Aktuelle Version vom 29. Juli 2025, 12:17 Uhr

Variablen

ct state new iif $wandev udp dport $vpnport accept

ct state new iif $vpndev oif $serverdev ip saddr $vpn ip daddr $server accept

ct state new iif $vpndev oif $dmzdev ip saddr $vpn ip daddr $dmz accept

@@ Zeile 1: / Zeile 1: @@
 = Variablen =
-*wandev = eth0
+*wandev = enp0s3
-*landev = ens19
+*serverdev = enp0s10
+*dmzdev = enp0s9
 *vpndev = tun0
 *vpnport = 1194
-*lan= 10.82.228.0/24
+*server = 172.16.2xx.0/24
-*vpn = 172.31.2.0/24
+*dmz = 10.88.2xx.0/24
+*vpn = 172.20.2xx.0/24
 {{#drawio:ipt-openvpn}}
@@ Zeile 11: / Zeile 13: @@
 = Vorausgesetztes Connection Tracking =
-; Verschlüsselter Verkehr – OpenVPN UDP
+; Verschlüsselter Verkehr – OpenVPN UDP (input Kette)
-*nft add rule inet filter ct state new iif $wandev udp dport $vpnport accept
+ ct state new iif $wandev udp dport $vpnport accept
-; VPN → LAN: Pakete aus dem Tunnel ins interne Netz
+; VPN → SERVER: Pakete aus dem Tunnel ins interne Netz (forward Kette)
-*nft add rule inet filter ct state new iif $vpndev oif $landev ip saddr $vpn ip daddr $lan ct state new accept
+ ct state new iif $vpndev oif $serverdev ip saddr $vpn ip daddr $server accept
+; VPN → DMZ: Pakete aus dem Tunnel ins interne Netz (forward Kette)
+ ct state new iif $vpndev oif $dmzdev ip saddr $vpn ip daddr $dmz accept