Something strange happened just now, im trying to figure out how exactly did it happen. On my server I was suddely able to bypass my VPN! I looked around what did happened and found that my VPN service had sent me an email that my subscription expired. What is strange is that I have ufw rules like

To                         Action      From

[VPN server]               ALLOW OUT   Anywhere                  
Anywhere                   ALLOW OUT   Anywhere on tun0

So it should be not allowed to access the internet outside of tun0. Why exactly did it happen? Does the VPN service change iptables or something? Any ideas? I was able to ping, wget, even surf on w3m. The thing is that when I rebooted the server, nothing could connect outside the tunnel, as it should be. Here is the whole ufw table.

Status: active
Logging: on (low)
Default: deny (incoming), deny (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    192.168.1.0/24            
53                         ALLOW IN    192.168.1.0/24            
80                         ALLOW IN    192.168.1.0/24            
9091                       ALLOW IN    192.168.1.0/24              # Transmission
2049                       ALLOW IN    192.168.1.0/24              # nfs

[VPN server]               ALLOW OUT   Anywhere                  
Anywhere                   ALLOW OUT   Anywhere on tun0          
192.168.2.77 22            ALLOW OUT   Anywhere                  
2049                       ALLOW OUT   Anywhere                   # nfs

So how in the world did my VPN company do something to bypass my ufw??? Or was it something else completely?

TIA

  • fmstrat@lemmy.nowsci.com
    link
    fedilink
    English
    arrow-up
    0
    ·
    2 days ago

    Did you run a traceroute before rebooting?

    Sounds like your VPN software does some wacky stuff with IPtables. Personally, I’d switch to the native Wireguard client, and use iptables to block outbound.