search

NordSecurity / nordvpn-linux

NordVPN Linux client
GNU General Public License v3.0
287 stars 44 forks source link

How do to allow icmp ping from anywhere to linux with nordvpn? #344

Closed tm4ig closed 2 months ago

tm4ig commented 3 months ago

How can I to allow icmp ping from anywhere to my linux host when nordvpn connection is active? Earlier I have created issue https://github.com/NordSecurity/nordvpn-linux/issues/158 that nordvpn firewall can not be fully disabled and it have not resolved yet. Nordvpn firewall is blocking icmp even Firewall disabled option is installed. Now I want to allow icmp ping for my host where nordvpn is using. How can I to do it? I have tried nordvpn whitelist add subnet 0.0.0.0/0 command but with this setting nordvpn does not work.

mariusSincovici commented 3 months ago

hi would meshnet and nicknames be a possible option? In this way the pings would go thru the tunnel and leak.

tm4ig commented 3 months ago

I do not not use meshnet. I want that my linux host with nordvpn will be available by ping from everywhere

mariusSincovici commented 3 months ago

Then in this case you might need to play with the routing table and the firewall.

Because by default when the VPN is started, the VPN's interface will be used to send the traffic by default. Allowing packets to bypass the tunnel you'll need to have a route for a specific destination or packet type(check the Policy-based routing). And then to configure the firewall to allow those packets. Kind of this is what happens when LAN access is enabled.

But please keep in mind that this are VPN leaks and should be configured with care because other apps might exploit this.

tm4ig commented 3 months ago

I do not want allow ping from my host to anywhere outside vpn. I want allow ping from remote hosts to my host.

tm4ig commented 3 months ago

after add 

iptables -A OUTPUT -t mangle -p icmp --icmp-type 0 -j MARK --set-mark 0xe1f1

ping is working

mariusSincovici commented 2 months ago

I'm closing this, if more info is needed from our side let us know.