Servidor OpenVPN para acesso a uma porta de um IP da rede interna [RESOLVIDO]

fabiano duarte
(usa Debian)

Enviado em 22/02/2019 - 00:42h

tenho um servidor OpenVPN e preciso que ele libera as conexões externas apenas para a porta 80 de um IP interno, segue meu iptables:

*filter

#Loopback Rules
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -s 127.0.0.0/8 -j REJECT
-A OUTPUT -o lo -j ACCEPT

#Allowing Ping
-A INPUT -p icmp -m state --state NEW --icmp-type 8 -j DROP
-A INPUT -p icmp -m state --state ESTABLISHED,RELATED -j DROP
-A OUTPUT -p icmp -j DROP

#SSH Setup
-A INPUT -i eth0 -p tcp -m state --state NEW,ESTABLISHED --dport 5530 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m state --state ESTABLISHED --sport 5530 -j ACCEPT

#Allow OpenVPN Through
-A INPUT -i eth0 -p udp -m state --state NEW,ESTABLISHED --dport 1194 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m state --state ESTABLISHED --sport 1194 -j ACCEPT

#DNS
-A INPUT -i eth0 -p udp -m state --state ESTABLISHED --sport 53 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m state --state NEW,ESTABLISHED --dport 53 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state ESTABLISHED --sport 53 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m state --state NEW,ESTABLISHED --dport 53 -j ACCEPT

#HTTP/S For Updates
-A INPUT -i eth0 -p tcp -m state --state ESTABLISHED --sport 80 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state ESTABLISHED --sport 443 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m state --state NEW,ESTABLISHED --dport 80 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m state --state NEW,ESTABLISHED --dport 443 -j ACCEPT

#NTP To Sync Your Clock
-A INPUT -i eth0 -p udp -m state --state ESTABLISHED --sport 123 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m state --state NEW,ESTABLISHED --dport 123 -j ACCEPT

#TUN To Tunnel Through The VPN
-A INPUT -i tun0 -j ACCEPT
-A FORWARD -i tun0 -j ACCEPT
-A OUTPUT -o tun0 -j ACCEPT

#Forvard tun to ens
-A FORWARD -i tun0 -o eth0 -s 12.0.0.0/27 -j ACCEPT
-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

#Log Blocked Traffic
-A INPUT -m limit --limit 3/min -j LOG --log-prefix "iptables_INPUT_denied: " --log-level 4
-A FORWARD -m limit --limit 3/min -j LOG --log-prefix "iptables_FORWARD_denied: " --log-level 4
-A OUTPUT -m limit --limit 3/min -j LOG --log-prefix "iptables_OUTPUT_denied: " --log-level 4

#Reject All Other Traffic
-A INPUT -j REJECT
-A FORWARD -j REJECT
-A OUTPUT -j REJECT

COMMIT



Assim os clientes da VPN estão conseguindo pingar e acessar todas as maquinas da rede interna, preciso de uma regra que os clientes tenham acesso apenas a porta 80 de um ip, podem me ajudar?