We have a rule in “Incoming Firewall Access” that blocks UDP traffic from GREEN to RED:OpenVPN that used to work with previous IPFire versions. Reason for this was that the connection from inside the network which the VPN should connect to, wouldn’t be established anyway, and I wanted to prevent unnecessary log entries. This was fine.
Now, apparently something in the last core updates has changed as not only is this rule not blocking anymore, but also the VPN connection can be established successfully. Kind of useless to establish a connection from your network via VPN to the same network
While investigating, I found some strange things:
In the GUI, “Incoming Firewall Access” has 7 rules. The chain INPUTFW contains these 7 rules at the top, but those are followed by the rules from FORWARDFW!
However, there are only big blocks from FORWARDFW, but not every rule is duplicated!
For testing, I have created a forward rule UDP GREEN to : OpenVPN
While this rule appears in FORWARDFW, it is duplicated in OUTGOINGFW!
Seems buggy at first glance or is this a feature I don’t understand and working as expected?
I have noticed this too. Before, I used to have to connect to a different network to test that a user’s VPN config was working. Now it connects even from the native network. I’m not sure why but I think it has to do with a recent OpenVPN server update.
I will also generate later a CU202 FW diagram and post it there - alas, I do not have a spare machine to deploy CU203 and generate FW Diagram so that part should be on your side.
No. The one I posted in Firewall Diagram - Network - IPFire Community was generated in CU200 - please check that against your FW rules (in what chain were created). The diagram should help you see the path of the packet through all chains but you have to manually list the rules from the chain via iptables -L <CHAIN> command in that box to see if there is a rule that match that packet.
You might want to deploy the rule in a chain that WUI does not present you (yet) therefore the Firewall-local add-on - Add-Ons - IPFire Community might help you achieve that via WUI rather than manual edit of firewall.local file.
The dedicated OVPNINPUTRW chain (or upper OVPNBLOCK chain) is/are not exposed in WUI - so if you want to precisely control that traffic, you have to use firewall.local or the add-on I’ve created.
