I'm still fairly new to networking, and I'm having a little trouble grasping some concepts of the proper firewall rules I need to implement for my desired setup. I'm setting up a router with OpenWRT and OpenVPN to route incoming traffic through my VPN provider (proxy.sh). I've largely got things setup adapting from these two guides:
One thing I'm having trouble understanding is OpenWRT's LuCI firewall rules. The basic idea is all traffic coming in from the LAN port is forwarded to the VPN interface and packets are masqueraded behind the VPN interface. If the VPN disconnects, then traffic is dropped and no ip is leaked. Where these guides differ is in one, the WAN (which connects to the web) port is set to its normal settings with input rejected, and masquerading on (see below image)
While the other guide instead turns off masquerading on the WAN port, and allows input (see below image).
Both configurations work for me, (and pass all the tests on ipleak.net) but I'd like to better understand what's going on and make sure I'm secure. So can someone please explain/help me understand...
- If and why one approach is better or more secure than the other?
- These rules/how the packet routing actually works? I don't think I quite understand what is going on. For example, I don't understand why if masquerading is turned off on the WAN interface, input needs to be allowed on the WAN interface (I checked this config and ineed it doesn't work unless WAN input is allowed). The explanation the author gives is too brief and doesn't make sense to me. My understanding (which is probably wrong) of input not being allowed is that the interface only accepts packets returning from an outgoing request and not packets from a new connection (again new to networking here). So if a packet is sent out over the VPN interface (with WAN masquerading turned off), why is its return packet rejected by the WAN interface if WAN input is disallowed? Wouldn't it be a response just like any other?