Orbi IPTABLES and TUN interface

Question

uname -a :&nbsp;Linux RBR50 3.14.77 #1 SMP PREEMPT Fri Jan 8 20:10:05 CST 2021 armv7l GNU/Linux&nbsp;Aid needed.&nbsp;Background:I want to enable VPN server and only allow a handfull of ports to be allowed once connected to the tunnel interface.TUN Network: 192.168.2.0/24LAN Network: 192.168.1.0/24&nbsp;I have been playing around with IPTables on the Orbi console interface but not managed to actually affect the tunnel IP traffic. I'm lost to what chain I'm suppossed to put the statement in to block traffic. What I can see is that when enabling the VPN server a statement like below appears under the loc2net chain I try and add a statement above this it has no effect.&nbsp;5 ACCEPT all -- 192.168.2.0/24 anywhere* iptables -I loc2net 4 -s 192.168.2.0/24 -j DROP&nbsp;**and I've been trying statements in other places also but not wanting to break things I thought I'd stop and ask here instead :)&nbsp;I tried to look at the GUI if it had any ways of blocking but the secion where you seem to be able to do so doesn't allow 192.168.2.0 statements, but I enabled this for something else just to see what&nbsp; the IPtables behaviour was and noticed it created a new section called chain blk_svc . I also tried to add my drop statements there but to no avail.&nbsp;&nbsp;Also wondering if its possible somehow to trace or log on the ORBI the trace function doesn't seem to work and when I try below nothing shows up in the /var/log/messages, any ideas?~ iptables -A INPUT -s 192.168.2.2 -j LOG--log-level 4iptables -t raw -A OUTPUT -p icmp -j TRACE gives :&nbsp;iptables v1.4.21: Couldn't load target `TRACE':No such file or directory&nbsp;Cheers and thank you!&nbsp;

CrimpOn · Answer

Could you please describe the intended result in more general terms? Such as:

When a remote device joins my Orbi LAN through OpenVPN, I want this device to be able to (a) only do certain things, or (b) not be able to do certain things, (1) on the local LAN or (2) when it accesses the internet.

And, this restriction applies only to devices on the VPN and not "regular devices"?

andlid · Answer

Sure :&nbsp;&nbsp;When this device joins my network through VPN and get the IP 192.168.2.x I want it only to be able to access the following IP: 192.168.1.150 with tcp/udp port 25000&nbsp;Cheers&nbsp;

CrimpOn · Answer

andlid&nbsp;wrote:When this device joins my network through VPN and get the IP 192.168.2.x I want it only to be able to access the following IP: 192.168.1.150 with tcp/udp port 25000That would be any (every) device that joins the network through VPN.&nbsp; Seems to that this sorts of defeats the general purpose of having a VPN.&nbsp; I am guessing that the remote device can be 'anywhere' and thus have a different IP address every time it connects.&nbsp;Does 192.168.1.150 have no firewall or password capability?This sounds like what port forwarding is intended to accomplish. i.e. a connection attempt to port 25000 goes only to one IP on the LAN and that IP can decide to accept or decline the connection, and then can require whatever authentication it wants before granting access.&nbsp;Another consideration is that anything done to iptables will disappear if the Orbi reboots&nbsp;Frankly, I am impressed that you know so much about iptables. I made a couple of attempts to figure out how Orbi was implementing things and got SO confused that I gave up.

andlid · Answer

Hmm ok not what I wanted to see I guess :)&nbsp;Since the VPN feature doesnt allow for usernamne and password or further settings I'd like to be able to control the whole subnet say and only allow it access to a certain IP / port. This is since the ORBI has a flat network structure, otherwise I would be able to host the service on say a DMZ and only have the port exposed to that. But with the move in IOT and 20+ devices per household it would be good practise to at least try and restrict this somehow.&nbsp;CheersA.

CrimpOn · Answer

andlid&nbsp;wrote:Since the VPN feature doesnt allow for username and password or further settingsI sort of think that an 861 character key is about as secure as a username and password.&nbsp; And, the user can take whatever steps are required to secure the physical device that the key is stored on. (Balancing security and convenience.&nbsp; Who wants a 50 character password on a cell phone?)&nbsp;If the goal is to distribute the VPN configuration widely, that's probably not what Netgear had in mind.There was a post (months ago) where a company was using OpenVPN to allow employees to access their office network from home and one of the employees left the company. The only solution was to create a new OpenVPN configuration and send it to the remaining employees.&nbsp; They could have invested in a corporate VPN solution, so the inconvenience was a tradeoff of cost vs. ease of management.

Forum Discussion

Orbi IPTABLES and TUN interface

8 Replies