Sample TLS Configuration

From Mudlet
Jump to navigation Jump to search

To add TLS (secure connection) support to your game without changing your code base, while still having your server see the originating IP address, see below. (Normal SSL tunnels will show the IP of the proxy server). This has been tested on a fresh Debian stable install.

Credit to Paul Saindon from Iron Realms for writing this up.

1. Install Stunnel4

  $ sudo apt-get install stunnel4

2. Create stunnel4 file /etc/stunnel/rapture.conf (rapture is an example, replace with any server engine.)

  pid = /run/
  cert = /etc/stunnel/localhost.crt
  key = /etc/stunnel/
  accept = 6003
  connect =
  transparent = source

Note Note: In this example, 6003 is the port for ssl requests and 6002 is the normal server port. Change accordingly. You must also replace the cert and key with your own cert/key.

3. Enable stunnel. Open file /etc/default/stunnel4 and change

  -- to --

4. Start stunnel

   $ sudo systemctl start stunnel4.service

5. Install ipset

   $ sudo apt-get install ipset

6. Create ipset to use

   $ sudo ipset create stunneled hash:ip,port -exist timeout 300

7. Configure IPTables

  $ sudo iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 6003 -j SET --add-set stunneled src,srcport
  $ sudo iptables -t mangle -N DIVERT
  $ sudo iptables -t mangle -A OUTPUT -p tcp -m set --match-set stunneled dst,dstport -m tcp --sport 6002 -j DIVERT
  $ sudo iptables -t mangle -A DIVERT -j MARK --set-mark 1
  $ sudo iptables -t mangle -A DIVERT -j ACCEPT

8. Add routing rule

  $ sudo ip rule add fwmark 1 lookup 100
  $ sudo ip route add local dev lo table 100

9. Disable RP Filter for lo

  $ sudo sh -c "echo 0 >/proc/sys/net/ipv4/conf/lo/rp_filter"

10. Turn on route_localnet (depends on OS)

  sysctl -w net.ipv4.conf.default.route_localnet=1
  sysctl -w net.ipv4.conf.all.route_localnet=1

Note Note: These rules are not permanent by default. Test and then use your preferred method to restore on reboot.

Note Note: Based on the above, here is Tamarindo's implementation deployed on AWS - Amazon Linux 2.