OpenVPN iptable question

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking
Author Message
johnnyNobody999
DD-WRT User


Joined: 10 Jan 2014
Posts: 382

PostPosted: Mon Feb 22, 2021 22:51    Post subject: OpenVPN iptable question Reply with quote
I was reading the latest server setup and they said to use the following iptables configuration:

iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -o $(get_wanface) -j MASQUERADE

I've been reading (uh, oh) about iptables and I was wondering if the following would be a better or more generic way to set up the rule:

iptables -t nat -I POSTROUTING -s $(nvram get openvpn_net)/$(nvram get openvpn_tunmask) -o $(get_wanface) -j SNAT --to-source $(nvram get wan_ipaddr)

I read that SNAT is faster than MASQUERADE and that SNAT should be fine for those of us with a public (WAN side) static IP. What do you guys/gals think? My configuration idea works. I don't think there's any security issues but I'm not an iptables expert.
Sponsor
eibgrad
DD-WRT Guru


Joined: 18 Sep 2010
Posts: 8563

PostPosted: Mon Feb 22, 2021 23:11    Post subject: Reply with quote
Using nvram variables is most advantageous for tech support when we're providing advice, since it applies more generally. But if you *know* what these values are, then at least in terms of performance, using fixed, known values is going to be more efficient. After all, those nvram variables have to be looked up continuously.

OTOH, it probably doesn't matter all that much in this particular case anyway. Many ppl don't realize that unlike the filter table, the NAT table is only referenced *once* for a given connection, so the *hit* taken for these continuous lookups isn't nearly as bad as it might first appear.

So take your pick.

_________________
ddwrt-ovpn-split-basic.sh
ddwrt-ovpn-split-advanced.sh
ddwrt-ovpn-remote-access.sh
ddwrt-ovpn-client-backup.sh
ddwrt-mount-usb-drives.sh
johnnyNobody999
DD-WRT User


Joined: 10 Jan 2014
Posts: 382

PostPosted: Tue Feb 23, 2021 1:17    Post subject: Reply with quote
You're probably right that the rule would operate faster if the actual numbers were used. The only drawback would be if at some point you were assigned a new WAN IP and/or changed the openvpn network and have to remember to update the firewall rule. I suppose a firmware update might change the way it labels the outgoing port also. I'll leave it as is for now. If anything, I learned something about iptables.
eibgrad
DD-WRT Guru


Joined: 18 Sep 2010
Posts: 8563

PostPosted: Tue Feb 23, 2021 1:25    Post subject: Reply with quote
johnnyNobody999 wrote:
You're probably right that the rule would operate faster if the actual numbers were used. The only drawback would be if at some point you were assigned a new WAN IP and/or changed the openvpn network and have to remember to update the firewall rule. I suppose a firmware update might change the way it labels the outgoing port also. I'll leave it as is for now. If anything, I learned something about iptables.


If the WAN ip changes, that means the WAN was reinitialized, and I assume the firewall would be reset at that point, so you'd pick up the change, even w/ SNAT.

_________________
ddwrt-ovpn-split-basic.sh
ddwrt-ovpn-split-advanced.sh
ddwrt-ovpn-remote-access.sh
ddwrt-ovpn-client-backup.sh
ddwrt-mount-usb-drives.sh
SurprisedItWorks
DD-WRT Guru


Joined: 04 Aug 2018
Posts: 1086
Location: Appalachian mountains, USA

PostPosted: Tue Feb 23, 2021 2:46    Post subject: Reply with quote
Please think a bit more on that notion of the nvram commands being rerun continually. It really isn't so. iptables is an ordinary linux command executed in the usual shell. It's arguments are subject to the usual shell expansions. Experiment: put "echo" in front of iptables and run the slightly longer command on the router using ssh. Then you can see what the iptables command will actually see as arguments once the shell is finished with its expansions.

Of course maybe I misread something horribly! Shocked

_________________
Five WRT1900ACSv2's on 42926, 44048.
VLANs, VAPs, NAS, client-mode travel router, OpenVPN client (AirVPN), DDNS, wireguard servers, wireguard clients (AzireVPN), two DNSCrypt DNS providers (incl Quad9) via OpenVPN/wireguard clients.
eibgrad
DD-WRT Guru


Joined: 18 Sep 2010
Posts: 8563

PostPosted: Tue Feb 23, 2021 3:02    Post subject: Reply with quote
SurprisedItWorks wrote:
Please think a bit more on that notion of the nvram commands being rerun continually. It really isn't so. iptables is an ordinary linux command executed in the usual shell. It's arguments are subject to the usual shell expansions. Experiment: put "echo" in front of iptables and run the slightly longer command on the router using ssh. Then you can see what the iptables command will actually see as arguments once the shell is finished with its expansions.

Of course maybe I misread something horribly! Shocked


Good point. I wasn't thinking too clearly there. Wink

_________________
ddwrt-ovpn-split-basic.sh
ddwrt-ovpn-split-advanced.sh
ddwrt-ovpn-remote-access.sh
ddwrt-ovpn-client-backup.sh
ddwrt-mount-usb-drives.sh
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum