0

As stated in the title I would like to restrict VPN clients' access to specific websites.

More specifically, I push the route for 5 websites to the clients via the server config. However, I would like to block CLIENTS's access to one of these websites on an ad-hoc basis. In order to achieve this I understand that I have to edit the SERVER's iptables (directly or via ufw).

Unfortunately, I cannot manage to find the right way to do it! The most promising rule I found is

-A FORWARD -m state --state NEW,ESTABLISHED,RELATED -d X.X.X.X -j REJECT

But that does not work. Maybe I am not putting the rule in the appropriate segment of ufw's before rules.

All other efforts (editing hosts, adding different rules in ufw, etc.) result in the server not being able to access the website, but with the clients unaffected by the rule!

  • What kind of access do you have to what machine? – Tom K. Jan 30 at 9:10
  • Let me elaborate; I set up an OpenVPN server and routing the access of 5 websites via this network (i.e. if clients want to access one of these sites their traffic is directed via the VPN). The routing tables of the clients are being populated correctly. Now, if I want to block access to one of these 5 sites, what should I do? I thought that adding rules to the server's firewall (ufw/iptables) would do it, but no result. – skifast Jan 30 at 9:41
  • 1
    Why.. don't you... remove ... this one website from however you setup this routing? – Tom K. Jan 30 at 9:57
  • It normally does. If you have iptables on your openvpn server setup correctly you can use it. Common mistakes include: not having set the correct input device, output device or e.g. source IP. All traffic caused by openvpn is available to iptables (that's a very generalized statement but I have never seen otherwise). Maybe you got in trouble with NAT? – Ben Jan 30 at 9:58
  • @ Tom K.: If I do that I lose the opportunity of controlling user's access to it! – skifast Jan 30 at 10:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.