WIP: openvpn

services/basic/global.policy.json

@@ -1,11 +1,16 @@
 {
     "description": "Restrict all internet access",
-    "variable": { "internet_if": "eth0" },
     "zone": {
-        "internet": { "iface": "$internet_if" }
+        "WAN": { "iface": "eth0" },
+        "LAN": { "iface": "eth1" },
+        "VPN": { "iface": "tun+" }
     },
     "policy": [
-        { "in": "internet", "action": "drop" },
+        { "in": "VPN", "action": "accept" },
+        { "out": "VPN", "action": "accept" },
+        { "in": "LAN", "action": "accept" },
+        { "out": "LAN", "action": "accept" },
+        { "in": "WAN", "action": "drop" },
         { "action": "reject" }
     ]
 }

services/basic/icmp.policy.json

@@ -2,7 +2,8 @@
     "description": "Allow ping-pong",
     "filter": [
         {
-            "in": "internet",
+            "in": "WAN",
+            "out": "_fw",
             "service": "ping",
             "action": "accept",
             "flow-limit": { "count": 10, "interval": 6 }

services/basic/outgoing.policy.json

@@ -3,7 +3,7 @@
     "filter": [
         {
             "in": "_fw",
-            "out": "internet",
+            "out": "WAN",
             "service": ["http", "https", "dns", "ssh", "ntp", "ping"],
             "action": "accept"
         }

services/caddy/http.policy.json

@@ -2,7 +2,7 @@
     "description": "Allow incoming http (TCP 80 & 443) ports",
     "filter": [
         {
-            "in": "internet",
+            "in": "WAN",
             "out": "_fw",
             "service": ["http", "https"],
             "action": "accept"

services/openvpn/config/openvpn.conf

@@ -0,0 +1,7 @@
+port 1194
+proto udp
+dev tun
+
+topology subnet
+
+# TODO

services/openvpn/install.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+echo "Setting up OpenVPN..."
+apk add openvpn
+
+rc-update add openvpn
+modprobe tun
+echo tun >> /etc/modules-load.d/tun.conf
+
+# Enable IP forwarding, persistent
+echo "net.ipv4.ip_forward=1" >> /etc/sysctl.d/ip_forward.conf
+sysctl -p /etc/sysctl.d/ip_forward.conf

services/openvpn/openvpn.policy.json

@@ -0,0 +1,14 @@
+{
+    "description": "Allow OpenVPN server access from the internet",
+    "service": {
+        "openvpn": { "port": 1194, "proto": "udp" }
+    },
+    "filter": [
+        {
+            "in": "WAN",
+            "out": "_fw",
+            "service": "openvpn",
+            "action": "accept"
+        }
+    ]
+}

services/openvpn/update.sh

@@ -0,0 +1,2 @@
+#!/bin/sh
+ln -sf ./config/openvpn.conf /etc/openvpn/openvpn.conf

services/ssh/ssh.policy.json

@@ -2,7 +2,7 @@
     "description": "Allow limited incoming SSH access (TCP/22)",
     "filter": [
         {
-            "in": "internet",
+            "in": "WAN",
             "out": "_fw",
             "service": "ssh",
             "action": "accept",