Bernhard.Linz/openvpn-install
1
0
Fork 0
mirror of https://github.com/angristan/openvpn-install.git synced 2026-08-03 05:08:13 +02:00
Code Issues Projects Releases Wiki Activity

Fix firewalld forwarding policies

Browse Source
This commit is contained in:
Stanislas Lange
2026-08-02 16:28:42 +02:00
parent 5f69ddadd8
commit 8c40bc9b4d
2 changed files with 79 additions and 95 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openvpn-install.sh
+51 -77
View File
@@ -3533,51 +3533,55 @@ verb 3"
log_info "Configuring firewall rules..." log_info "Configuring firewall rules..."
if [[ $FIREWALL_BACKEND == 'firewalld' ]]; then if [[ $FIREWALL_BACKEND == 'firewalld' ]]; then
# Rich-rule priorities make explicit local and peer access win before the # A dedicated source zone identifies VPN traffic. A policy object applies
# private-network deny rules, followed by the selected default policy. # destination rules to forwarded traffic; zone rich rules alone only
# govern traffic addressed to the server.
log_info "firewalld detected, using firewall-cmd..." log_info "firewalld detected, using firewall-cmd..."
run_cmd_fatal "Adding OpenVPN port to firewalld" firewall-cmd --permanent --add-port="$PORT/$PROTOCOL" run_cmd_fatal "Adding OpenVPN port to firewalld" firewall-cmd --permanent --add-port="$PORT/$PROTOCOL"
run_cmd_fatal "Creating OpenVPN firewalld zone" firewall-cmd --permanent --new-zone=openvpn-install
run_cmd_fatal "Creating OpenVPN firewalld policy" firewall-cmd --permanent --new-policy=openvpn-egress
run_cmd_fatal "Setting OpenVPN policy ingress" firewall-cmd --permanent --policy=openvpn-egress --add-ingress-zone=openvpn-install
run_cmd_fatal "Setting OpenVPN policy egress" firewall-cmd --permanent --policy=openvpn-egress --add-egress-zone=ANY
run_cmd_fatal "Setting OpenVPN policy default" firewall-cmd --permanent --policy=openvpn-egress --set-target=DROP
if [[ -n $VPN_SUBNET_IPV4 ]]; then if [[ -n $VPN_SUBNET_IPV4 ]]; then
run_cmd_fatal "Allowing the IPv4 VPN gateway" firewall-cmd --permanent --add-rich-rule="rule priority=\"-400\" family=\"ipv4\" source address=\"$VPN_SUBNET_IPV4/24\" destination address=\"$VPN_GATEWAY_IPV4/32\" accept" run_cmd_fatal "Adding IPv4 VPN source to firewalld" firewall-cmd --permanent --zone=openvpn-install --add-source="$VPN_SUBNET_IPV4/24"
while IFS= read -r local_network; do run_cmd_fatal "Allowing the IPv4 VPN gateway" firewall-cmd --permanent --zone=openvpn-install --add-rich-rule="rule priority=\"-400\" family=\"ipv4\" destination address=\"$VPN_GATEWAY_IPV4/32\" accept"
run_cmd_fatal "Allowing local IPv4 network $local_network" firewall-cmd --permanent --add-rich-rule="rule priority=\"-300\" family=\"ipv4\" source address=\"$VPN_SUBNET_IPV4/24\" destination address=\"$local_network\" accept" if [[ $CLIENT_IPV4 == 'y' ]]; then
run_cmd_fatal "Adding NAT for local IPv4 network $local_network" firewall-cmd --permanent --add-rich-rule="rule family=\"ipv4\" source address=\"$VPN_SUBNET_IPV4/24\" destination address=\"$local_network\" masquerade" while IFS= read -r local_network; do
done < <(local_networks_for_family 4) run_cmd_fatal "Allowing local IPv4 network $local_network" firewall-cmd --permanent --policy=openvpn-egress --add-rich-rule="rule priority=\"-300\" family=\"ipv4\" destination address=\"$local_network\" accept"
if [[ $CLIENT_IPV4 == 'y' && $CLIENT_TO_CLIENT == 'y' ]]; then run_cmd_fatal "Adding NAT for local IPv4 network $local_network" firewall-cmd --permanent --policy=openvpn-egress --add-rich-rule="rule family=\"ipv4\" destination address=\"$local_network\" masquerade"
run_cmd_fatal "Allowing IPv4 client-to-client traffic" firewall-cmd --permanent --add-rich-rule="rule priority=\"-300\" family=\"ipv4\" source address=\"$VPN_SUBNET_IPV4/24\" destination address=\"$VPN_SUBNET_IPV4/24\" accept" done < <(local_networks_for_family 4)
fi if [[ $ROUTE_INTERNET == 'y' ]]; then
if [[ $CLIENT_IPV4 == 'y' && $ROUTE_INTERNET == 'y' ]]; then for protected_network in "${PROTECTED_IPV4_NETWORKS[@]}"; do
for protected_network in "${PROTECTED_IPV4_NETWORKS[@]}"; do run_cmd_fatal "Protecting IPv4 network $protected_network" firewall-cmd --permanent --policy=openvpn-egress --add-rich-rule="rule priority=\"-200\" family=\"ipv4\" destination address=\"$protected_network\" reject"
run_cmd_fatal "Protecting IPv4 network $protected_network" firewall-cmd --permanent --add-rich-rule="rule priority=\"-200\" family=\"ipv4\" source address=\"$VPN_SUBNET_IPV4/24\" destination address=\"$protected_network\" reject" done
done run_cmd_fatal "Allowing IPv4 internet access" firewall-cmd --permanent --policy=openvpn-egress --add-rich-rule="rule priority=\"-100\" family=\"ipv4\" accept"
run_cmd_fatal "Allowing IPv4 internet access" firewall-cmd --permanent --add-rich-rule="rule priority=\"-100\" family=\"ipv4\" source address=\"$VPN_SUBNET_IPV4/24\" accept" run_cmd_fatal "Adding IPv4 internet NAT" firewall-cmd --permanent --policy=openvpn-egress --add-rich-rule="rule family=\"ipv4\" masquerade"
run_cmd_fatal "Adding IPv4 internet NAT" firewall-cmd --permanent --add-rich-rule="rule family=\"ipv4\" source address=\"$VPN_SUBNET_IPV4/24\" masquerade" fi
else
run_cmd_fatal "Restricting other IPv4 access" firewall-cmd --permanent --add-rich-rule="rule priority=\"-100\" family=\"ipv4\" source address=\"$VPN_SUBNET_IPV4/24\" reject"
fi fi
fi fi
if [[ $CLIENT_IPV6 == 'y' ]]; then if [[ $CLIENT_IPV6 == 'y' ]]; then
run_cmd_fatal "Allowing the IPv6 VPN gateway" firewall-cmd --permanent --add-rich-rule="rule priority=\"-400\" family=\"ipv6\" source address=\"${VPN_SUBNET_IPV6}/112\" destination address=\"$VPN_GATEWAY_IPV6/128\" accept" run_cmd_fatal "Adding IPv6 VPN source to firewalld" firewall-cmd --permanent --zone=openvpn-install --add-source="${VPN_SUBNET_IPV6}/112"
run_cmd_fatal "Allowing the IPv6 VPN gateway" firewall-cmd --permanent --zone=openvpn-install --add-rich-rule="rule priority=\"-400\" family=\"ipv6\" destination address=\"$VPN_GATEWAY_IPV6/128\" accept"
while IFS= read -r local_network; do while IFS= read -r local_network; do
run_cmd_fatal "Allowing local IPv6 network $local_network" firewall-cmd --permanent --add-rich-rule="rule priority=\"-300\" family=\"ipv6\" source address=\"${VPN_SUBNET_IPV6}/112\" destination address=\"$local_network\" accept" run_cmd_fatal "Allowing local IPv6 network $local_network" firewall-cmd --permanent --policy=openvpn-egress --add-rich-rule="rule priority=\"-300\" family=\"ipv6\" destination address=\"$local_network\" accept"
run_cmd_fatal "Adding NAT for local IPv6 network $local_network" firewall-cmd --permanent --add-rich-rule="rule family=\"ipv6\" source address=\"${VPN_SUBNET_IPV6}/112\" destination address=\"$local_network\" masquerade" run_cmd_fatal "Adding NAT for local IPv6 network $local_network" firewall-cmd --permanent --policy=openvpn-egress --add-rich-rule="rule family=\"ipv6\" destination address=\"$local_network\" masquerade"
done < <(local_networks_for_family 6) done < <(local_networks_for_family 6)
if [[ $CLIENT_TO_CLIENT == 'y' ]]; then
run_cmd_fatal "Allowing IPv6 client-to-client traffic" firewall-cmd --permanent --add-rich-rule="rule priority=\"-300\" family=\"ipv6\" source address=\"${VPN_SUBNET_IPV6}/112\" destination address=\"${VPN_SUBNET_IPV6}/112\" accept"
fi
if [[ $ROUTE_INTERNET == 'y' ]]; then if [[ $ROUTE_INTERNET == 'y' ]]; then
for protected_network in "${PROTECTED_IPV6_NETWORKS[@]}"; do for protected_network in "${PROTECTED_IPV6_NETWORKS[@]}"; do
run_cmd_fatal "Protecting IPv6 network $protected_network" firewall-cmd --permanent --add-rich-rule="rule priority=\"-200\" family=\"ipv6\" source address=\"${VPN_SUBNET_IPV6}/112\" destination address=\"$protected_network\" reject" run_cmd_fatal "Protecting IPv6 network $protected_network" firewall-cmd --permanent --policy=openvpn-egress --add-rich-rule="rule priority=\"-200\" family=\"ipv6\" destination address=\"$protected_network\" reject"
done done
run_cmd_fatal "Allowing IPv6 internet access" firewall-cmd --permanent --add-rich-rule="rule priority=\"-100\" family=\"ipv6\" source address=\"${VPN_SUBNET_IPV6}/112\" accept" run_cmd_fatal "Allowing IPv6 internet access" firewall-cmd --permanent --policy=openvpn-egress --add-rich-rule="rule priority=\"-100\" family=\"ipv6\" accept"
run_cmd_fatal "Adding IPv6 internet NAT" firewall-cmd --permanent --add-rich-rule="rule family=\"ipv6\" source address=\"${VPN_SUBNET_IPV6}/112\" masquerade" run_cmd_fatal "Adding IPv6 internet NAT" firewall-cmd --permanent --policy=openvpn-egress --add-rich-rule="rule family=\"ipv6\" masquerade"
else
run_cmd_fatal "Restricting other IPv6 access" firewall-cmd --permanent --add-rich-rule="rule priority=\"-100\" family=\"ipv6\" source address=\"${VPN_SUBNET_IPV6}/112\" reject"
fi fi
fi fi
if [[ $CLIENT_TO_CLIENT == 'y' ]]; then
run_cmd_fatal "Allowing firewalld intra-zone forwarding" firewall-cmd --permanent --zone=openvpn-install --add-forward
fi
run_cmd_fatal "Reloading firewalld" firewall-cmd --reload run_cmd_fatal "Reloading firewalld" firewall-cmd --reload
elif [[ $FIREWALL_BACKEND == 'nftables' ]]; then elif [[ $FIREWALL_BACKEND == 'nftables' ]]; then
log_info "nftables detected, configuring nftables rules..." log_info "nftables detected, configuring nftables rules..."
@@ -3600,9 +3604,11 @@ verb 3"
echo " type filter hook forward priority -10; policy accept;" echo " type filter hook forward priority -10; policy accept;"
if [[ -n $VPN_SUBNET_IPV4 ]]; then if [[ -n $VPN_SUBNET_IPV4 ]]; then
echo " oifname \"tun*\" ip daddr $VPN_SUBNET_IPV4/24 ct state established,related accept" echo " oifname \"tun*\" ip daddr $VPN_SUBNET_IPV4/24 ct state established,related accept"
while IFS= read -r local_network; do if [[ $CLIENT_IPV4 == 'y' ]]; then
echo " iifname \"tun*\" ip saddr $VPN_SUBNET_IPV4/24 ip daddr $local_network accept" while IFS= read -r local_network; do
done < <(local_networks_for_family 4) echo " iifname \"tun*\" ip saddr $VPN_SUBNET_IPV4/24 ip daddr $local_network accept"
done < <(local_networks_for_family 4)
fi
if [[ $CLIENT_IPV4 == 'y' && $CLIENT_TO_CLIENT == 'y' ]]; then if [[ $CLIENT_IPV4 == 'y' && $CLIENT_TO_CLIENT == 'y' ]]; then
echo " iifname \"tun*\" ip saddr $VPN_SUBNET_IPV4/24 ip daddr $VPN_SUBNET_IPV4/24 accept" echo " iifname \"tun*\" ip saddr $VPN_SUBNET_IPV4/24 ip daddr $VPN_SUBNET_IPV4/24 accept"
fi fi
@@ -3715,10 +3721,12 @@ verb 3"
echo "iptables -I INPUT 1 -i tun+ -s $VPN_SUBNET_IPV4/24 -j ACCEPT" echo "iptables -I INPUT 1 -i tun+ -s $VPN_SUBNET_IPV4/24 -j ACCEPT"
echo "iptables -I FORWARD 1 -o tun+ -d $VPN_SUBNET_IPV4/24 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT" echo "iptables -I FORWARD 1 -o tun+ -d $VPN_SUBNET_IPV4/24 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT"
echo "iptables -I FORWARD 1 -i tun+ -s $VPN_SUBNET_IPV4/24 -j OPENVPN_INSTALL_FORWARD" echo "iptables -I FORWARD 1 -i tun+ -s $VPN_SUBNET_IPV4/24 -j OPENVPN_INSTALL_FORWARD"
while IFS= read -r local_network; do if [[ $CLIENT_IPV4 == 'y' ]]; then
echo "iptables -A OPENVPN_INSTALL_FORWARD -d $local_network -j ACCEPT" while IFS= read -r local_network; do
echo "iptables -t nat -I POSTROUTING 1 -s $VPN_SUBNET_IPV4/24 -d $local_network -j MASQUERADE" echo "iptables -A OPENVPN_INSTALL_FORWARD -d $local_network -j ACCEPT"
done < <(local_networks_for_family 4) echo "iptables -t nat -I POSTROUTING 1 -s $VPN_SUBNET_IPV4/24 -d $local_network -j MASQUERADE"
done < <(local_networks_for_family 4)
fi
if [[ $CLIENT_IPV4 == 'y' && $CLIENT_TO_CLIENT == 'y' ]]; then if [[ $CLIENT_IPV4 == 'y' && $CLIENT_TO_CLIENT == 'y' ]]; then
echo "iptables -A OPENVPN_INSTALL_FORWARD -d $VPN_SUBNET_IPV4/24 -j ACCEPT" echo "iptables -A OPENVPN_INSTALL_FORWARD -d $VPN_SUBNET_IPV4/24 -j ACCEPT"
fi fi
@@ -3740,9 +3748,11 @@ verb 3"
if [[ $CLIENT_IPV4 == 'y' && $ROUTE_INTERNET == 'y' ]]; then if [[ $CLIENT_IPV4 == 'y' && $ROUTE_INTERNET == 'y' ]]; then
echo "remove_rule iptables -t nat -D POSTROUTING -s $VPN_SUBNET_IPV4/24 -o $NIC -j MASQUERADE" echo "remove_rule iptables -t nat -D POSTROUTING -s $VPN_SUBNET_IPV4/24 -o $NIC -j MASQUERADE"
fi fi
while IFS= read -r local_network; do if [[ $CLIENT_IPV4 == 'y' ]]; then
echo "remove_rule iptables -t nat -D POSTROUTING -s $VPN_SUBNET_IPV4/24 -d $local_network -j MASQUERADE" while IFS= read -r local_network; do
done < <(local_networks_for_family 4) echo "remove_rule iptables -t nat -D POSTROUTING -s $VPN_SUBNET_IPV4/24 -d $local_network -j MASQUERADE"
done < <(local_networks_for_family 4)
fi
echo "remove_rule iptables -F OPENVPN_INSTALL_FORWARD" echo "remove_rule iptables -F OPENVPN_INSTALL_FORWARD"
echo "remove_rule iptables -X OPENVPN_INSTALL_FORWARD" echo "remove_rule iptables -X OPENVPN_INSTALL_FORWARD"
} >>/etc/iptables/rm-openvpn-rules.sh } >>/etc/iptables/rm-openvpn-rules.sh
@@ -4942,44 +4952,8 @@ function removeOpenVPN() {
if systemctl is-active --quiet firewalld && { [[ $has_policy_manifest == 'y' && $FIREWALL_BACKEND == 'firewalld' ]] || { [[ $has_policy_manifest == 'n' ]] && firewall-cmd --list-ports | grep -q "$PORT/$PROTOCOL_BASE"; }; }; then if systemctl is-active --quiet firewalld && { [[ $has_policy_manifest == 'y' && $FIREWALL_BACKEND == 'firewalld' ]] || { [[ $has_policy_manifest == 'n' ]] && firewall-cmd --list-ports | grep -q "$PORT/$PROTOCOL_BASE"; }; }; then
run_cmd "Removing OpenVPN port from firewalld" firewall-cmd --permanent --remove-port="$PORT/$PROTOCOL_BASE" run_cmd "Removing OpenVPN port from firewalld" firewall-cmd --permanent --remove-port="$PORT/$PROTOCOL_BASE"
if [[ $has_policy_manifest == 'y' ]]; then if [[ $has_policy_manifest == 'y' ]]; then
if [[ -n $VPN_SUBNET_IPV4 ]]; then firewall-cmd --permanent --delete-policy=openvpn-egress 2>/dev/null || true
firewall-cmd --permanent --remove-rich-rule="rule priority=\"-400\" family=\"ipv4\" source address=\"$VPN_SUBNET_IPV4/24\" destination address=\"$VPN_GATEWAY_IPV4/32\" accept" 2>/dev/null || true firewall-cmd --permanent --delete-zone=openvpn-install 2>/dev/null || true
while IFS= read -r local_network; do
firewall-cmd --permanent --remove-rich-rule="rule priority=\"-300\" family=\"ipv4\" source address=\"$VPN_SUBNET_IPV4/24\" destination address=\"$local_network\" accept" 2>/dev/null || true
firewall-cmd --permanent --remove-rich-rule="rule family=\"ipv4\" source address=\"$VPN_SUBNET_IPV4/24\" destination address=\"$local_network\" masquerade" 2>/dev/null || true
done < <(local_networks_for_family 4)
if [[ $CLIENT_IPV4 == 'y' && $CLIENT_TO_CLIENT == 'y' ]]; then
firewall-cmd --permanent --remove-rich-rule="rule priority=\"-300\" family=\"ipv4\" source address=\"$VPN_SUBNET_IPV4/24\" destination address=\"$VPN_SUBNET_IPV4/24\" accept" 2>/dev/null || true
fi
if [[ $CLIENT_IPV4 == 'y' && $ROUTE_INTERNET == 'y' ]]; then
for protected_network in "${PROTECTED_IPV4_NETWORKS[@]}"; do
firewall-cmd --permanent --remove-rich-rule="rule priority=\"-200\" family=\"ipv4\" source address=\"$VPN_SUBNET_IPV4/24\" destination address=\"$protected_network\" reject" 2>/dev/null || true
done
firewall-cmd --permanent --remove-rich-rule="rule priority=\"-100\" family=\"ipv4\" source address=\"$VPN_SUBNET_IPV4/24\" accept" 2>/dev/null || true
firewall-cmd --permanent --remove-rich-rule="rule family=\"ipv4\" source address=\"$VPN_SUBNET_IPV4/24\" masquerade" 2>/dev/null || true
else
firewall-cmd --permanent --remove-rich-rule="rule priority=\"-100\" family=\"ipv4\" source address=\"$VPN_SUBNET_IPV4/24\" reject" 2>/dev/null || true
fi
fi
if [[ $CLIENT_IPV6 == 'y' ]]; then
firewall-cmd --permanent --remove-rich-rule="rule priority=\"-400\" family=\"ipv6\" source address=\"${VPN_SUBNET_IPV6}/112\" destination address=\"$VPN_GATEWAY_IPV6/128\" accept" 2>/dev/null || true
while IFS= read -r local_network; do
firewall-cmd --permanent --remove-rich-rule="rule priority=\"-300\" family=\"ipv6\" source address=\"${VPN_SUBNET_IPV6}/112\" destination address=\"$local_network\" accept" 2>/dev/null || true
firewall-cmd --permanent --remove-rich-rule="rule family=\"ipv6\" source address=\"${VPN_SUBNET_IPV6}/112\" destination address=\"$local_network\" masquerade" 2>/dev/null || true
done < <(local_networks_for_family 6)
if [[ $CLIENT_TO_CLIENT == 'y' ]]; then
firewall-cmd --permanent --remove-rich-rule="rule priority=\"-300\" family=\"ipv6\" source address=\"${VPN_SUBNET_IPV6}/112\" destination address=\"${VPN_SUBNET_IPV6}/112\" accept" 2>/dev/null || true
fi
if [[ $ROUTE_INTERNET == 'y' ]]; then
for protected_network in "${PROTECTED_IPV6_NETWORKS[@]}"; do
firewall-cmd --permanent --remove-rich-rule="rule priority=\"-200\" family=\"ipv6\" source address=\"${VPN_SUBNET_IPV6}/112\" destination address=\"$protected_network\" reject" 2>/dev/null || true
done
firewall-cmd --permanent --remove-rich-rule="rule priority=\"-100\" family=\"ipv6\" source address=\"${VPN_SUBNET_IPV6}/112\" accept" 2>/dev/null || true
firewall-cmd --permanent --remove-rich-rule="rule family=\"ipv6\" source address=\"${VPN_SUBNET_IPV6}/112\" masquerade" 2>/dev/null || true
else
firewall-cmd --permanent --remove-rich-rule="rule priority=\"-100\" family=\"ipv6\" source address=\"${VPN_SUBNET_IPV6}/112\" reject" 2>/dev/null || true
fi
fi
else else
# Compatibility with installations created before policy manifests. # Compatibility with installations created before policy manifests.
run_cmd "Removing masquerade from firewalld" firewall-cmd --permanent --remove-masquerade run_cmd "Removing masquerade from firewalld" firewall-cmd --permanent --remove-masquerade
test/server-entrypoint.sh
+28 -18
View File
@@ -776,20 +776,43 @@ echo "Verifying OpenVPN server..."
echo "Verifying firewall rules..." echo "Verifying firewall rules..."
if systemctl is-active --quiet firewalld; then if systemctl is-active --quiet firewalld; then
echo "firewalld detected, checking scoped policy rules..." echo "firewalld detected, checking scoped policy rules..."
if ! firewall-cmd --get-policies | grep -qw openvpn-egress; then
echo "FAIL: firewalld OpenVPN policy is missing"
exit 1
fi
if ! firewall-cmd --zone=openvpn-install --query-source="$VPN_SUBNET_IPV4/24"; then
echo "FAIL: firewalld OpenVPN source zone is missing"
exit 1
fi
if [ "$(firewall-cmd --permanent --policy=openvpn-egress --get-target)" != "DROP" ]; then
echo "FAIL: firewalld OpenVPN policy does not default to DROP"
exit 1
fi
FIREWALLD_POLICY_RULES=$(firewall-cmd --policy=openvpn-egress --list-rich-rules)
if [ "$ROUTE_INTERNET" = "y" ]; then if [ "$ROUTE_INTERNET" = "y" ]; then
if firewall-cmd --list-rich-rules | grep -q "source address=\"$VPN_SUBNET_IPV4/24\" masquerade"; then if grep -q 'family="ipv4" masquerade' <<<"$FIREWALLD_POLICY_RULES"; then
echo "PASS: firewalld has source-scoped internet NAT" echo "PASS: firewalld has policy-scoped internet NAT"
else else
echo "FAIL: firewalld source-scoped internet NAT is missing" echo "FAIL: firewalld policy-scoped internet NAT is missing"
firewall-cmd --list-rich-rules printf '%s\n' "$FIREWALLD_POLICY_RULES"
exit 1 exit 1
fi fi
if grep -q 'destination address="10.0.0.0/8" reject' <<<"$FIREWALLD_POLICY_RULES"; then
echo "PASS: firewalld private-network isolation is configured"
else
echo "FAIL: firewalld private-network isolation is missing"
printf '%s\n' "$FIREWALLD_POLICY_RULES"
exit 1
fi
fi
if [ "$CLIENT_TO_CLIENT" = "y" ] && ! firewall-cmd --zone=openvpn-install --query-forward; then
echo "FAIL: firewalld client-to-client forwarding is missing"
exit 1
fi fi
if firewall-cmd --query-masquerade 2>/dev/null; then if firewall-cmd --query-masquerade 2>/dev/null; then
echo "FAIL: firewalld zone-wide masquerade should not be enabled" echo "FAIL: firewalld zone-wide masquerade should not be enabled"
exit 1 exit 1
fi fi
# Verify port is open
if firewall-cmd --list-ports | grep -q "1194/udp"; then if firewall-cmd --list-ports | grep -q "1194/udp"; then
echo "PASS: OpenVPN port is open in firewalld" echo "PASS: OpenVPN port is open in firewalld"
else else
@@ -797,19 +820,6 @@ if systemctl is-active --quiet firewalld; then
firewall-cmd --list-ports firewall-cmd --list-ports
exit 1 exit 1
fi fi
if [ "$ROUTE_INTERNET" = "y" ]; then
# Private destinations, including the VPN pool, stay isolated unless explicitly allowed.
if firewall-cmd --list-rich-rules | grep -q "destination address=\"10.0.0.0/8\" reject"; then
echo "PASS: firewalld private-network isolation is configured"
else
echo "FAIL: firewalld private-network isolation is missing"
firewall-cmd --list-rich-rules
exit 1
fi
elif ! firewall-cmd --list-rich-rules | grep -q "source address=\"$VPN_SUBNET_IPV4/24\" reject"; then
echo "FAIL: firewalld split-tunnel default reject is missing"
exit 1
fi
elif systemctl is-active --quiet nftables; then elif systemctl is-active --quiet nftables; then
# nftables mode - verify OpenVPN tables exist # nftables mode - verify OpenVPN tables exist
echo "nftables detected, checking OpenVPN tables..." echo "nftables detected, checking OpenVPN tables..."