Something strange happened just now, im trying to figure out how exactly did it happen. On my server I was suddely able to bypass my VPN! I looked around what did happened and found that my VPN service had sent me an email that my subscription expired. What is strange is that I have ufw rules like
To Action From
[VPN server] ALLOW OUT Anywhere
Anywhere ALLOW OUT Anywhere on tun0
So it should be not allowed to access the internet outside of tun0. Why exactly did it happen? Does the VPN service change iptables or something? Any ideas? I was able to ping, wget, even surf on w3m. The thing is that when I rebooted the server, nothing could connect outside the tunnel, as it should be. Here is the whole ufw table.
Status: active
Logging: on (low)
Default: deny (incoming), deny (outgoing), disabled (routed)
New profiles: skip
To Action From
-- ------ ----
22/tcp ALLOW IN 192.168.1.0/24
53 ALLOW IN 192.168.1.0/24
80 ALLOW IN 192.168.1.0/24
9091 ALLOW IN 192.168.1.0/24 # Transmission
2049 ALLOW IN 192.168.1.0/24 # nfs
[VPN server] ALLOW OUT Anywhere
Anywhere ALLOW OUT Anywhere on tun0
192.168.2.77 22 ALLOW OUT Anywhere
2049 ALLOW OUT Anywhere # nfs
So how in the world did my VPN company do something to bypass my ufw??? Or was it something else completely?
TIA
I've had experiences with certain software manipulating iptables behind ufw and those changes do not show up when I viewed ufw's status.
Docker is a well known example of this. Simply searching
docker ufwin a search engine will bring up this issue immediately. I've also had experiences with cloudflared (the program used for cloudflare's tunnel service) manipulating iptables behind ufw as well.It's possible the vpn is doing something similar.
I'm beginning to learn to check iptables as well when it comes to troubleshooting network issues.