iptables NAT and VPN

wkevin wrote:
> Hello,
> Is it possible to block VPN traffic through a certain machine with
> some iptables rule?

Simply block the port in question

> rgs,
> Kevin

Klaus

--
Klaus Zerwes
http://www.zero-sys.net

On Jul 30, 7:14 am, wkevin <wkev... RemoveThis @gmail.com> wrote:

> I want to block VPNs in general on this machine, without prior
> knowledge of the port. Is it possible ?

Yes if you have some way to distinguish VPN traffic from non-VPN
traffic. No if you don't.

One possibility is to block all traffic except the traffic you
specifically choose to allow. Then you can distinguish "VPN traffic"
as "anything not covered by the rules that state what I want to
allow".

Just make sure you don't specifically choose to allow something that
you consider a VPN. (The definition is fluid. For example, if I use
HTTP to exchange IP packets, is that a VPN?)

DS

wkevin wrote:
> Thanks, Klaus.
> I want to block VPNs in general on this machine, without prior
> knowledge of the port. Is it possible ?

Not really AFAIK.
And it depends on what you mean by the term VPN.

Regarding IPSec you can try to block the protocols ESP and AH.
Or you may have a look at the policy module for iptables.

Regarding other VPN or tunneling techniques you must search for
corresponding stuff, may et be protocol based, port based or other way.

The other way would be to only allow specific traffic (but even then a
openvpn-server running on port 80 or 443 would be reachable)

Or you should have a look at snort running inline of iptables. Maybe you
can compile your own rules matching at least some VPN techniques.

Klaus

> Rgs,
> Kevin


--
Klaus Zerwes
http://www.zero-sys.net

wkevin wrote:
> Hello,
> Is it possible to block VPN traffic through a certain machine with
> some iptables rule?
> rgs,
> Kevin


VPN is a term that is far from unique - there are
myriads of different ways to create a VPN tunnel.

If you have an Internet connection, there may be a VPN
going on on top of the connection, e.g.

- tunneled on seemingly innocent HTTP requests and responses,
- tunneled on DNS requests,
- tunneled on data on ping requests,
- etc (you name it).

For blocking a SSH VPN, close TCP port 22. For an OpenVPN
on default UDP port, block UDP port 1194 (and so on, for
each VPN method and port setup separately).

What are you attempting to achieve and why?

--

Tauno Voipio
tauno voipio (at) iki fi