Something strange happened just now, im trying to figure out how exactly did it happen. On my server I was suddely able to bypass my VPN! I looked around what did happened and found that my VPN service had sent me an email that my subscription expired. What is strange is that I have ufw rules like
To Action From
[VPN server] ALLOW OUT Anywhere
Anywhere ALLOW OUT Anywhere on tun0
So it should be not allowed to access the internet outside of tun0. Why exactly did it happen? Does the VPN service change iptables or something? Any ideas? I was able to ping, wget, even surf on w3m. The thing is that when I rebooted the server, nothing could connect outside the tunnel, as it should be. Here is the whole ufw table.
Status: active
Logging: on (low)
Default: deny (incoming), deny (outgoing), disabled (routed)
New profiles: skip
To Action From
-- ------ ----
22/tcp ALLOW IN 192.168.1.0/24
53 ALLOW IN 192.168.1.0/24
80 ALLOW IN 192.168.1.0/24
9091 ALLOW IN 192.168.1.0/24 # Transmission
2049 ALLOW IN 192.168.1.0/24 # nfs
[VPN server] ALLOW OUT Anywhere
Anywhere ALLOW OUT Anywhere on tun0
192.168.2.77 22 ALLOW OUT Anywhere
2049 ALLOW OUT Anywhere # nfs
So how in the world did my VPN company do something to bypass my ufw??? Or was it something else completely?
TIA
Did you run a traceroute before rebooting?
Sounds like your VPN software does some wacky stuff with IPtables. Personally, I'd switch to the native Wireguard client, and use iptables to block outbound.