Using UFW to Restrict VPN Access to Specific IPs

UFW is a simple and user-friendly front-end for managing iptables firewall rules on Linux systems. It is designed to be easy to use for beginners while still providing the flexibility needed for more advanced configurations. When used correctly, UFW helps to secure your server from unauthorized access while maintaining necessary functionality.

Setting Up UFW for VPN Access Control

Before you can restrict VPN access using UFW, you need to have a VPN server already set up on your system. In this guide, we’ll assume you are using OpenVPN, but the steps can be adapted for other VPN solutions.

Install and Enable UFW

If UFW is not already installed, it can be easily installed on a system using the following command:
sudo apt-get install ufw
Once installed, enable UFW to start managing your firewall:
sudo ufw enable

Allow VPN Service

First, allow incoming connections for your VPN service. For OpenVPN, the default port is 1194, and you can allow traffic on this port using the following command:
sudo ufw allow 1194/udp
Replace 1194/udp with the appropriate port if you’re using a different VPN service.

Restrict VPN Access to Specific IP Addresses

Now that your VPN is accessible, the next step is to restrict access to only a set of trusted IP addresses. This can be done using UFW’s rich rule-set, where you can define specific IP addresses that are allowed to access your VPN.

Adding Specific IPs

You can use UFW to specify which IP addresses are allowed to access the VPN server by adding rules. Let’s assume you want to allow access from two specific IP addresses, 192.168.1.10 and 203.0.113.15.
Use the following commands to allow these IPs:
sudo ufw allow from 192.168.1.10 to any port 1194 proto udp
sudo ufw allow from 203.0.113.15 to any port 1194 proto udp
These commands tell UFW to allow only the specified IP addresses to access the VPN service on port 1194.

Deny All Other IPs

By default, UFW will deny all incoming connections unless explicitly allowed. However, it’s a good practice to ensure that access to the VPN is completely restricted for all other IP addresses. This can be done by adding a deny rule:
sudo ufw deny 1194/udp
This rule ensures that only the specified IP addresses are able to connect to your VPN on port 1194, and all other IPs will be blocked.

Testing and Verifying the Configuration

Once the rules are in place, you should test the configuration to ensure that only the authorized IP addresses can connect to the VPN. From an authorized machine (using one of the allowed IPs), try to connect to the VPN. If everything is set up correctly, the connection should succeed.
Next, from a machine with a non-authorized IP address, attempt to connect to the VPN. The connection should fail, confirming that your UFW configuration is working as expected.

Checking UFW Status

To view your current UFW rules and ensure that your restrictions are properly in place, you can use:
sudo ufw status verbose
This will display a list of all active firewall rules, including the allowed IP addresses for your VPN service.

Logging VPN Access Attempts

To monitor access attempts to your VPN server, you can enable UFW logging. This will log all blocked access attempts to /var/log/ufw.log.
Enable logging with the following command:
sudo ufw logging on
You can then check the logs for denied access attempts:
sudo tail -f /var/log/ufw.log
This will show any blocked attempts in real time, allowing you to track unauthorized connection attempts.

Further Configuration Options

While restricting VPN access to specific IPs is an effective security measure, there are additional configuration options you can consider for enhanced protection.

Rate Limiting

To protect against brute force attacks, UFW allows you to limit the number of connection attempts to your VPN. For instance, to limit connections to 3 per minute, use the following rule:
sudo ufw limit 1194/udp
This will ensure that anyone attempting to brute force the VPN service will be limited to only 3 attempts per minute, providing additional protection.

Access Control Based on Subnets

Instead of specifying individual IP addresses, you can also limit access based on entire subnets. For example, to allow an entire subnet, such as 192.168.1.0/24, to access your VPN, use:
sudo ufw allow from 192.168.1.0/24 to any port 1194 proto udp
This would allow all devices within the 192.168.1.0/24 subnet to connect to your VPN service.

Conclusion

By using UFW to restrict VPN access to specific IP addresses, you add an additional layer of security to your VPN service. This simple configuration ensures that only trusted IPs can connect to your server, while blocking all other access.