kill switch for ubuntu

m1xm4sterm1xm4ster
edited May 2014 in General Privacy Discussion
Hi!
As statet in another thread, there is a bug in the pia.sh app for ubuntu.

The kill switch does it's job, but when you try to connect to your local network, the kill switch will refuse this connection as well.


So I disabled the killswitch in the pia.sh app and configuered a firewall to make my own kill switch.



First I installed UFW
sudo apt-get install ufw



Added these rules


This denies all in and outgoing traffic:

sudo ufw default deny outgoing

sudo ufw default deny incoming

Optional step for OpenSSH users or if you want to allow/block a specific service:
sudo ufw app list //will show some services, OpenSSH among others
sudo ufw OpenSSH allow //allows OpenSHH. this works for other services too

This allows connections from the vpn interface:
sudo ufw allow out on tun0 from any to any // replace "tun0" with your vpn interface name --> see sudo ifconfig
sudo ufw allow in on tun0 from any to any   // replace "tun0" with your vpn interface name --> see sudo ifconfig

This allows all traffic from and to the VPN server:
The port range is specifically for the VPN server in the netherlands. You can add other servers as well. Just find out the port range or ask the staff.

sudo ufw allow in from 109.201.128.0/109.201.159.255 to any
sudo ufw allow out from any to 109.201.128.0/109.201.159.255

This step allows connections within your LAN:


sudo ufw allow from 192.168.11.0/24 // replace "192.168.11" with your address



Now just enable the firewall


sudo ufw enable

There is one thing I did not solve by now. You have to disable the firewall (sudo ufw disable) before you can connect to your VPN server. After the connection has been established, you want to enable the firewall again. For me this is no big deal, because my PC runs 24/7 and I usually don't reconnect.

Note that I am not a linux expert. I guess there are some people here that know a lot more about this. Feel free to make suggestions for improvements :)

Comments

  • slopslop
    edited September 2014
    Hi m1xm4ster - thanks for sharing this seems to do exactly what I want. 

    I think I got around the issue you have with openvpn not being able to connect at statup, I just added 

    sudo ufw allow out 1194/udp

    and that seems to do the trick.

    so my rules look like:

    allow access to/from any local network devices

    sudo ufw allow to 192.168.1.0/24
    sudo ufw allow in from 192.168.1.0/24

    allow access to ip addresses for my chosen gateway - use nslookup X in windows or linus, with X being your chosen vpn gateway. Replace X.X.X.X below with the ip's shown in nslookup

    sudo ufw allow in from X.X.X.X to any
    sudo ufw allow in from X.X.X.X to any
    sudo ufw allow in from X.X.X.X to any
    sudo ufw allow in from X.X.X.X to any

    allow traffice over tun0 or whatever your vpn tunnel name is found via ifconfig

    sudo ufw allow in on tun0 from any to any
    sudo ufw allow out on tun0 from any to any

    allow vpn to connect on startup

    sudo ufw allow out 1194/udp

    deny all traffic otherwise

    sudo ufw default deny incoming
    sudo ufw default deny outgoing

    save/enable fw on startup

    sudo ufw enable



    It doesn't look like I had to specify the gateway IPs with an allow out rule... I thought I had but reviewing my rules with sudo ufw status verbose seems to indicate I don't have that set up.

    Either way, dropping vpn connection kills internet but allows me to keep accessing local machines. So far so good.



    ***edit - had to play around with the local network section but I think I have it working now.
  • pyro12pyro12
    Thanks for posting this.  I'm going to wait are read a few more comments from the "gurus" before I try it, but it looks great and I even think I understand what is going on!
  • slopslop
    Yep I hear ya... I'm... pretty happy with how it's working out.

    My setup is:

    Host OS - Open Media Vault, with virtualbox plugin installed

    VirtualBox Guest OS running Ubuntu 14.04 server.

    I was running 12.04, but there are all sorts of issue with the python libcrypt package and updating it beyond what gets installed by default on 12.04 was beyond me.

    I also couldn't use 14.04 desktop due to poor performance of unity3d in virtualbox.

    What's great though, is with a VM machine I can clone it, then make changes and always just go back to my "clean" copy if I end up breaking something or am not comfortable with all the changes I made.




    So.. on my guest OS (14.04 server) 
    - I just installed openssh server so I can work on it using putty (vs the console window which doesn't have nice copy/past support).
    - install guest additions.. had to use apt get for some reason, perhaps my virtual box host additions image wasnt current enough.
    - used the following to install openvpn and connect to PIA. http://raspinotes.wordpress.com/2013/06/04/setup-vpn-with-privateinternetaccess-com/
    - install whatever software you want.. in my case I think I used this link for deluge http://www.havetheknowhow.com/Install-the-software/Install-Deluge-Headless.html

    made sure the webui was working against a test torrent (and that my vpn ip was being used).

    Then applied my firewall rules.

    - my guest os is accesible from my lan
    - the lan is accesible from my guest os
    - share drives are accesible from my guest os (make sure you add the deluge user to the vbosxf group and reboot if you get permissions issues)

    bringing the tunnel up and down external traffic, traffic does not recover after any amount of time (ie.. use your non-vpn connection). Deluge does have a setting to force a certain NIC to be used (tun0) but it doesn't seem to work.. that said I did still set the setting just in case.

    It's good.. it's fast.. and a single cpu core assigned to the guest in virtual box from my 4570k seems able to handle 2.5+mbps of torrent traffic and vpn processing easily.

    Very happy.












  • kostickostic
    m1xm4ster said:
    Hi! As statet in another thread, there is a bug in the pia.sh app for ubuntu.
    The kill switch does it's job, but when you try to connect to your local network, the kill switch will refuse this connection as well.
    So I disabled the killswitch in the pia.sh app and configuered a firewall to make my own kill switch.

    First I installed UFW
    sudo apt-get install ufw

    Added these rules
    This denies all in and outgoing traffic:
    sudo ufw default deny outgoing
    sudo ufw default deny incoming

    Optional step for OpenSSH users or if you want to allow/block a specific service:
    sudo ufw app list //will show some services, OpenSSH among others
    sudo ufw OpenSSH allow //allows OpenSHH. this works for other services too

    This allows connections from the vpn interface:
    sudo ufw allow out on tun0 from any to any // replace "tun0" with your vpn interface name --> see sudo ifconfig
    sudo ufw allow in on tun0 from any to any   // replace "tun0" with your vpn interface name --> see sudo ifconfig

    This allows all traffic from and to the VPN server:
    The port range is specifically for the VPN server in the netherlands. You can add other servers as well. Just find out the port range or ask the staff.
    sudo ufw allow in from 109.201.128.0/109.201.159.255 to any
    sudo ufw allow out from any to 109.201.128.0/109.201.159.255

    This step allows connections within your LAN:
    sudo ufw allow from 192.168.11.0/24     // replace "192.168.11" with your address

    Now just enable the firewall
    sudo ufw enable

    There is one thing I did not solve by now. You have to disable the firewall (    sudo ufw disable) before you can connect to your VPN server. After the connection has been established, you want to enable the firewall again. For me this is no big deal, because my PC runs 24/7 and I usually don't reconnect.

    Note that I am not a linux expert. I guess there are some people here that know a lot more about this. Feel free to make suggestions for improvements :)




    Sorry to resurrect such an old thread, how did you find the necessary ports for the Netherlands server? I tried contacting support in order to get the ports required for US East coast servers but they were unable to help. Thanks!
  • somethingdumbsomethingdumb
    Tried this but ufw periodically kills access to my nas, then the vpn drops - rules are default deny incoming, default deny outgoing, allow out on tun0 from any to any, allow 1194/udp to let VPN reconnect on failure, allow to 192.168.nas ip, allow from 192.168.nas ip, then just for fun allow to 192.168.***.0/24 just to blanket the whole LAN in allow. It works for a few hours, then stops talking to the share.
Sign In or Register to comment.