3

I have an openvpn setup that is working great. There are some 50 clients connected and everything is handy dandy. I need one of these clients to route all traffic trough the vpn. I setup a ccd for that particular client and added the push "redirect-gateway def1" to it. The routing table seems to be updated in the client. I can access all the hosts in the vpn but can't access anything else outside the vpn. When tracerouting from the client, everything goes to the vpn gateway, but after that not further. I believe the culprit is the iptables configuration in the server.

This is the setup

  • I have an openvpn using the subnet 10.170.x.x with the vpn gateway at 10.170.0.1 (VPNGATEWAY)
  • I have different subnet 10.171.x.x that gets its ip assigned via ccd records (this is the admin network and has 3 clients)
  • The client that I want to have all its traffic trough the vpn is 10.171.0.1 (CLIENT)

From 10.171.0.1 (CLIENT) I can ping 10.170.0.1 (VPNGATEWAY). In fact I can ping all hosts in 10.170.x.x and 10.171.x.x. But can't ping 8.8.8.8.

This is the iptables conf

There are a bunch rules and I took out to make it simpler.

*filter
:INPUT DROP [1000:900000]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -s 127.0.0.1 -j ACCEPT 

# here were some rules accepting certain ports  22, 80, etc

-A INPUT -p icmp -m icmp --icmp-type 8 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -p icmp -m icmp --icmp-type 13 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -p icmp -m icmp --icmp-type 30 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT 

# this is the client that needs internet thru the gateway
# i've tried to make as permissive as possible but still to no avail
-A INPUT -s 10.171.0.1 -j ACCEPT
-A FORWARD -s 10.171.0.1 -j ACCEPT

-A FORWARD -j REJECT --reject-with icmp-port-unreachable 
-A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT 
COMMIT

I've additionaly tried adding

iptables -t nat -A POSTROUTING -s 10.171.0.1 -o eth0 -j MASQUERADE

But still no work. Any ideas?

9
  • 1
    Your rule -A FORWARD -s 10.171.0.1 -j ACCEPT isn't stateful. Are you sure you don't need to add a rule to accept packets returning to 10.171.0.1?
    – Zoredache
    Mar 29, 2012 at 16:35
  • The openvpn server, is it the gateway machine for your network?
    – cjc
    Mar 29, 2012 at 16:36
  • BTW, if you do a tcpdump on the outside (eth0?) interface of the gateway, do you see the trace,ping,packets, from 10.171.0.1 leaving the system?
    – Zoredache
    Mar 29, 2012 at 16:36
  • @zoredache i will tryyour suggestion just to make sure. Mar 29, 2012 at 17:59
  • @cjc the openvpn server is a remote server that I would like to act as the gateway to the outside world for that one client. In this case it will be the server and the gateway. Mar 29, 2012 at 18:00

1 Answer 1

1

You have these two rules which to permit your traffic. But these rules are probably not what you want.
or at least not only what you want.

-A INPUT -s 10.171.0.1 -j ACCEPT
-A FORWARD -s 10.171.0.1 -j ACCEPT

Your firewall rule set seems to be designed to be stateful, but these two rules are stateless. You either need to add two rules to handle the traffic in the other direction, or add some state matching.

1
  • Thanks @zoredache. This is a nice example of: would you please put that comment in the form of an answer... ;-) Mar 30, 2012 at 12:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .