2

Setting up an openvpn server with tls auth and ip forwarding.

I could connect to the vpn server just fine, but couldn't reach any outside connections

I could not successfully ping 8.8.8.8 the google dns service

but I knew I could connect to the vpn server:

tcpdump -i tun0

where tun0 is my vpn interface and could see packets comming in from my client. But the problem was that my iptables chain was reversed

here is my old iptables

-A POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/8 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p udp -m udp --dport 2345 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 2345 -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
-A INPUT -j DROP
-A FORWARD -j DROP
-A FORWARD -i eth0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -o eth0 -j ACCEPT
-A OUTPUT -j ACCEPT
COMMIT

You can see that this is backwards

-A FORWARD -j DROP
-A FORWARD -i eth0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -o eth0 -j ACCEPT

before any forwarded packet is accepted. it is dropped immediately simply reversing it fixed the issue

-A FORWARD -i eth0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -o eth0 -j ACCEPT
-A FORWARD -j DROP

once I fixed it everything else worked just fine. The only problem is that I feel a little silly

Michael Hampton
  • 244,070
  • 43
  • 506
  • 972
GoldenStake
  • 21
  • 2
  • Can you post the full output of `iptables-save`? – Isaac Freeman May 25 '13 at 17:47
  • @Isaac Freeman sure, edited into the post – GoldenStake May 25 '13 at 17:56
  • Thanks. I was hoping there would be something else in the iptables causing problems, but it's pretty vanilla. Hopefully someone else will be able to help. :} – Isaac Freeman May 25 '13 at 18:28
  • I _think_ what you want is to use either the PREROUTING table or the FORWARD table instead of POSTROUTING, but I'm not positive. Try tinkering with those to see if you get anywhere. There's a pretty detailed guide on iptables routing [here](http://www.frozentux.net/iptables-tutorial/chunkyhtml/c962.html). – Isaac Freeman May 25 '13 at 18:32
  • If you solved the problem, please post an Answer. Questions are for Questions. – Michael Hampton May 27 '13 at 02:10

1 Answers1

0

have you tried accessing a website/server via ip to exclude DNS as a error source? If that works try adding push "dhcp-option DNS 8.8.8.8" to your server.conf .This pushes the Google-DNS server to the client, helping to resolve the adresses

niklaskar
  • 1
  • 1