255.255.255.0"
ifconfig-push 10.8.0.29 255.0.0.0

And then I route the traffic from vpn tun interface to client-specific docker network interface (multiple).

sudo iptables -A FORWARD -i tun0 -o br-6b1cd32adc27 -j ACCEPT
sudo iptables -A FORWARD -i br-6b1cd32adc27 -o tun0 -m state --state ESTABLISHED,RELATED -j ACCEPT
sudo iptables -t nat -A POSTROUTING -o br-6b1cd32adc27 -j MASQUERADE

However it is possible for one client to access the interface purposed for the other client if he just adds the route via ip.

ip route add 172.16.236.0/24 via 255.0.0.0

I would like to limit this behavior and somehow filter accessing certain interface only to specific client ip address.

How can I make this possible?

2 + 1

networking

iptables

openvpn

docker

vidarlo

3/9/24, 11:41 AM

In general, that's what firewalls is for.

Score:0

Server

Se7e

3/9/24, 12:35 PM

To limit access to specific Docker network interfaces only to certain client IP addresses, you can use iptables rules to filter the traffic based on the source IP address of the client. Here's an example of how you could set up the rules:

Create a new Docker network for each client that you want to restrict access for:

docker network create --subnet=172.16.236.0/24 client1_network
docker network create --subnet=172.16.237.0/24 client2_network

Set up iptables rules to restrict traffic between the VPN tunnel interface and the Docker network interfaces based on the client IP addresses:

iptables -A FORWARD -i tun0 -o br-client1_network -s 10.8.0.29 -d 172.16.236.0/24 -j ACCEPT
iptables -A FORWARD -i br-client1_network -o tun0 -s 172.16.236.0/24 -d 10.8.0.29 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -o br-client1_network -s 172.16.236.0/24 -j MASQUERADE

iptables -A FORWARD -i tun0 -o br-client2_network -s 10.8.0.30 -d 172.16.237.0/24 -j ACCEPT
iptables -A FORWARD -i br-client2_network -o tun0 -s 172.16.237.0/24 -d 10.8.0.30 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -o br-client2_network -s 172.16.237.0/24 -j MASQUERADE

In this example, the first set of rules allows traffic between the VPN tunnel interface (tun0) and the Docker network interface for client1 (br-client1_network) only if the source IP address is 10.8.0.29 and the destination IP address is 172.16.236.0/24. The second set of rules does the same for client2.

By setting up these rules, you can restrict access to specific Docker network interfaces based on the source IP address of the client. Any traffic from other client IP addresses attempting to access the restricted Docker network interfaces will be blocked by the iptables rules.

I hope this solution solves your problem!

+ 1

fig314

3/9/24, 4:10 PM

Thanks. Destination and source are what I was looking for.

Score:0

Server

Nikita Kipriyanov

3/9/24, 12:05 PM

The only option is the firewall. It is a good practice to have one if you spawn a VPN service anyway.

In theory the firewall could be built into the OpenVPN by the means of plugins, but it is so awfully documented so nobody actually uses that. Usually per-client firewall is managed on the firewall host with client-connect/client-disconnect scripts, or statically, if you can know client encapsulated addresses in advance (I believe it's your case, since you mentioned "static IPs").

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Limiting routing only from specific ip

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.