Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Strange behavior with Firewall #8

Open
TheNotary opened this issue Oct 19, 2014 · 0 comments
Open

Strange behavior with Firewall #8

TheNotary opened this issue Oct 19, 2014 · 0 comments

Comments

@TheNotary
Copy link

I have a firewall on a debian machine preventing internet traffic through anything other than the TUN I have set up through openpvp, EXCLUDING local network traffic, so I can still SSH the box and theoretically should be able to access MiniDLNA:

#Allow loopback device (internal communication)
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

#Allow all local traffic.
iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT
iptables -A OUTPUT -d 192.168.1.0/24 -j ACCEPT


#Allow VPN establishment
iptables -A OUTPUT -p udp --dport 1194 -j ACCEPT
iptables -A INPUT -p udp --sport 1194 -j ACCEPT

#Allow traffic to uk and hk PIA server to reconnect VPN in case of failure
iptables -A INPUT -s uk-london.privateinternetaccess.com -j ACCEPT
iptables -A OUTPUT -d uk-london.privateinternetaccess.com -j ACCEPT
iptables -A INPUT -s  hk.privateinternetaccess.com -j ACCEPT
iptables -A OUTPUT -d hk.privateinternetaccess.com -j ACCEPT
#Allow traffic to PIA DNS
iptables -A INPUT -s 209.222.18.222 -j ACCEPT
iptables -A OUTPUT -d 209.222.18.222 -j ACCEPT

#Accept all TUN connections (tun = VPN tunnel)
iptables -A OUTPUT -o tun+ -j ACCEPT
iptables -A INPUT -i tun+ -j ACCEPT

#Set default policies to drop all communication unless specifically allowed
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

That script works great, I fire it on the servers bootup via /etc/rc.local (it's a debian system). But when I run DLNA that's in the sources.list, I can't connect to the server from other devices. Upon inspection of the logfile, I see something that I can readily make sense of.

[2014/10/18 19:53:29] minissdp.c:335: error: sendto(udp_notify=7, 192.168.1.2): Operation not permitted

I tried compiling but can't get things to work with the init script for some reason. Anyway, does anyone have any suggestions?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant