Per-VPN-user network ACLs using Netfilter and OpenVPN.
There are effectively two packages to this repo. * python-openvpn-netfilter - a python library that does all of the filtering * openvpn-netfilter - a series of scripts and configurations to allow integration with openvpn.
openvpn integration: .. code:
learn-address /usr/lib/openvpn/plugins/netfilter_openvpn.sh
This shell wrapper makes a sudo call to one of the scripts, `netfilter_openvpn_sync.py`
While these scripts are fast, there are calls to IAM systems that may hang, and that would be felt by all VPN users.
To minimize that impact, the synchronous script blocks all connections from the client IP, forks a call to `netfilter_openvpn_async.py`, and returns control to openvpn.
The forked `netfilter_openvpn_async.py` then finishes the rule setup.
Change the settings in /etc/netfilter_openvpn.conf if needed. Make sure that the paths of the 'iptables' and 'ipset' are correct for your OS. Somewhat-conventional defaults are present without a config.
Obviously this filtering depends on having proper client routes for the network/IPs you allow, so consider the routes.
learn-address is an OpenVPN hook called when the remote client is allocated an IP address by the VPN server side. Given the user and now-allocated client IP, we load the netfilter (iptables/ipset) rules for that user and apply them to that client IP address.
If the script fails for any reason, OpenVPN will deny packets to come through.
When a user successfully connects to OpenVPN, netfilter.py will create a set for firewall rules for this user. The custom rules are added into a new chain named after the VPN IP of the user.
Chain 172.16.248.50 (3 references) pkts bytes target prot opt in out source destination 5925 854K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate ESTABLISHED /* ulfr at 172.16.248.50 */ 688 46972 ACCEPT all -- * * 172.16.248.50 0.0.0.0/0 match-set 172.16.248.50 dst /* ulfr groups: vpn_caribou;vpn_pokemon;vpn_ninjas; */ 24 2016 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 /* ulfr at 172.16.248.50 */ LOG flags 0 level 4 prefix `DROP 172.16.248.50' 24 2016 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 /* ulfr at 172.16.248.50 */
A jump target is added to INPUT, OUTPUT and FORWARD to send all traffic originating from the VPN IP to the custom chain:
Chain INPUT (policy ACCEPT 92762 packets, 15M bytes) 3320 264K 172.16.248.50 all -- * * 172.16.248.50 0.0.0.0/0 Chain OUTPUT (policy ACCEPT 136K packets, 138M bytes) 2196 549K 172.16.248.50 all -- * * 0.0.0.0/0 172.16.248.50 Chain FORWARD (policy ACCEPT 126K packets, 127M bytes) 1120 90205 172.16.248.50 all -- * * 172.16.248.50 0.0.0.0/0
You'll notice the comments are there for ease of troubleshooting, you can grep through "iptables -L -n" and find out which user or group has access to what easily.
To reduce the amount of rules created, when a user ACL only contains a list of destination subnets (no ports), these subnets are added into an IPSet. The IPSet is named after the VPN IP of the user.
--- IPSET HASH TABLE --- Name: 172.16.248.50 Type: hash:net Header: family inet hashsize 1024 maxelem 65536 Size in memory: 17968 References: 1 Members: 172.39.72.0/24 172.31.0.0/16 172.11.92.150 42.89.217.202
You can list the rules and sets of a particular user with the script named 'vpn-fw-find-user.sh'.
You can delete all of the rules and sets of a given VPN IP using the script named 'vpn-netfilter-cleanup-ip.py'.
The async script may be invoked by hand to refresh a user's rules while they are still connected / so they do not have to reconnect to the VPN
netfilter_openvpn_async.py update 172.16.248.50 ulfr