Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    1.2.3 файрволл для openvpn без Disable all auto-added VPN rules

    Russian
    3
    5
    2.2k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      alexandrnew
      last edited by

      в 1.2.3 файрволл для openvpn возможен без Disable all auto-added VPN rules?
      и что дает\убирает Disable all auto-added VPN rules ?

      1 Reply Last reply Reply Quote 0
      • V
        volag
        last edited by

        Автоматическое добавление разрешающих правил для vpn-соединений, т.е. каждый установивший туннель мог легко попадать во все внутренние сети.

        У меня вот обратная ситуация: мне нужно было ограничить доступ из туннеля в локальную сеть, я отключал автоматические правила и разрешал доступ только к нескольким ресурсам.

        Этот нюанс нормально расписан в книге по pfSense 1.2.3., правда там чисто по-аглицки;)

        P.S. Автоматически созданные правила не видны в общем списке, но их можно подглядеть в pftop.

        1 Reply Last reply Reply Quote 0
        • D
          deutsche
          last edited by

          Если у вас layer 2 vpn, то и правила должны быть на LAN интерфейсе.

          http://ru.doc.pfsense.org/

          1 Reply Last reply Reply Quote 0
          • A
            alexandrnew
            last edited by

            у меня sitе-to-site инфраструктура tun девайс…
            а привер такого правила можно увидеть?
            pfctl ?

            1 Reply Last reply Reply Quote 0
            • A
              alexandrnew
              last edited by

              попробовал увидеть разницу между правилами, кто подскажет правильно или нет, разница при снятой галочке и установленной
              смотрел ответ команд pfctl -s rules и pfctl -s nat:

              pass in quick on tun0 all flags S/SA keep state label "let out anything from firewall host itself openvpn"
              anchor "pptp" all
              pass in quick on WAN inet proto gre from any to 83.XX.2XX.253 keep state label "allow gre pptpd"
              pass in quick on WAN inet proto tcp from any to 83.XX.2XX.253 port = pptp flags S/SA modulate state label "allow pptpd 83.XX.2XX.253"

              pass out quick on WAN inet proto udp from any to 10.X.X.1X port = isakmp keep state label "IPSEC to 804dlink admin - outbound isakmp"
              pass in quick on WAN inet proto udp from 10.X.X.1X to any port = isakmp keep state label "IPSEC to 804dlink admin - inbound isakmp"
              pass out quick on WAN inet proto esp from any to 10.X.X.1X keep state label "IPSEC to 804dlink admin - outbound esp proto"
              pass in quick on WAN inet proto esp from 10.X.X.1X to any keep state label "IPSEC to 804dlink admin - inbound esp proto"
              pass out quick on em2 inet proto udp from any to 10.X.X.1X port = isakmp keep state label "IPSEC to 804dlink admin - outbound isakmp"
              pass in quick on em2 inet proto udp from 10.X.X.1X to any port = isakmp keep state label "IPSEC to 804dlink admin - inbound isakmp"
              pass out quick on em2 inet proto esp from any to 10.X.X.1X keep state label "IPSEC to 804dlink admin - outbound esp proto"
              pass in quick on em2 inet proto esp from 10.X.X.1X to any keep state label "IPSEC to 804dlink admin - inbound esp proto"
              pass out quick on em4 inet proto udp from any to 10.X.X.1X port = isakmp keep state label "IPSEC to 804dlink admin - outbound isakmp"
              pass in quick on em4 inet proto udp from 10.X.X.1X to any port = isakmp keep state label "IPSEC to 804dlink admin - inbound isakmp"
              pass out quick on em4 inet proto esp from any to 10.X.X.1X keep state label "IPSEC to 804dlink admin - outbound esp proto"
              pass in quick on em4 inet proto esp from 10.X.X.1X to any keep state label "IPSEC to 804dlink admin - inbound esp proto"
              pass out quick on em0 inet proto udp from any to 10.X.X.1X port = isakmp keep state label "IPSEC to 804dlink admin - outbound isakmp"
              pass in quick on em0 inet proto udp from 10.X.X.1X to any port = isakmp keep state label "IPSEC to 804dlink admin - inbound isakmp"
              pass out quick on em0 inet proto esp from any to 10.X.X.1X keep state label "IPSEC to 804dlink admin - outbound esp proto"
              pass in quick on em0 inet proto esp from 10.X.X.1X to any keep state label "IPSEC to 804dlink admin - inbound esp proto"

              pass in quick on WAN proto udp from any to any port = isakmp keep state label "IPSEC: Mobile - inbound isakmp"
              pass in quick on WAN proto esp all keep state label "IPSEC: Mobile - inbound esp proto"
              pass in quick on WAN proto ah all keep state label "IPSEC: Mobile - inbound ah proto"
              pass in quick on em2 proto udp from any to any port = isakmp keep state label "IPSEC: Mobile - inbound isakmp"
              pass in quick on em2 proto esp all keep state label "IPSEC: Mobile - inbound esp proto"
              pass in quick on em2 proto ah all keep state label "IPSEC: Mobile - inbound ah proto"
              pass in quick on em4 proto udp from any to any port = isakmp keep state label "IPSEC: Mobile - inbound isakmp"
              pass in quick on em4 proto esp all keep state label "IPSEC: Mobile - inbound esp proto"
              pass in quick on em4 proto ah all keep state label "IPSEC: Mobile - inbound ah proto"
              pass in quick on em0 proto udp from any to any port = isakmp keep state label "IPSEC: Mobile - inbound isakmp"
              pass in quick on em0 proto esp all keep state label "IPSEC: Mobile - inbound esp proto"
              pass in quick on em0 proto ah all keep state label "IPSEC: Mobile - inbound ah proto"

              в частности есть несколько вопросов:
              1 затрагивает эта "галочка" нат правила? так как разницу не обнаружил
              2 создает динамические правила для каждого клиента впн (не обнаружил, клиентов много, сразу с десяток подцепились) или только глобальные, то что обнаружил?

              1 Reply Last reply Reply Quote 0
              • First post
                Last post