1

I have the following setup

  • Server (192.168.21.11, 172.17.4.6), that routes 10.10.10.0/24 through OpenVPN
  • Client (192.168.21.9)
  • Router (192.168.21.1) [m0n0wall] that has a static route for 10.10.10.0/24 to 192.168.21.11

On the Server, NAT forwarding is enabled:

/sbin/iptables -t nat -A POSTROUTING -d 10.10.10.0/24 -o tun0 -j MASQUERADE
# cat /proc/sys/net/ipv4/ip_forward
1


# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination  

I'm able to do a traceroute from the client to the server

# traceroute 10.10.10.10
traceroute to 10.10.10.10 (10.10.10.10), 30 hops max, 60 byte packets
 1  (192.168.21.1)  0.283 ms  0.211 ms  0.165 ms  ## Router
 2  (192.168.21.11)  0.262 ms  0.249 ms  0.213 ms ## Server
 3  (172.17.4.1)  40.356 ms  83.965 ms  83.915 ms ## OpenVPN Subnet
 4  (10.10.10.10)  83.778 ms  83.626 ms  83.488 ms

But I'm somehow unable to connect from the client to the server. Here's what tcpdump reports, when I try to connect through SSH to the server:

# tcpdump -i tun0
tcpdump: WARNING: arptype 65534 not supported by libpcap - falling back to cooked socket
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type LINUX_SLL (Linux cooked), capture size 96 bytes
08:05:16.734848 IP 172.17.4.6.58710 > 10.10.10.10.ssh: S 2851123862:2851123862(0) win     5840 <mss 1460,sackOK,timestamp 597224955 0,nop,wscale 6>
08:05:16.776264 IP 10.10.10.10.ssh > 172.17.4.6.58710: S 658436853:658436853(0) ack 2851123863 win 5792 <mss 1366,sackOK,timestamp 296951268 597224955,nop,wscale 5>
08:05:20.986415 IP 10.10.10.10.ssh > 172.17.4.6.58710: S 658436853:658436853(0) ack 2851123863 win 5792 <mss 1366,sackOK,timestamp 296952321 597224955,nop,wscale 5>
08:05:26.985854 IP 10.10.10.10.ssh > 172.17.4.6.58710: S 658436853:658436853(0) ack 2851123863 win 5792 <mss 1366,sackOK,timestamp 296953821 597224955,nop,wscale 5>

It seems as though the packets from the server aren't routed back to the client.

1 Answer 1

1

Well it wasn't an iptables problem. The problem was that I am using m0n0wall as a router and I set up the routes through m0n0wall. Since m0n0wall pushes these routes through the firewall, the "Bypass firewall rules for traffic on the same interface" rule has to be enabled to stop m0n0wall from stopping packets.

The problem was very similar to: http://forum.m0n0.ch/index.php?topic=381.0

2
  • 1
    I feel quite stupid to respond to my own question so fast, but I tried 4 hours to get it working through iptables. 10 minutes after I posted it here, I got the idea that the router must be the problem.
    – Pascal
    Jan 27, 2011 at 9:17
  • I am having a similar problem and found your post. And to your comment, it happens to me many times as well. cheers.
    – Jake
    Apr 27, 2011 at 1:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .