Topic: RFC/Help/Ideas: new openvpn options and how to implement

Hello-
To make openvpn even easier for the average joe, i'd like to implement per-service bool options that cause the following to occur:
For each service
-- Open port on WAN on startup / close on shutdown
-- Open DNS port on associated TUN/TAP interface
-- Open associated TUN/TAP interface to br-lan

I have some ideas as to how to do this, but need some help with particulars. 

What is the best way to open/close firewall ports real-time?  I would think writing a firewall rule directly rather than messing with UCI and then reloading firewall.  Thoughts?


--Open port on WAN on specific service startup / close on shutdown
What is the best chain to insert a rule like this in?  The standard chains it is easy -- 'INPUT' .. but with all of the custom chains OpenWRT has i'm not sure this is the best place for it  Roughly, this works but not sure if it creates security holes (other than the obvious open port)
iptables -I INPUT 2 -p udp --dport $(VPNPORT) -j ACCEPT

--Open DNS port on TUN/TAP interface / close on shutdown
Again, what is the best way / place to do this? with the previous distro i was using, the following was recommended:
iptables -I INPUT 1 -i $(VPNINTERFACE) -p tcp --dport 53 -j ACCEPT
iptables -I INPUT 1 -i $(VPNINTERFACE) -p udp --dport 53 -j ACCEPT

--Open TUN/TAP interface to br-lan / close on shutdown
Same deal, except for FORWARD and INPUT
iptables -I INPUT 2 -i $(VPNINTERFACE) -j ACCEPT
iptables -I FORWARD -i br-lan -o $(VPNINTERFACE) -j ACCEPT
iptables -I FORWARD -i $(VPNINTERFACE) -o br-lan -j ACCEPT


So, the idea being we insert a bool uci config item for each of these, put a check box in the luci interface for the three config items, and then insert scripts to take care of the bits and pieces of opening/closing ports into /etc/init.d/openvpn.

Looking through the /etc/init.d/openvpn code, this seems to be a good place to call relevant functions... or a singlel fucntion that handles all 3.

code wrote:

startup mechanism:
start_instance() {                                                                                                 
        local s="$1"                                                                                               
                                                                                                                   
        section_enabled "$s" || return 1
        $open_port_on_wan
        $open_dns
        $open_interface_to_br-lan
                                                                                                                   
        ARGS=""                                                                                                     
                                                                                                                   
        # append flags                                                                                             
        append_bools "$s" \                                                                                         
                auth_nocache auth_retry auth_user_pass_optional bind ccd_exclusive client client_cert_not_required \
                client_disconnect client_to_client comp_lzo comp_noadapt disable \                                 
                disable_occ down_pre duplicate_cn fast_io float http_proxy_retry \                                 
                ifconfig_noexec ifconfig_nowarn ifconfig_pool_linear management_forget_disconnect management_hold \
                management_query_passwords management_signal mktun mlock mtu_test multihome mute_replay_warnings \ 
                nobind no_iv no_name_remapping no_replay opt_verify passtos persist_key persist_local_ip \         
                persist_remote_ip persist_tun ping_timer_rem pull push_reset \                                     
                remote_random rmtun route_noexec route_nopull single_session socks_proxy_retry \                   
                suppress_timestamps tcp_nodelay test_crypto tls_client tls_exit tls_server \                       
                tun_ipv6 up_delay up_restart username_as_common_name
                                                                                                                   
        # append params                                                                                             
        append_params "$s" \                                                                                       
                cd askpass auth auth_user_pass auth_user_pass_verify bcast_buffers ca cert \                       
                chroot cipher client_config_dir client_connect config connect_freq \                               
                connect_retry connect_timeout connect_retry_max crl_verify dev dev_node dev_type dh \               
                echo engine explicit_exit_notify fragment group hand_window hash_size \                             
                http_proxy http_proxy_option http_proxy_timeout ifconfig ifconfig_pool \                           
                ifconfig_pool_persist ifconfig_push inactive ipchange iroute keepalive \                           
                key key_method keysize learn_address link_mtu lladdr local log log_append \                       
                lport management management_log_cache max_clients \                                               
                max_routes_per_client mode mssfix mtu_disc mute nice ns_cert_type ping \                           
                ping_exit ping_restart pkcs12 plugin port port_share prng proto rcvbuf \                         
                redirect_gateway remap_usr1 remote remote_cert_eku remote_cert_ku remote_cert_tls \           
                reneg_bytes reneg_pkts reneg_sec \                                                           
                replay_persist replay_window resolv_retry route route_delay route_gateway \                   
                route_metric route_up rport script_security secret server server_bridge setenv shaper sndbuf \
                socks_proxy status status_version syslog tcp_queue_limit tls_auth \                           
                tls_cipher tls_remote tls_timeout tls_verify tmp_dir topology tran_window \                   
                tun_mtu tun_mtu_extra txqueuelen user verb                                                         
                                                                                                                   
        # append multi-value params                                                                                 
        append_params_quoted "$s" \                                                                               
                down push up                                                                                       
                                                                                                                   
                                                                                                                 
        SERVICE_PID_FILE="/var/run/openvpn-$s.pid"                                                           
        service_start /usr/sbin/openvpn --syslog "openvpn($s)" --writepid "$SERVICE_PID_FILE" $ARGS           
}

Would want to do something similar on shutdown.

Thoughts/Suggestions as to implementation and other?

Thanks!

Re: RFC/Help/Ideas: new openvpn options and how to implement

Unsure of the best way to get help with this / suggestions, so filed a bug as well

https://dev.openwrt.org/ticket/11027