This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision | ||
vpn-rpi4 [2020/04/30 08:58] robm [Setup] |
vpn-rpi4 [2021/04/25 20:13] robm Reduce dropped INPUT traffic to just DHCP (was also blocking ARP requests, so my wired side would never find the MAC address of the Raspberry Pi) |
||
---|---|---|---|
Line 6: | Line 6: | ||
* '' | * '' | ||
* CIDR: '' | * CIDR: '' | ||
+ | * DHCP range: '' | ||
* Gateway / router: '' | * Gateway / router: '' | ||
Line 18: | Line 19: | ||
* ... via home network when it is now | * ... via home network when it is now | ||
+ | ===== Strategy ===== | ||
+ | |||
+ | Create a new WiFi network ('' | ||
+ | |||
+ | The Raspberry Pi itself gets its internet connection via the wired network - i.e. it uses the same router as other wired hosts (192.168.167.1). | ||
+ | |||
+ | DHCP requests from the WiFi network will be answered by the Raspberry Pi (using '' | ||
+ | |||
+ | - Prevent DHCP requests from WiFi stations being answered by home network | ||
+ | - Prevent DHCP requests from wired network being answered by Raspberry Pi | ||
+ | |||
+ | The Raspberry Pi itself will not ask for IP addresses from the wired network. This keeps things simple, as the only IP on the Raspberry Pi will be on the bridge interface and it will be entirely predictable so we can embed it into the DHCP offers we give out (i.e. write it into ''/ | ||
+ | |||
+ | The Raspberry Pi's DHCP offers will nominate itself as the gateway (i.e. default route) and DNS server. It will have to perform Network Address Translation (" | ||
+ | |||
+ | ExpressVPN also tunnels DNS traffic, and *blocks* attempts to use DNS other than its own. This is a good thing, but I cannot get ExpressVPN and '' | ||
===== Setup ===== | ===== Setup ===== | ||
Line 46: | Line 63: | ||
# wired connection (we want to be the ones to answer DHCP requests, not our | # wired connection (we want to be the ones to answer DHCP requests, not our | ||
# ISP) | # ISP) | ||
- | up | + | |
- | down ebtables -t filter -D FORWARD --protocol | + | # UDP port 68: BOOTP client |
+ | | ||
+ | down ebtables -t filter -D FORWARD --protocol | ||
# Ethernet Bridging: Be deaf to DHCP requests originating on the wired | # Ethernet Bridging: Be deaf to DHCP requests originating on the wired | ||
# connection (home network), we are not their DHCP server. (.. and dnsmasq | # connection (home network), we are not their DHCP server. (.. and dnsmasq | ||
# cannot distinguish the source, as it all appears to be coming from br0) | # cannot distinguish the source, as it all appears to be coming from br0) | ||
- | up | + | |
- | down ebtables -t filter -D INPUT -d FF: | + | # UDP port 68: BOOTP client |
+ | | ||
+ | down ebtables -t filter -D INPUT --protocol IPv4 --ip-protocol UDP --ip-destination-port 67:68 -i eth0 -j DROP | ||
# Internet Protocol Network Address Translation when using this bridge, and | # Internet Protocol Network Address Translation when using this bridge, and |