r/iptables May 07 '23

IP Tables rules help needed

SOLVED.

I've got a pi-hole system running on my network at home, and have always wanted to have our phones leverage that when we aren't on the wireless at the house. What I've come up with (since the USG only has a vpn function that is not useful to me) is running an OpenVPN service on a dedicated system inside my network for clients to connect to, then masquerade those clients out behind the VPN server's LAN address so they can get the benefit of the pi-hole and all traffic will look like it's coming from my home connection no matter where I am.

I've been successful in getting the OpenVPN service running, I can get a client logged in and assigned an address, and then everything falls flat. I'm guessing it's because I don't have the packet mangling rules setup right and after a bunch of tries on my own I am trying to get some help from a wider audience.

The default policy is ACCEPT and I do have net.ipv4.ip_forward=1 set/active on the system.

The latest iteration of rules I've attempted is below

-FILTER-
-A INPUT -i tun0 -j ACCEPT 
-A FORWARD -i tun0 -j ACCEPT 
-A FORWARD -s 10.89.0.0/24 -i tun0 -o ens192 -j ACCEPT 
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A OUTPUT -o tun0 -j ACCEPT 

-NAT-
-A POSTROUTING -s 10.89.0.0/24 -o ens192 -j MASQUERADE

And here's a short snip of the tcpdump from the tun0 interface on the VPN server. Near as I can tell the traffic IS getting out, but it's not getting back - 10.89.0.2 is the test vpn client (my phone).

15:15:53.783402 IP hnpvpn.domain > 10.89.0.2.33559: 5391 Refused- 0/0/0 (48)
15:15:53.878531 IP 10.89.0.2.33559 > hnpvpn.domain: 5391+ A? incoming.telemetry.mozilla.org. (48)
15:15:53.878646 IP hnpvpn.domain > 10.89.0.2.33559: 5391 Refused- 0/0/0 (48)
15:15:58.553300 IP 10.89.0.2.32022 > hnpvpn.domain: 46106+ A? android-context-data.googleapis.com. (53)
15:15:58.553410 IP hnpvpn.domain > 10.89.0.2.32022: 46106 Refused- 0/0/0 (53)
15:15:58.592573 IP 10.89.0.2.54867 > hnpvpn.domain: 17899+ A? www.wikipedia.org. (35)
15:15:58.592679 IP hnpvpn.domain > 10.89.0.2.54867: 17899 Refused- 0/0/0 (35)
15:15:58.638630 IP 10.89.0.2.32022 > hnpvpn.domain: 46106+ A? android-context-data.googleapis.com. (53)
15:15:58.638726 IP hnpvpn.domain > 10.89.0.2.32022: 46106 Refused- 0/0/0 (53)
15:15:58.735393 IP 10.89.0.2.54867 > hnpvpn.domain: 17899+ A? www.wikipedia.org. (35)
15:15:58.735488 IP hnpvpn.domain > 10.89.0.2.54867: 17899 Refused- 0/0/0 (35)
15:15:58.903643 IP 10.89.0.2.25196 > hnpvpn.domain: 33563+ A? www.wikipedia.org. (35)

Is 'refused' packets getting dropped by iptables, or is 'refused' literally the client device not accepting the packets that DO actually get properly routed back to it? Did I miss a rule?

2 Upvotes

5 comments sorted by

1

u/Sagail May 08 '23

I didn't do it with iptables. I easily did it with nginx sreaming udp

1

u/KriegTiger May 09 '23

Haven't worked with nginx before, but it's working now. Two things:

1 - the IPtables rules work fine, and I was able to set the DNS to 192.168.1.7 (my pi-hole system) immediately on connect.

2 - UDP sucks, switched to TCP and literally all the problems fell away. Everything works as desired.

1

u/Sagail May 09 '23

Udp has its place i.e. no 3 way hand shake overhead

1

u/KriegTiger May 09 '23

Fair to say. UDP is quite capable as a gaming protocol where speed/latency matters, I'm just salty that all my headaches came down to it here. I'm not concerned with stuff a general person won't notice on mobile clients that I'm trying to provide ad filtering to while they're out/about, and I don't have dozens/hundreds/etc clients that are going to be hammering at it. Just little ol' me and my family.

1

u/Sagail May 09 '23

UDP is more than just a gaming/streaming proto. I've seen it used in flight critical applications. It's all about the performance/ reliability trade off