# Shorewall and VPN gateway
Tutorial for setting up an IP tunnel gateway from cjdns to clearnet, using a VPN and Shorewall.

* From: https://wiki.projectmeshnet.org/Gateway_server_howto

## General
* Close any open ports also on IPv6, e.g.:
 `ip6tables -A INPUT -i tun0 -p tcp --destination-port 22 -j REJECT`

## VPN
Connect to a VPN provider (I used mullvad.net). Make sure you can pay with bitcoins. Recommended connection: OpenVPN.

## Firewall (Shorewall)
### Interfaces
```
 #ZONE INTERFACE BROADCAST OPTIONS
 net eth0 detect routefilter,dhcp,tcpflags,logmartians,nosmurfs
 cjdns tun0 detect routefilter,dhcp,tcpflags,logmartians,nosmurfs
 vpn tun1 detect routefilter,dhcp,tcpflags,logmartians,nosmurfs
```
### Zones
```
 #ZONE   TYPE    OPTIONS                 IN                      OUT
 #                                       OPTIONS                 OPTIONS
 fw      firewall
 net     ipv4
 cjdns   ipv4
 vpn     ipv4
```
### Policy
```
 #SOURCE         DEST            POLICY          LOG LEVEL       LIMIT:BURST
 $FW             net             ACCEPT
 $FW             vpn             ACCEPT
 cjdns		vpn		ACCEPT
 vpn		cjdns		DROP		info
 net             $FW             DROP            info
 vpn             $FW             DROP            info
 cjdns		$FW		DROP		info
 $FW		cjdns		DROP		info
 net             all             DROP            info
 # The FOLLOWING POLICY MUST BE LAST
 all             all             REJECT          info
```
### Rules
```
 #ACTION         SOURCE                  DEST            PROTO   DEST
 #                                                       PORT
 # Cjdns over vpn:
 ACCEPT          vpn                     $FW             udp     31777
 # ping
 ACCEPT          net                     $FW             icmp    8
 # Reject Ping from the "bad" net zone.. and prevent your log from being flooded..
 Ping/REJECT     net                     $FW
 # Permit all ICMP traffic FROM the firewall TO the net zone
 ACCEPT          $FW                     net             icmp
 ACCEPT          $FW                     cjdns           icmp
 ACCEPT          cjdns                   $FW             icmp
```
## Networking
Give an IPV4 address to the server side of the cjdns tunnel:

 `ip addr add 10.42.0.3/32 dev tun0`

Add route to each client side of the cjdns tunnel:

 `ip route add 10.42.42.42 via 10.42.0.3 dev tun0`

Set forwarding on:

 `echo 1 > /proc/sys/net/ipv4/conf/all/forwarding`

Add vpn address:

 `route add $VPN_ENTRY_ADDRESS gateway $SERVER_REAL_ADDRESS`

The default gw for the clients (to vpn):

 `ip addr add 10.42.0.1/32 dev tun1`

Masquerading (NAT):

 `iptables -t nat -A POSTROUTING -o tun1 -j MASQUERADE`

Remove original gateway:
```
 GW=`route -n | grep ^0.0.0.0 | awk -F ' ' '{ print $2 }'`
 route del default gw $GW
```
Use DNS server from VPN provider to avoid leaks:
 `cp /etc/resolv.conf.vpn /etc/resolv.conf`

## Add user


For convenience, I check the last 20 characters of the public key (not including .k) e.g.:
 ```
 publicKey="lsvf85b3bg9fwy74sdlbqyhlt5n7w32s4m1mwsxggjx5kfzfk120.k"
 NODE=${publicKey: -22:22}
 echo $NODE
 4m1mwsxggjx5kfzfk120.k
```
And I use it as part of the password added to cjdroute.conf under "authorizedPasswords":
 `{"password":"4m1mwsxggjx5kfzfk120.k.foobarpassword"},`

And under `ipTunnel` `allowedConnections`:
```
 {
   "publicKey": "lsvf85b3bg9fwy74sdlbqyhlt5n7w32s4m1mwsxggjx5kfzfk120.k",
   "ip4Address": "10.42.something.else",
 },
```
## Quota

Add a user
```
 # Check if chain exists
 iptables -L | grep $NODE && exit 0
 # Add the user
 iptables -N $NODE
 iptables -I cjdns2vpn 1 -s $IP -j $NODE
 iptables -I vpn2cjdns 1 -d $IP -j $NODE
 iptables -I $NODE 1 -j DROP
 iptables -I $NODE 1 -m quota --quota $QUOTA -j ACCEPT
```
Delete a user:
```
 # Check if chain exists
 iptables -L | grep $NODE || exit 0
 # Delete the user
 iptables -D $NODE -j DROP
 iptables -D $NODE -m quota --quota $QUOTA -j ACCEPT
 iptables -D cjdns2vpn -s $IP -j $NODE
 iptables -D vpn2cjdns -d $IP -j $NODE
 iptables -X $NODE
```
Reset user's quota:
 `iptables -R $NODE 1 -m quota --quota $QUOTA -j ACCEPT`