Feedback Firewall / kill switch for single board computers

[AtramentousFlux]

The official Oeck app includes killswitch functionality, which is great, however the app won't run on everything.

I use Oeck on an odroid c1+ running linux for downloading and wanted the same function when using a downloaded .ovpn file.

An easy way is to run a script as root that sets up custom iptables rules before connecting the VPN:

#!/bin/bash
iptables --flush
iptables --delete-chain
iptables -t nat --flush
iptables -t nat --delete-chain
iptables -P OUTPUT DROP
iptables -A INPUT -j ACCEPT -i lo
iptables -A OUTPUT -j ACCEPT -o lo
iptables -A INPUT -j ACCEPT -s 192.168.0.0/16 -i eth0
iptables -A OUTPUT -j ACCEPT -d 192.168.0.0/16 -o eth0
iptables -A OUTPUT -m iprange --dst-range 213.152.174.176-213.152.174.190 -j ACCEPT -o eth0 -p udp -m udp --dport 1196
iptables -A INPUT -m iprange --src-range 213.152.174.176-213.152.174.190 -j ACCEPT -i eth0 -p udp -m udp --sport 1196
iptables -A INPUT -j ACCEPT -i tun0
iptables -A OUTPUT -j ACCEPT -o tun0

This one is hardcoded for my local LAN (192.168.0.x), network interface (eth0) and the Oeck torrent region. Note that you'll lose LAN connectivity to the device if your local LAN and network are not explicitly allowed. The INPUT rules are really overkill, as it's only outgoing traffic that needs to be forced over the tun interface for security, but meh. If the VPN connection is lost, no traffic can pass to or from the un-VPN'd internet.

The custom rules will be lost on reboot, which is what I want, as I use other VPNs on this machine. They can be made permanent of course.

One further thing I did need to do on this particular machine was to disable IPV6 in order to get Oeck to connect. I did that by adding:

net.ipv6.conf.all.disable_ipv6 = 0
net.ipv6.conf.default.disable_ipv6 = 0
net.ipv6.conf.lo.disable_ipv6 = 0

to /etc/sysctl.conf and running sysctl -p as root.

 

[AtramentousFlux]

Oops - can't edit. Doing the above last bit enables IPV6 of course, not disables it.