UFW (uncomplicated firewall) Openvpn killswitch Issues

anotheranonymous

Trying to use UFW for my openvpn killswitch instead of Iptables because I am new to linux and iptables is too esoteric and complicated looking for me to dive into now.  I am currently able to get my openVPN connection to PIA's VPN server running on startup. 

Now I want my UFW settings to act as a killswitch preventing any traffic entering or leaving my computer, except through my VPN.  Obviously, I have to allow my real IP address to connect to the VPN before the rest of the firewall kicks in.  The ip address (LAN IP) of my router is 192.168.0.1.

I use this command to check my ip address in terminal and make sure the VPN is connected:

curl http://ipinfo.io/ip

I downloaded the default openvpn configuration files that connect over UDP port 1198 from here:

https://helpdesk.privateinternetaccess.com/hc/en-us/articles/218984968-What-is-the-difference-between-the-OpenVPN-config-files-on-your-website-

Here are the UFW commands I used:

sudo apt install ufw (installs UFW)

sudo ufw reset (resets all default settings)

sudo ufw default deny outgoing (block all traffic coming out, then give exceptions)

sudo ufw default deny incoming (block all traffic coming in, then give exceptions)

sudo ufw allow out 1198/udp (connect to PIA server with their default openvpn file)

sudo ufw allow to 192.168.0.1/24 (allow outgoing traffic to within lan)

sudo ufw allow in from 192.168.0.1/24 (allow incoming traffic from within lan)

sudo ufw allow out on tun0 (allow traffic out through tun0 (VPN))

sudo ufw allow in on tun0 (allow traffic in through tun0 (VPN))

sudo ufw enable (enables ufw, then I need to reboot computer)

Now after I reboot my computer and try to use the "curl http://ipinfo.io/ip" command, terminal spits back:

curl: (6) Could not resolve host: ipinfo.io

I presume my UFW firewall settings are shutting off any incoming or outgoing connections because I didn't establish a VPN connection at startup? 

Would anyone please explain to me what I am doing wrong?  What do I need to change in my UFW settings?

Thanks

piaabo

Try allow in 1198/udp

I don't use ufw. If it does not set input state to established connections, as i read it, any new input over your tun0 interface will be accepted on any port eg ssh 20, which you probably don't want.

anotheranonymous

piaabo said:

Try allow in 1198/udp

I don't use ufw. If it does not set input state to established connections, as i read it, any new input over your tun0 interface will be accepted on any port eg ssh 20, which you probably don't want.

1. I tried your idea of adding an allow in rule for UDP over port 1198 so that the PIA VPN server I want to connect to can talk back to my computer and confirm I'm connected before the rest of my data starts tunneling over my VPN connection.

Unfortunately when I added your suggested allow in UFW rule with the others I showed above, I still was not able to run the ip address checking command in terminal and got the same error as before:

curl: (6) Could not resolve host: ipinfo.io

If I were really connected to my VPN, then running a command in terminal such as "curl http:// ipinfo.io" would have worked, right?  If I can't even run that command than trying to run "sudo apt install" over http or https won't work either.  Obviously my UFW rules are so strict that they are preventing me from connecting to my PIA VPN.  Either I am using the wrong protocol (UDP/TCP) or port to connect to for the PIA configured openvpn configuration files I downloaded from them.

Wish someone else who's got some experience with UFW could tell me what I am doing wrong.

2. I know my VPN allow in and out rules are too lax.  First I wanted to test that I could connect to my VPN with my UFW killswitch rules turned on, that UFW would drop my internet connection in case my VPN connection died or my VPN were shutoff.  Then my plan was to tighten up my firewall rules to only allow certain protocols (e.g. http/https/SSH etc.) over the ports I specify

Thanks for your suggestion, piaabo!

martouf

DNS is a service which resolves names like ipinfo.io into IP addresses. It runs over whatever network interface(s) you have (hardwired, wifi, VPN, etc). DNS traffic must be permissible for names to be resolved.

anotheranonymous

martouf said:

DNS is a service which resolves names like ipinfo.io into IP addresses. It runs over whatever network interface(s) you have (hardwired, wifi, VPN, etc). DNS traffic must be permissible for names to be resolved.

Hmm I see.  Well I'm still new to networking and linux, but I want to learn as much as I can rather than copying other commands I see online like a monkey without understanding.

When names normally resolve into IP addresses when not using a VPN, who is doing that for me in the first place?  Does my router itself do that for me?  Or does my ISP?  How does one normally decide which DNS service to use?  I've read there are alternative DNS services such as Google DNS and OpenDNS to choose from.  PIA uses it's own DNS server whenever my VPN is turned on doesn't it?

Anyways, what sort of UFW firewall rule will I need to allow DNS resolution?  Does it need to be both outbound and inbound?

martouf

answering the first question: have a look at the content of your /etc/resolv.conf file when the VPN is down.

that will tell you the IP addresses of "who is doing that". but it doesn't tell you the IP ports being used.

after you discover which IP ports are being used, it would be an opportunity for you to see exactly what is going on using a tool like Wireshark and filtering on the IP host address(es) [and possibly also the IP port(s), if there is just too much traffic in addition to DNS traffic]

piaabo

Your router may have DNS server address pre-configured, which would be bypassed by the VPN tunnel providing you check where your computer is looking, as per martouf's suggestion.

The DNS servers recommended by PIA are found here under DNS leak protection. Note the 'additional resources' bottom of page.

I would be surprised if ufw blocks dns with your rules 'allow out tun0', the equivalent iptables rule allows dns. DNS traffic is reserved for port 53, you would open this port in and out for whichever DNS server address you like.

anotheranonymous

So I'm using a headless version of the raspian operating system.  I don't think I can use a tool like martouf suggested if it needs a GUI.

I did check my WLAN settings on my router and noticed that it does have "Connect to DNS server automatically" set to "Yes".

Do I need to add an extra outgoing or incoming rule for UFW to allow DNS?  If so, what should my rule look like?

Thanks!

martouf

good of you to mention you're CLI only over there.  tcpdump can fill in for wireshark.

ps: you can run wireshark on your fav laptop and use a wired hub on your LAN to plug both the laptop and the pi into.. or, if your laptop uses an atheros wifi chipset, you can go all wirelessly promiscuous..

anotheranonymous

martouf said:

good of you to mention you're CLI only over there.  tcpdump can fill in for wireshark.

ps: you can run wireshark on your fav laptop and use a wired hub on your LAN to plug both the laptop and the pi into.. or, if your laptop uses an atheros wifi chipset, you can go all wirelessly promiscuous..

Actually I disabled wifi on my raspberry pi since PIA explicitly tells users running their app (which runs their own version of openvpn, I presume) that the kill switch can only shut off your device's internet connection over one type of interface at a time.  So if your device is plugged into ethernet and running wifi at the same time, the kill switch might not work as intended.

So going back to my original post, I provided everyone with the exact list of UFW commands I ran in my attempt to create my own openvpn killswitch from scratch.  But I can't even check what my ip address is after startup right now once UFW is enabled...

Can you or anyone else tell me what other UFW commands I should add or modify to my existing ones so that my device will drop its internet connection to the outside world (ie.e. outside of my local network) if the VPN connection drops?

I've been stuck on this for a while and wanted to know what I was doing wrong.

piaabo

Try to rule out dns issue. Change your DNS manually; edit resolv.conf. Open port 53 in/out in ufw (allows dns traffic). Try nslookup ipinfo.io the first server address should match DNS server of pia. You can try this before connecting to pia to confirm dns change. Just to be clear, the addition from my first post is required for successful vpn connection.

martouf

teaching a person to make firewall rules who does not choose to observe network traffic directly is like teaching gardening to someone who avoids contact with soil.