Nftables und openvpn: Unterschied zwischen den Versionen
Zur Navigation springen
Zur Suche springen
| Zeile 2: | Zeile 2: | ||
*WANDEV = enp0s3 | *WANDEV = enp0s3 | ||
*SERVERDEV = enp0s10 | *SERVERDEV = enp0s10 | ||
| − | *DMZDEV = | + | *DMZDEV = enp0s8 |
*VPNDEV = tun0 | *VPNDEV = tun0 | ||
*VPNPORT = 1194 | *VPNPORT = 1194 | ||
| − | *SERVER = | + | *SERVER = 10-2XX.1.0/24 |
| − | *DMZ = 10.88. | + | *DMZ = 10.88.2XX.0/24 |
| − | *VPN = 172.20. | + | *VPN = 172.20.2XX.0/24 |
{{#drawio:ipt-openvpn}} | {{#drawio:ipt-openvpn}} | ||
| + | |||
= Vorausgesetztes Connection Tracking = | = Vorausgesetztes Connection Tracking = | ||
; Verschlüsselter Verkehr – OpenVPN UDP (input Kette) | ; Verschlüsselter Verkehr – OpenVPN UDP (input Kette) | ||
Version vom 11. Mai 2026, 13:43 Uhr
Variablen
- WANDEV = enp0s3
- SERVERDEV = enp0s10
- DMZDEV = enp0s8
- VPNDEV = tun0
- VPNPORT = 1194
- SERVER = 10-2XX.1.0/24
- DMZ = 10.88.2XX.0/24
- VPN = 172.20.2XX.0/24
![Bearbeiten](javascript:editDrawio("430770021", "ipt-openvpn.drawio.png", "png", false, false, false, true, "https://embed.diagrams.net")){kind=link}
Vorausgesetztes Connection Tracking
- Verschlüsselter Verkehr – OpenVPN UDP (input Kette)
ct state new iif $WANDEV udp dport $VPNPORT accept
- VPN → SERVER
- Pakete aus dem Tunnel ins interne Netz (forward Kette)
ct state new iif $VPNDEV oif $SERVERDEV ip saddr $VPN ip daddr $SERVER accept
- VPN → DMZ
- Pakete aus dem Tunnel ins interne Netz (forward Kette)
ct state new iif $VPNDEV oif $DMZDEV ip saddr $VPN ip daddr $DMZ accept