Part of the situation that I’m running on my MIAB machine is that part of the time I use it as a traffic concentrator when I’m traveling. Aka OpenVPN I want my data to cross back into a country I trust a bit more when I’m abroad. The reason I’m even running MIAB is that theres tonnes of time when this machine isn’t really being used where I might as well be using it for something else. Turns out MIAB is a super great solution. Especially since I don’t really care for the situation where I have to trust cloud providers too much. ( I realise trusting a VPS provider is also technically in the same boat ).
The problem
Thing is, I use this OpenVPN for way more then just web browsing and a lot of things like browser extensions that rely on things like Sync functions die because I don’t want to sit here and argue with firewall rules. Would it be possible to set priorities in UFW or something where the ports that Fail2Ban will be able to apply special limitations etc… but basically allow all other traffic? I know that it was recommended to me in another thread to just run ufw default allow outgoing. Which solves part of the problem but not the whole problem.
The thing is, I’ve got a firewall installed inside of my machines so that I know what traffic is going through my network cards locally. So I could effectively just write down all of the individual ports on a piece of paper and do UFW allow for every service ever but this is going to require about 700 UFW rules.
I don’t want to do that at the very least not manually.
The simplest solution that I can think of
The easiest solution that I can imagine is to just do something like ufw default allow incoming then just hope that MIAB will just restrict access when needed.
That’s what I’m looking for yeah basically. The problem basically in abstract is the fact that the various ports that everything needs gets exhausting.
Leave ufw alone on the MIAB server, do the following:
Use the following to install openVPN: https://github.com/Nyr/openvpn-install (Take not of ports, usernames, and passwords as they ARE SEPARATE FROM MIAB. (Once OpenVPN is installed, forget about MIAB for a minute.)(Configure the server to be a “Gateway”)
Run ufw allow 1194 (Or whatever port you decided to use during OpenVPN installation)
Add users as needed using the script above.
Once the port is open on MIAB open it on your modem as well pointing to MIAB server. (If you are on a VPS ignore this step)
Test account login using openvpn for your phone, another computer, etc from OUTSIDE the network the MIAB server is on.
You should be able to login. Once logged in, and connected, openvpn will route all traffic while on the VPN through the MIAB server. Since ufw defaults to allow ALL OUTBOUND CONNECTIONS NOTHING ELSE IS NEEDED. There is no reason to complicate all this just to route your traffic.
Confirm the routing works by visiting icanhazip.com in your browser. It should have the same IP address as your MIAB server. (Externally anyway)
So the issue isn’t getting OpenVPN to reroute the traffic. That’s working perfectly and so long as ufw is disabled all of my programs work on my local machine. The problem exists in the fact that I have a lot of programs locally that fail to work like for example DiscordApp begins to spin its wheels and timing out when ufw is enabled on the VPN/MIAB.
Sorry by “spins its wheels” I’m implying like the loading circle thing on a web browser when a page is loading. But in this case its in regards to Discord itself among other things. It seems that opening outgoing allow on the UFW firewall doesn’t necessarily allow all communications.
So imagine an application like Skype ( I have no idea what ports it requires I think it requires a range ) is trying to connect to its servers. It may use port 443 (https) but it ends up also needing ports 64000 through 65000 both inbound and outbound. I know that UFW can do port ranges but I think that the easiest solution would be to just allow incoming and outgoing and then let fail2ban block connections as it is behaving like a blacklist.
At this point I cannot recommend you do that. It’s a huge security risk. I’d do some research on the applications you plan on using and open ports to the VPN network as needed.
Run a network analyzer locally and go through your daily workflow. When something breaks take note of the ports & modify ufw. It shouldn’t take that long until you’ve accounted for everything.
Already running LittleSnitch on my local machines I think UFW would need to handle about 300 rules at least. If there was some kind of way to automate this I’d be over the moon.
