I am trying to implement a OpenVPN killswitch. My goal is for ALL traffic to be forced through the OpenVPN tun interface
++ iptables -vL -n -t filter
Chain INPUT (policy DROP 2 packets, 221 bytes)
pkts bytes target prot opt in out source destination
3064 543K ACCEPT all -- * * 10.1.3.0/24 0.0.0.0/0
65 8711 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
1200 101K ACCEPT all -- tun+ * 0.0.0.0/0 0.0.0.0/0
1380 194K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * tun+ 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy DROP 55 packets, 3821 bytes)
pkts bytes target prot opt in out source destination
3701 372K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 owner UID match 0
1397 994K ACCEPT all -- * * 0.0.0.0/0 10.1.3.0/24
67 8765 ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0
710 59654 ACCEPT all -- * tun+ 0.0.0.0/0 0.0.0.0/0
+ ip netns exec dewinetns235 ip route
custom: 0.0.0.0/1 via 188.72.101.193 dev tun0
custom: default via 10.1.3.1 dev veth1
custom: 10.1.3.0/24 dev veth1 proto kernel scope link src 10.1.3.2
custom: 128.0.0.0/1 via 188.72.101.193 dev tun0
custom: 188.72.101.192/28 dev tun0 proto kernel scope link src 188.72.101.194
custom: 188.72.101.245 via 10.1.3.1 dev veth1
I allow any user to send/receive data on the OpenVPN tun+ interface.
But only the root user can send traffic on ANY interface
I start qbittorrent-nox as dewi user - as I only want it to use the tun+ OpenVPN interface
The problem is torrents don't download.
Here is the log:
(N) 2022-01-03T22:29:30 - Using config directory: /home/dewi/.config/qBittorrent/
(I) 2022-01-03T22:29:30 - Trying to listen on: 0.0.0.0:24435,[::]:24435
(N) 2022-01-03T22:29:30 - Peer ID: -qB4390-
(N) 2022-01-03T22:29:30 - HTTP User-Agent is 'qBittorrent/4.3.9'
(I) 2022-01-03T22:29:30 - DHT support [ON]
(I) 2022-01-03T22:29:30 - Local Peer Discovery support [ON]
(I) 2022-01-03T22:29:30 - PeX support [ON]
(I) 2022-01-03T22:29:30 - Anonymous mode [OFF]
(I) 2022-01-03T22:29:30 - Encryption support [ON]
(I) 2022-01-03T22:29:30 - UPnP / NAT-PMP support [ON]
(I) 2022-01-03T22:29:30 - IP geolocation database loaded. Type: DBIP-Country-Lite. Build time: Sat Jan 1 01:11:53 2022.
(N) 2022-01-03T22:29:30 - Using built-in Web UI.
(W) 2022-01-03T22:29:30 - Couldn't load Web UI translation for selected locale (C).
(N) 2022-01-03T22:29:30 - Web UI: Now listening on IP: *, port: 8080
(I) 2022-01-03T22:29:30 - Successfully listening on IP: 127.0.0.1, port: TCP/24435
(I) 2022-01-03T22:29:30 - Successfully listening on IP: 127.0.0.1, port: UDP/24435
(I) 2022-01-03T22:29:30 - Successfully listening on IP: 10.1.3.2, port: TCP/24435
(I) 2022-01-03T22:29:30 - Successfully listening on IP: 10.1.3.2, port: UDP/24435
(I) 2022-01-03T22:29:30 - Successfully listening on IP: ::1, port: TCP/24435
(I) 2022-01-03T22:29:30 - Successfully listening on IP: ::1, port: UDP/24435
(N) 2022-01-03T22:29:30 - 'Tears of Steel' restored.
(W) 2022-01-03T22:29:31 - URL seed name lookup failed. Torrent: "Tears of Steel". URL: "https://webtorrent.io/torrents/". Error: "Tears of Steel url seed (https://webtorrent.io/torrents/) failed: Host not found (non-authoritative), try again later"
(I) 2022-01-03T22:29:31 - Successfully listening on IP: fe80::9854:c0ff:fe91:8615%veth1, port: TCP/24435
(I) 2022-01-03T22:29:31 - Successfully listening on IP: fe80::9854:c0ff:fe91:8615%veth1, port: UDP/24435
(I) 2022-01-03T22:29:38 - Successfully listening on IP: fe80::adff:cb13:634d:1de8%tun0, port: TCP/24435
(I) 2022-01-03T22:29:38 - Successfully listening on IP: fe80::adff:cb13:634d:1de8%tun0, port: UDP/24435
(I) 2022-01-03T22:29:38 - Successfully listening on IP: 188.72.101.194, port: TCP/24435
(I) 2022-01-03T22:29:38 - Successfully listening on IP: 188.72.101.194, port: UDP/24435
(N) 2022-01-03T22:29:53 - WebAPI login success. IP: ::ffff:10.1.3.1
(C) 2022-01-03T22:32:14 - UPnP/NAT-PMP: Port mapping failure, message: could not map port using UPnP: no router found
(C) 2022-01-03T22:32:14 - UPnP/NAT-PMP: Port mapping failure, message: could not map port using UPnP: no router found
(I) 2022-01-03T22:37:21 - Detected external IP: 188.72.101.194
Interesting to see the following line:
(W) 2022-01-03T22:29:31 - URL seed name lookup failed. Torrent: "Tears of Steel". URL: "https://webtorrent.io/torrents/". Error: "Tears of Steel url seed (https://webtorrent.io/torrents/) failed: Host not found (non-authoritative), try again later"
I can curl google. It manages to resolve the hostname
dewi@dewiserver:~/.local/share/qBittorrent/logs$ curl google.com
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>301 Moved</TITLE></HEAD><BODY>
<H1>301 Moved</H1>
The document has moved
<A HREF="http://www.google.com/">here</A>.
</BODY></HTML>
Setting the default ipable rules to ALLOW does not produce the above error and the torrent downloads successfully.
What is weird, when using my iptable rule restriction is that this torrent IP test works and correctly brings back my Openvpn public ip address https://torguard.net/checkmytorrentipaddress.php
0 Answers