OPENVPN NAT CONNECT A DB PORT

[rafaelvilelacosta94]

need help.

I have the following scenario.

I have a vm 192.168.42.55, and it runs a db service on port 61433.

We decided for security to state the following in the NAT rule for a service provider.

WAN interface > TCP protocol > Origin: Provider address > Source ports: * > Dest: WAN address > Dest Port: 1433 > nat ip: 192.168.42.55 > accept.

All ok, working.

But now is where I need help. A company is going to access this db from different places with their notebook, so for security we authenticate it in LDAP and give it a VPN access.

As the first rule I made states that it only accepts the connection to the db from one source, I need to somehow declare that I also accepted the connection from this guy who will be connected through the VPN.

Is there any way I can do this? I don't know what I can do, because locally it won't get access either because the rule declared above determined an origin and the rest won't accept it.

[rafaelvilelacosta94]

I have a user authenticated by OPEN VPN on an OPENVPNserver with a specific tunnel for this guy.

it only needs to be on the local network after connecting accessing a specific server on a specific port which is the database.

How do I make the rule in PFSENSE to prevent this guy who is in this VPN tunnel from this server from being able to ping or give a // to the other local servers.

I wanted to block everything from that source and accept only the connection on the port of the db in a server specific.

is it possible to do that ???

[dotdash]

@rafaelvilelacosta94
If you have other OpenVPN users, you'll need to set a Client Specific Override for the user that you want to restrict. Then use firewall/rules/openvpn to restrict the user- make a pass rule set source for his ip, destination for the server/ports, then follow it with a block all from his ip, then your normal rules.

[rafaelvilelacosta94]

@dotdash so man i dont know what to declare. I can't understand what the origin of openvpn is.

I understand that I should declare that the origin would be the tunnel's network range on the openvpn interface.

What I need is that the guys connected to openvpnserver from ip 40.40.20.0/24 can't see anything from the lan, block everything, and make one after releasing it only for the specific server on a specific port.

Look, I did that and even so, it manages to drip, do everything.

[dotdash]

@rafaelvilelacosta94
You're using Eli Lilly's public block for your openvpn network?
If it's private use 10.40.20.x or something.
Does LAN address=192.168.42.1? Is that the only rule there?
Source should match the openvpn tunnel network specified on your openvpn server config. Start with an allow to the target server, then follow with a rule to block all destination LAN net.

[rafaelvilelacosta94]

@dotdash

40.40.20.0/24 it's a tunnel network set in openvpn server

192.168.42.0/24 is my lan network in interface lan.

but I can't make a generic rule, because I have another open vpn server created that the employees use, and it is the tunnel 50.50.10.0/24

I need the rule to understand that the origin of this guy from the tunnel network openvpn server 40.40.20.0/24 is the only one affected.

but that's the problem, I don't know what to put at the origin of the rule.

[dotdash]

@rafaelvilelacosta94
Again, 40.x and 50.x are not private ranges. Moving on from that, you would do something like this for your openvpn rules-
action/proto/src/srcport/dest/destport
pass * 40.40.20.0/24 * 192.168.42.xy z
block * 40.40.20.0/24 * * *
pass * 50.50.10.0/24 * LAN subnet *
etc...
with xy being the ip of the server and z being the port(s) they need to access.