f1r_CTLF f1r-CTLF
f1r-CTLF
/ set-ovpn-firewall.sh
Last active
November 9, 2024 13:53
Basic, hardened iptables + ip6tables firewall script for an OpenVPN 2.3.x server running dnscrypt-proxy and unbound for DNS. Designed with security testing in mind. Supports dual-stack IPv4 + IPv6. Hardens against many common attacks, and implements strict filtering of DHCP, ICMPv6, and DHCPv6. Tested on Arch Linux; most Linux should work, also.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/bin/bash | |
| echo ' (pre) script declarations' | |
| IP6TABLES='/sbin/ip6tables' | |
| IP4TABLES='/sbin/iptables' | |
| LAN_IF='ens+' | |
| TUN_IF='tun+' | |
| INNER_GLOBAL_UNICAST='2001:0db8:ffff:ffff::/48' | |
| INNER_IPV4_UNICAST='10.8.0.0/24' | |
| IPV4_LINK_LOCAL='169.254.0.0/16' #RFC 3927 | |
| IPV6_LINK_LOCAL='fe80::/10' #RFC 4291 |