0

Is this possible? If not through ufw then some other software or iptables? How should I set up the ip tables?

Assuming my public ip is known (and I don't want to change it), would it provide complete security against hacking if I don't perform any wrong actions such as downloading infected files?

If not complete security then would it provide additional security? Like making nmap scans impossible?

2

Inbound Traffic

It seems like the threat you are concerned about is "hacking", which I will interpret in this case as "exploitation of locally running network services by malicious actors".

If this is your threat model, and we disregard out other privacy/security implications and potential benefits of using a VPN, I suspect the VPN has little to offer in this case.

First off, if your public address is known to an adversary, and you do not have any public-facing network services or they are firewalled off, the above threat model is effectively mitigated. Full stop. Any unwarranted traffic inbound to your device should be silently dropped with no effect to you*. If you are behind a network firewall (possibly providing NAT), you have even less to worry about, since stray traffic will not reach your device unless you have specifically enabled port forwarding (or UPnP is enabled)**.

So, a VPN doesn't help much with inbound traffic if you already have a firewall that denies by default. Unless you have specifically requested/configured it, a commercial VPN service is not going to allow public traffic to be sent to your device. That said, if the VPN provider is compromised, malicious actors could use the VPN as a channel to reach your device even while on your private network. But again, with a firewall, such inbound attacks are likely null and void.

Outbound Traffic

In the case I am interpreting your question incorrectly, and you mean traffic to the VPN instead of from the VPN, there could be an advantage to only allowing outbound traffic across a VPN. A likely scenario is that you are using untrusted public WiFi, perhaps in an airport. While the modern internet over HTTPS is fairly secure against MitM attacks, there are still privacy ramifications of using a public network. Modern devices are also very noisy, and could unintentionally reveal information about you or your devices that could result in privacy issues or compromise. For example, look into the tool Responder, which targets Windows devices on the same network by responding to queries they automatically make, sometimes without prompt from the user. To prevent your computer from leaking more information to the network than necessary, you can indeed lock down all outbound traffic to a VPN adapter. Example below with iptables (although any firewall should suffice):

# Name of VPN network adapter
VPN_IF=tun0

VPN_SERVER=1.2.3.4
VPN_PORT=1194

# Allow inbound connections related to things you initiate on any interface
iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
# Allow loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# Allow all out to VPN
iptables -A OUTPUT -o $VPN_IF -j ACCEPT
# Assuming UDP
iptables -A OUTPUT -p udp --dport $VPN_PORT -d $VPN_SERVER -j ACCEPT
# Allow DHCP
iptables -A OUTPUT -p udp --dport 67 -j ACCEPT
iptables -A INPUT -p udp --dport 68 -j ACCEPT
# Default drop the rest
iptables -A INPUT -j DROP
iptables -A OUTPUT -j DROP

That should do it. Note you may need to make changes specific to your scenario. If your VPN configuration uses a hostname for the VPN server instead of an IP address, you will need to allow DNS outbound too. You also may need to allow multiple IP addresses if the server resolves to more than one address.

* Ignoring the possibility of a bug in the kernel firewall code.

** A vulnerability in your edge router/firewall would remove any of this possible protection.

  • You said "First off, if your public address is known to an adversary, and you do not have any public-facing network services or they are firewalled off, the above threat model is effectively mitigated." What do you mean by public-facing services? Is the browser such as firefox, a public facing service? – Linux_user0987 Jul 3 at 23:17
  • So if a browser or an application like skype is a public facing service and when using them they would have to be allowed through the firewall, does using a vpn provide additional security as my computer would be not connected directly to the internet? – Linux_user0987 Jul 7 at 4:06
  • Question 2: You also said that a vpn does not help much with incoming connections if I have a firewall. But just to get a better overall understanding, if I don't use a firewall, then how good security will using a trusted vpn provide (that is configured for all connections) against intrusions? Assuming I don't make any wrong connections through the vpn. – Linux_user0987 Jul 7 at 4:07
  • 1. No, a public-facing service could be a web server, SSH server, file share, RDP server, or anything else that accepts incoming connections. A web browser is generally not going to have incoming connections but initiates many outbound connections. The only protection a VPN would offer is that you would be protected from local network attacks if any of your applications did not use proper encryption. 2. It depends what traffic the VPN provider allows to be forwarded to your device. If an attacker compromises the VPN network, or it is not secured properly, you could be left completely exposed. – multithr3at3d Jul 7 at 21:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.