> > > > > From: "Jason Long via Openvpn-users" <openvpn-users@lists.sourceforge.net> > Date: Saturday, 29 July 2023 at 16:18:44 > To: "Tincantech via Openvpn-users" <openvpn-users@lists.sourceforge.net> > Subject: [Openvpn-users] How to write the iptables rules for a NIC with > multiple IP addresses? > > > > Hello, > Suppose several IP addresses are set on a NIC and the name of the NIC is > eth0. For example, you have set "1.2.3.4", "1.2.3.5" and "1.2.3.6" IP > addresses on the eth0. > > You want to launch several server configuration files for each IP. For > example, for IP "1.2.3.4" you want to launch Server-1.conf, Server-2.conf and > Server-3.conf configuration files. > For IP "1.2.3.5" you want to launch Server-4.conf, Server-5.conf and > Server-6.conf configuration files and so on. > > Each .conf file is as follows: > > port 119X > proto udp > dev tunX > ca ca.crt > cert server.crt > key server.key > dh dh.pem > server "IP" 255.255.255.0 > push "redirect-gateway def1 bypass-dhcp" > push "dhcp-option DNS 1.1.1.1" > push "dhcp-option DNS 8.8.8.8" > keepalive 10 120 > tls-auth ta.key 0 > data-ciphers AES-256-CBC > user nobody > group nogroup > persist-key > persist-tun > status /var/log/openvpn/openvpn-status.log > log /var/log/openvpn/openvpn.log > log-append /var/log/openvpn/openvpn.log > verb 3 > explicit-exit-notify 1 > > > Your iptables rules are: > > # IF_MAIN=eth0 > # IF_TUNNEL=tunX > # YOUR_OPENVPN_SUBNET=IP/16 > # iptables -I INPUT -p udp --dport 119X -j ACCEPT > # iptables -A FORWARD -i $IF_MAIN -o $IF_TUNNEL -m state --state > ESTABLISHED,RELATED -j ACCEPT > # iptables -A FORWARD -s $YOUR_OPENVPN_SUBNET -o $IF_MAIN -j ACCEPT > # iptables -t nat -A POSTROUTING -s $YOUR_OPENVPN_SUBNET -o $IF_MAIN -j > MASQUERADE > > > In the iptables rules you have mentioned the name of the NIC. > > How can OpenVPN recognize that the configuration files Server-1.conf, > Server-2.conf and Server-3.conf should be for IP address "1.2.3.4"? > Should I change the name of the NIC to the IP address? > > > Thank you. > > > _______________________________________________ > Openvpn-users mailing list > Openvpn-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/openvpn-users > > >
> Instead of adding virtual (slave) devices to your nic, you can simply add > additional up addresses to that nic (ip addr add 1.2.3.10/32 dev your-nic; ip > addr add 1.2.3.20/32 dev your—nic; etc etc > That helps to keep firewall rules simple. > Else you might look into bridge-devices… Hello, Thank you so much. Keep firewall rules simple? How? Please consider the following iptables rules: # IF_MAIN=enp0s3 # IF_TUNNEL=tun2 # YOUR_OPENVPN_SUBNET=IP/16 # iptables -I INPUT -p udp --dport PORT -j ACCEPT # iptables -A FORWARD -i $IF_MAIN -o $IF_TUNNEL -m state --state ESTABLISHED,RELATED -j ACCEPT # iptables -A FORWARD -s $YOUR_OPENVPN_SUBNET -o $IF_MAIN -j ACCEPT # iptables -t nat -A POSTROUTING -s $YOUR_OPENVPN_SUBNET -o $IF_MAIN -j MASQUERADE # iptables -t nat -A POSTROUTING -s $YOUR_OPENVPN_SUBNET -j SNAT --to $IF_MAIN You added two public IPs to enp0s3 NIC and on each IP address you want to run three server.conf files. Can you update the iptables rules it for this scenario? I guess you should at least update the following rules: # IF_TUNNEL=tun2 # YOUR_OPENVPN_SUBNET=IP/16 # iptables -I INPUT -p udp --dport PORT -j ACCEPT Am I right? Dit bericht kan informatie bevatten die niet voor u is bestemd. Indien u niet de geadresseerde bent of dit bericht abusievelijk aan u is toegezonden, wordt u verzocht dat aan de afzender te melden en het bericht te verwijderen. De Staat aanvaardt geen aansprakelijkheid voor schade, van welke aard ook, die verband houdt met risico's verbonden aan het elektronisch verzenden van berichten. This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. The State accepts no liability for damage of any kind resulting from the risks inherent in the electronic transmission of messages. _______________________________________________ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-users
