Firewall - LAN Traffic enabled - Iptables local subnet missing after system start

[ivpn]

Firewall - LAN Traffic enabled - Iptables local subnet missing after system start

[stenya]

Thanks, @m4rkv5 . We are preparing a new release for Linux (it will also include the fix you requested).

[stenya]

@m4rkv5 The issue is fixed in v3.3.7.
Feel free to reopen the ticket if you still have problems with it.

[m4rkv5]

When I restart the systemd service the problem get's fixed. Maybe the iptables are set before DHCP gets my local subnet ip adress?

~
❯ ivpn status
VPN : CONNECTED
xx
xx
Protocol : OpenVPN
Local IP : xx
Server IP : xx
Connected : 2021-03-15 xx
AntiTracker : Enabled
Firewall : Enabled
Allow LAN : true
Persistent :true

Tips:
ivpn disconnect Stop current VPN connection

~
❯ sudo iptables --list
Chain INPUT (policy DROP)
target prot opt source destination
NFQUEUE udp -- anywhere anywhere udp spt:domain NFQUEUE num 0 bypass
IVPN-IN all -- anywhere anywhere

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy DROP)
target prot opt source destination
IVPN-OUT all -- anywhere anywhere

Chain IVPN-IN (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT udp -- anywhere anywhere udp dpt:bootpc
IVPN-IN-VPN all -- anywhere anywhere
IVPN-IN-STAT-EXP all -- anywhere anywhere
IVPN-IN-ICMP-EXP all -- anywhere anywhere

Chain IVPN-IN-ICMP-EXP (1 references)
target prot opt source destination

Chain IVPN-IN-STAT-EXP (1 references)
target prot opt source destination
ACCEPT all -- base-address.mcast.net/4 anywhere
ACCEPT all -- base-address.mcast.net/4 anywhere

Chain IVPN-IN-VPN (1 references)
target prot opt source destination
ACCEPT all -- xx anywhere
ACCEPT all -- anywhere anywhere

Chain IVPN-OUT (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT udp -- anywhere anywhere udp dpt:bootps
IVPN-OUT-VPN all -- anywhere anywhere
IVPN-OUT-STAT-EXP all -- anywhere anywhere
IVPN-OUT-ICMP-EXP all -- anywhere anywhere

Chain IVPN-OUT-ICMP-EXP (1 references)
target prot opt source destination

Chain IVPN-OUT-STAT-EXP (1 references)
target prot opt source destination
ACCEPT all -- anywhere base-address.mcast.net/4
ACCEPT all -- anywhere base-address.mcast.net/4

Chain IVPN-OUT-VPN (1 references)
target prot opt source destination
ACCEPT all -- anywhere xx
ACCEPT all -- anywhere anywhere

~
❯ systemctl restart ivpn-service

~ took 11s
❯ ivpn status
VPN : DISCONNECTED
Firewall : Enabled
Allow LAN : true
Persistent :true

~
❯ vpnc
WARNING: filtering flags are ignored for Multi-Hop connection [exit_svr]
[OpenVPN] Connecting Multi-Hop...
entry server: xx
exit server : xx
Connecting...
VPN : CONNECTED
xx
xx
Protocol : OpenVPN
Local IP : xx
Server IP : xx
Connected : xx
AntiTracker : Enabled
Firewall : Enabled
Allow LAN : true
Persistent :true

Tips:
ivpn disconnect Stop current VPN connection

~
❯ sudo iptables --list
Chain INPUT (policy DROP)
target prot opt source destination
NFQUEUE udp -- anywhere anywhere udp spt:domain NFQUEUE num 0 bypass
IVPN-IN all -- anywhere anywhere

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy DROP)
target prot opt source destination
IVPN-OUT all -- anywhere anywhere

Chain IVPN-IN (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT udp -- anywhere anywhere udp dpt:bootpc
IVPN-IN-VPN all -- anywhere anywhere
IVPN-IN-STAT-EXP all -- anywhere anywhere
IVPN-IN-ICMP-EXP all -- anywhere anywhere

Chain IVPN-IN-ICMP-EXP (1 references)
target prot opt source destination

Chain IVPN-IN-STAT-EXP (1 references)
target prot opt source destination
ACCEPT all -- base-address.mcast.net/4 anywhere
ACCEPT all -- base-address.mcast.net/4 anywhere
ACCEPT all -- 192.168.178.0/24 anywhere
ACCEPT all -- base-address.mcast.net/4 anywhere
ACCEPT all -- 192.168.178.0/24 anywhere
ACCEPT all -- base-address.mcast.net/4 anywhere

Chain IVPN-IN-VPN (1 references)
target prot opt source destination
ACCEPT all -- xx anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- xx anywhere
ACCEPT all -- anywhere anywhere

Chain IVPN-OUT (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT udp -- anywhere anywhere udp dpt:bootps
IVPN-OUT-VPN all -- anywhere anywhere
IVPN-OUT-STAT-EXP all -- anywhere anywhere
IVPN-OUT-ICMP-EXP all -- anywhere anywhere

Chain IVPN-OUT-ICMP-EXP (1 references)
target prot opt source destination

Chain IVPN-OUT-STAT-EXP (1 references)
target prot opt source destination
ACCEPT all -- anywhere base-address.mcast.net/4
ACCEPT all -- anywhere base-address.mcast.net/4
ACCEPT all -- anywhere 192.168.178.0/24
ACCEPT all -- anywhere base-address.mcast.net/4
ACCEPT all -- anywhere 192.168.178.0/24
ACCEPT all -- anywhere base-address.mcast.net/4

Chain IVPN-OUT-VPN (1 references)
target prot opt source destination
ACCEPT all -- anywhere xx
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere xx
ACCEPT all -- anywhere anywhere

~
❯

[m4rkv5]

As workaround I installed a login script:
#!/bin/bash
ivpn firewall -lan_block
ivpn firewall -lan_allow