How to set up UFW on a server where I only use OpenVPN?

X

xutegino2017-09-18 15:57:56

linux

xutegino, 2017-09-18 15:57:56

I have an Ubuntu 16.04 server. I have an OpenVPN server running on it.
I want to configure UFW to disallow everything except OpenVPN (well, SSH).
At first I just turned it on and could not connect via VPN. Therefore, I added the VPN port to the exceptions.
I completed sudo ufw allow 1194
My status:

Status: active

To                         Action      From
--                         ------      ----
OpenSSH                    ALLOW       Anywhere                  
1194                       ALLOW       Anywhere                  
OpenSSH (v6)               ALLOW       Anywhere (v6)             
1194 (v6)                  ALLOW       Anywhere (v6)

Pages in the browser still do not open. I thought maybe I should also add port 80. I added it sudo ufw allow 80
. The pages still don't open.
What ports need to be opened, how to configure everything? So that I can freely use the Internet with VPN and do not worry that something is not working or someone will get into the server.

Reply

Answer the question

In order to leave comments, you need to log in

1 answer(s)

A

Anton Kuzmichev, 2017-09-18
@xutegino

Look at the OpenVPN setup here
. You most likely have the reason that you need to allow the udp protocol:
I have the following ufw ports open on my VPS with OpenVPN:

$ sudo ufw status
Status: active

To                         Action      From
--                         ------      ----
OpenSSH                    ALLOW       Anywhere                  
443/tcp                    ALLOW       Anywhere                  
443/udp                    ALLOW       Anywhere                  
XXX22/tcp                  ALLOW       Anywhere                  
XXX22/udp                  ALLOW       Anywhere                  
1194/udp                   ALLOW       Anywhere                  
OpenSSH (v6)               ALLOW       Anywhere (v6)             
443/tcp (v6)               ALLOW       Anywhere (v6)             
443/udp (v6)               ALLOW       Anywhere (v6)             
XXX22/tcp (v6)             ALLOW       Anywhere (v6)             
XXX22/udp (v6)             ALLOW       Anywhere (v6)             
1194/udp (v6)              ALLOW       Anywhere (v6)

But in addition to ports, there is another point with ufw (with the file /etc/ufw/before.rules), which is described in the article by reference.