Group of devices and VPN

Security Firewall Rules
1

Hi

I was playing with the rules… and groups.

What I understood: if I create a group and I add MAC of my devices, I can choose the group in the source field of the rule, and all devices in that rule will access to that rule and follow the behavior… correct?

Now… the real example:

  1. created a VPN in my router Fritxbox, NOT in ipfire. By the way: ipfire is linked to one LAN-port of Fritz.
  2. installed the same VPN access in both android and iphone mobile
  3. created a group in ipfire, assigning only android mac address. Iphone is out.
  4. IN the rule:
    a. selected the group in the source field.
    b. set the NAT → RED
    c. set the IP and the port in the Raspberry for destination
  5. I activate VPN in both mobiles.
  6. Both mobiles are working fine, reaching the destination server, despite the restriction imposed in the group.

My expectation: only android working. Iphone NOT.
Which and where is my mistake?

thanks
vincenzo

2

The ovpnblock in the iptables is run before the inputfw so your additional rules never get seen by the OpenVPN connection.

See the IPFire FW chains diagram at the bottom of this link.

https://wiki.ipfire.org/configuration/firewall/iptables

You will need to add your additional rules into the firewall.local file - see the following link from the Firewall Documentation section of the wiki.

https://wiki.ipfire.org/configuration/firewall/firewall-local

1 Like
3

Hi Adolf

I’m not so confident with iptables rule… but I try… looking also to the man page of iptables:
In the start section of firewall.local i put, something like:

iptables -A CUSTOMPREROUTING -d 192.168.x.x/32 -p tcp -m tcp --dport x -m mac --mac-source xx -m limit --limit 10/sec --limit-burst 20 -j LOG --log-prefix "CUSTOMPREROUTING "

iptables -A CUSTOMPREROUTING -d x.x/32 -p tcp -m tcp --dport x-m mac --mac-source x -j ACCEPT

  1. correct?
  2. have I to write this 2 rules for every mac I have? or can I enter the name of the ipfire group… somewhere?
  3. have I to enter also something in stop and reload section?
    thx
    vincenzo
4

I am not very familiar with iptable rules, certainly not enough to be able to comment on your proposals.

Need to wait and get some additional input from people more familiar with the details of writing iptables rules directly.

5

ok i will wait for someone more familiar on writing iptables rules.
Thanks Adolf