2

Here are the rules of my firewall :

deny outgoing
deny incoming
allow out from any to any on tun0 (alow just the traffic from the VPN)

However, I am forced to disable ufw when I want to start my vpn connection from gnome-network manager. Yet, I tried something like :

allow out from any to any on wlan0 port 1194

But it does not work.

Any suggestions ?

SOLUTION :

Those following lines enable you to block all the outgoing NON-VPN traffic. In other words, only the VPN traffic is allowed. Besides, in case your VPN connection failed, you will be able to reconnect without disabling your firewall.

1 - Run the following command in a terminal :

sudo tail -f /var/log/ufw.log

2 - Try to connect to your VPN

3 - Look at all the "[UFW BLOCK]"'s lines with an Ip adress In my case, I have two adress ip with DST=...240 and DST="...241.

Then I have the Ip given by my VPN which is also blocked.

3 - Allow those ip in your firewall :

To                         Action      From
--                         ------      ----
***.**.**.240              ALLOW OUT   Anywhere
***.**.**.241              ALLOW OUT   Anywhere
**.***.0.0/18  (VPN)            ALLOW OUT   Anywhere
Anywhere                   ALLOW OUT   Anywhere on tun0
22/tcp                     ALLOW OUT   Anywhere
Anywhere (v6)              ALLOW OUT   Anywhere (v6) on tun0
22/tcp (v6)                ALLOW OUT   Anywhere (v6)
3

Based on port 1194 I guess you use OpenVPN. OpenVpn documentation in the FAQ recommended fallowing

Which ports do I need to open in my firewall for Access Server?

Short answer: TCP 443, TCP 943, UDP 1194 Long answer: By default OpenVPN Access Server has 2 OpenVPN daemons running. One of them on UDP port 1194 and another on TCP 443. We recommend that you use the UDP port because this functions better for an OpenVPN tunnel. However, many public locations block all sorts of ports except very common ones like http, https, ftp, pop3, and so on. Therefore we also have TCP 443 as an option. TCP port 443 is the default port for https:// (SSL) traffic and so this is usually allowed through at the user's location. TCP port 943 is the port where the web server interface is listening by default. You can either approach this directly using a URL like https://yourserverhostnamehere:943/ or by approaching it through the standard https:// port TCP 443, since the OpenVPN daemon will automatically internally route browser traffic to TCP 943 by default. (https://yourserverhostnamehere/).

But my recommendation, from battle field, is to allow all traffic from vpn server ip address

sudo ufw allow from ip_address_of_vpn_server

Do not specify proto because OpenVPN use both, tcp and udp

Edit 1

Also you can create script to auto reconnect when tun0 is down.

Add a simple script to caled tun-upin /etc/network/if-down.d/ which content is

#!/bin/sh
# filename: tun-up

if [ "$IFACE" = tun0 ]; then
  sudo ifup tun0
fi

make it executable

sudo chmod +x /etc/network/if-up.d/tun-up

Edit 2

Ok, we allow wrong address. First we need to catch correct ip address to allow traffic.

Start terminal and run command

tail -f /var/log/system | grep UFW

then try to connect to vpn sever. In terminal you will see block off

May 25 08:18:22 xxx kernel: [259789.025019] [UFW BLOCK] IN=eth0 OUT= MAC=01:00:5e:00:00:01:00:23:cd:f4:8c:29:08:00 SRC=XXX.XXX.XXX.XXX 

In block find SRC=XXX.XXX.XXX.XXX, this is address who send traffic to you, in most cases this will be public ip address of vpn server.

This ip address must add in ufw rules on first please, because you talk and exchange traffic with this address before is tun0 up.

Rule is

sudo ufw insert 1 allow from XXX.XXX.XXX.XXX
12
  • Thanks but how to set set a range of ip ? My VPN provides a random ip between 00.000.32.0 and 00.000.63.255. May 24 '15 at 18:14
  • sudo ufw allow from xx.xxx.32.0/18 This rule is for net range you are specified,
    – 2707974
    May 24 '15 at 18:55
  • You have my edit 1 in answer to make auto reconnect of tun0
    – 2707974
    May 24 '15 at 19:08
  • Thanks again 2707974. However, it is not working. Can you take a look at my Edit 1 please ? May 24 '15 at 19:47
  • The VPN connection failed (I must still shutdown the firewall) May 24 '15 at 20:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.