Hi, On Sun, May 02, 2021 at 03:02:37PM +0100, lejeczek via Openvpn-users wrote: > Not being an expert I expected that, on a Linux box, I can > firewall 'tun0' of ovpn server. > Using 'firewalld' it put 'tun0' into a dedicated zone and > selected a few ports for access but it turns out that > clients see all ports as accessible. > > Is that default & expected behaviour? If yes then how to > change it, how to firewall OVPN's server tun ifaces? > many thanks, L.
I have no idea what firewalld is, but generally speaking, for the
OS kernel, "tun0" is "just a normal input/output interface". So you
can apply iptables, pf, ... rules on it.
Now, for "client A talks to client B", there's a catch - if you put
"client-to-client" into the openvpn server config, OpenVPN will forward
the packets directly, bypassing tun0 firewalls. Without client-to-client,
packets go to tun0, get firewalled, come back (or not).
gert
--
"If was one thing all people took for granted, was conviction that if you
feed honest figures into a computer, honest figures come out. Never doubted
it myself till I met a computer with a sense of humor."
Robert A. Heinlein, The Moon is a Harsh Mistress
Gert Doering - Munich, Germany g...@greenie.muc.de
signature.asc
Description: PGP signature
_______________________________________________ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-users
