Thread: iptables vpn rules

Hello there ,

I have a problem with iptables rules , so i try to make a firewall but still blocking my vpn connection or when i'm connected in a vpn i have a deconnection this is my rules :

#!/bin/sh

# FLUSH TABLES
iptables -t filter -F

# Flush personal tables
iptables -t filter -X



#dont break connection connected
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

# OKr loopback
iptables -t filter -A INPUT -i lo -j ACCEPT
iptables -t filter -A OUTPUT -o lo -j ACCEPT

# ICMP (Ping)
iptables -t filter -A INPUT -p icmp -j ACCEPT
iptables -t filter -A OUTPUT -p icmp -j ACCEPT

# ---

# SSH In
iptables -t filter -A INPUT -p tcp --dport 22 -j ACCEPT

# SSH Out
iptables -t filter -A OUTPUT -p tcp --dport 22 -j ACCEPT


# DNS In/Out
iptables -t filter -A OUTPUT -p tcp --dport 53 -j ACCEPT
iptables -t filter -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 53 -j ACCEPT
iptables -t filter -A INPUT -p udp --dport 53 -j ACCEPT

# NTP Out
iptables -t filter -A OUTPUT -p udp --dport 123 -j ACCEPT

# HTTP + HTTPS Out
iptables -t filter -A OUTPUT -p tcp --dport 80 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 443 -j ACCEPT

# HTTP + HTTPS In
iptables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 8443 -j ACCEPT


#VPN
iptables -A INPUT -p TCP --dport 1723 -j ACCEPT
iptables -A OUTPUT -p TCP --dport 1723 -j ACCEPT
iptables -A INPUT -p UDP --dport 1723 -j ACCEPT
iptables -A OUTPUT -p UDP --dport 1723 -j ACCEPT


#skype
iptables -A INPUT -p TCP --dport 23399 -j ACCEPT

But still blocked.

Any help ?

Regards .

Is it PPTP based vpn? Your script is so wrong... you are not dropping traffic for any chain at start or end but still opening and closing all ports which is a bad design.

Originally Posted by meta

Is it PPTP based vpn? Your script is so wrong... you are not dropping traffic for any chain at start or end but still opening and closing all ports which is a bad design.

Yes is PPTP BASED.

Where is wrong in my script ?

Are you using CentoS or Debian?

I have Ubuntu

Up please !