Nftables und openvpn: Unterschied zwischen den Versionen
Zur Navigation springen
Zur Suche springen
| Zeile 3: | Zeile 3: | ||
*SERVERDEV = enp0s10 | *SERVERDEV = enp0s10 | ||
*DMZDEV = enp0s8 | *DMZDEV = enp0s8 | ||
| + | *SERVER = 10.2XX.1.0/24 | ||
| + | |||
| + | *DMZ = 10.88.2XX.0/24 | ||
*VPNDEV = tun0 | *VPNDEV = tun0 | ||
*VPNPORT = 1194 | *VPNPORT = 1194 | ||
| − | |||
| − | |||
*VPN = 172.20.2XX.0/24 | *VPN = 172.20.2XX.0/24 | ||
{{#drawio:ipt-openvpn}} | {{#drawio:ipt-openvpn}} | ||
Aktuelle Version vom 11. Mai 2026, 13:44 Uhr
Variablen
- WANDEV = enp0s3
- SERVERDEV = enp0s10
- DMZDEV = enp0s8
- SERVER = 10.2XX.1.0/24
- DMZ = 10.88.2XX.0/24
- VPNDEV = tun0
- VPNPORT = 1194
- VPN = 172.20.2XX.0/24
![Bearbeiten](javascript:editDrawio("1879688275", "ipt-openvpn.drawio.png", "png", false, false, false, true, "https://embed.diagrams.net")){kind=link}
Vorausgesetztes Connection Tracking
- Verschlüsselter Verkehr – OpenVPN UDP (input Kette)
ct state new iif $WANDEV udp dport $VPNPORT accept
- VPN → SERVER
- Pakete aus dem Tunnel ins interne Netz (forward Kette)
ct state new iif $VPNDEV oif $SERVERDEV ip saddr $VPN ip daddr $SERVER accept
- VPN → DMZ
- Pakete aus dem Tunnel ins interne Netz (forward Kette)
ct state new iif $VPNDEV oif $DMZDEV ip saddr $VPN ip daddr $DMZ accept