0

currently I'm using iptables as a kill-switch for my VPN connection. Therefore I only have one rule : -A OUTPUT -o eth0 -m owner --uid-owner 1000 -j DROP everything else is accepted.

Now the problem is I actually want to access other computers in my internal network which runs on the eth0 interface but I still want to have a VPN kill-switch kind of thing...

I already tried a few things but as I'm no networking professional I'm pretty much stuck here.

Appreciate every kinda help. Cheers!

  • This is not really a security question. It has more to do with super user SE – Limit Jan 5 '17 at 22:22
1

I had the same problem and a couple of similar ones so here's my complete iptables OUTPUT chain which is all I use and should solve your problem and then some.

-A OUTPUT -d 192.168.1.0/24 -j ACCEPT
-A OUTPUT -o lo -m owner --uid-owner 110 -j ACCEPT
-A OUTPUT ! -o tun+ -m owner --uid-owner 110 -j DROP

Here's what all it's doing:

-A OUTPUT -d 192.168.1.0/24 -j ACCEPT

This command allows all traffic on your local network. The -d parameter causes the rule to apply to all traffic going to the destination ip. Change 192.168.1 to the first three parts of your local network ip address. For example if your local network ip ranges is from 15.15.15.0 to 15.15.15.255 change that line to

-A OUTPUT -d 15.15.15.0/24 -j ACCEPT

The .0/24 at the end will include all ip addresses on that network.

-A OUTPUT -o lo -m owner --uid-owner 110 -j ACCEPT

This allows local programs on your computer to talk to each other. This was causing problems for me so I thought I would include it. Specifically one of my programs needed this to work with the vpn client.

-A OUTPUT ! -o tun+ -m owner --uid-owner 110 -j DROP

These two commands drop any outgoing packets that don't go out a tun connection. In yours you use eth0 instead of tun+. Have you tested whether that actually works as a kill switch? I don't think it should because when your vpn connection goes down eth0 should remain.

In order for this to work the order matters. If the accept commands aren't first they will get blocked by the drop commands.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.