younghacker

• Выключить VPN - всё нормализуется само собой. :)
  
• Удалить маршрут по умолчанию через VPN, перестать "PUSH-ить" его с сервера.
  
• Поднять VPN сервер у себя в сети :)
  
• Поднять у себя в локалке прокси. Настроить в браузере прокси. Если вдруг это будет другая подсеть то нужно прокинуть статический маршрут до прокси чтобы он был доступен с устройства.
  
• Запустите в локалке машину с браузером. Подключайтесь к нему через RDP или VNC из iOS
  
• есть несколько других способов но в разрезе iOS даже не знаю применимы ли они
  

-A OUTPUT -o enp1s0 -p tcp -m tcp --dport 443 -d x.x.x.x -j ACCEPT

-A OUTPUT -o wlp2s0 -p tcp -m tcp --dport 443 -d x.x.x.x -j ACCEPT

-A OUTPUT -j REJECT --reject-with icmp-host-prohibited

push "redirect-gateway"
push "dhcp-option DNS 10.11.0.1"
push "explicit-exit-notify 3"

-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -o tun+ -j ACCEPT
-A OUTPUT -o eth0 -d adresservera -p udp -dport vpnport -j ACCEPT
-A OUTPUT -j DROP

push "dhcp-option DNS 10.1.10.1"
push "redirect-gateway"

TUN/TAP device tun1 opened

10.49.0.0 10.13.0.1 255.255.0.0 UG 0 0 0 tun0

Wed Jan 11 11:45:38 2017 ERROR: Linux route add command failed: external program exited with error status: 2

[user001@localhost ~]$ ipcalc 192.168.0.0/24
Network:        192.168.0.0/24
Address space:  Private Use
Address class:  Class C
Netmask:        255.255.255.0 = 24
Broadcast:      192.168.0.255

HostMin:        192.168.0.1
HostMax:        192.168.0.254
Hosts/Net:      254

[user001@localhost ~]$ ipcalc 192.168.0.0/25
Network:        192.168.0.0/25
Address space:  Private Use
Address class:  Class C
Netmask:        255.255.255.128 = 25
Broadcast:      192.168.0.127

HostMin:        192.168.0.1
HostMax:        192.168.0.126
Hosts/Net:      126

[user001@localhost ~]$ ipcalc 192.168.0.128/25
Network:        192.168.0.128/25
Address space:  Private Use
Address class:  Class C
Netmask:        255.255.255.128 = 25
Broadcast:      192.168.0.255

HostMin:        192.168.0.129
HostMax:        192.168.0.254
Hosts/Net:      126

cipher none
auth none

-sU (UDP scans) .
           While most popular services on the Internet run over the TCP protocol, UDP[6] services are widely deployed. DNS, SNMP, and DHCP (registered
           ports 53, 161/162, and 67/68) are three of the most common. Because UDP scanning is generally slower and more difficult than TCP, some security
           auditors ignore these ports. This is a mistake, as exploitable UDP services are quite common and attackers certainly don't ignore the whole
           protocol. Fortunately, Nmap can help inventory UDP ports.

#!/bin/bash
## Parse variables

if [ ! -z "${time_ascii}" ]; then
  sessionStart=${time_ascii}
else
  sessionStart="UNSET"
fi

if [ ! -z "${trusted_ip}" ]; then
  clientHostAddress=${trusted_ip}
else
  clientHostAddress="UNSET"
fi

if [ ! -z "${username}" ]; then
  clientUID=${username}
else
  clientUID="UNSET"
fi

if [ ! -z "${time_duration}" ]; then
  sessionDuration=${time_duration}
else
  sessionDuration="UNSET"
fi

if [ ! -z "${bytes_sent}" ]; then
  txVolume=${bytes_sent}
else
  txVolume="UNSET"
fi

if [ ! -z "${bytes_received}" ]; then
  rxVolume=${bytes_received}
else
  rxVolume="UNSET"
fi

if [ ! -z "${common_name}" ]; then
  client_cn=${common_name}
else
  client_cn="UNSET"
fi

## Send to syslog
logger -t openvpn -- "Disconnect: CommonName: ${client_cn} Username: ${clientUID} HostIP: ${clientHostAddress} Duration: ${sessionDuration} seconds opened at ${sessionStart} Session Traffic: TX: ${txVolume} bytes RX: ${rxVolume} bytes"