Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to setup openvpn and I need to add the following rule among others:

iptables -A FORWARD -s 10.8.0.0/24 -d 0/0 -j ACCEPT

but, after adding this rule and running iptables -L I get the following output:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  server.hosting.invalid/24  anywhere           

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination 

which clearly states that there is an error in adding that rule or something. It must be a message from my hosting provider. Any idea how can I make that rule working?

Thank you.

share|improve this question
1  
What evidence other then the iptables output do you have that this rule is not working? Given the current state of your firewall you really don't need it. –  Zoredache Oct 22 '10 at 6:41
add comment

2 Answers

ACCEPT     all  --  server.hosting.invalid/24  anywhere           

which clearly states that there is an error in adding that rule or something. 

That isn't necessarily an error. It could just be that you have 10.8.0.0 or something similar defined in your /etc/networks file. It could just be DNS resolution. Try passing -n to iptables to skip the DNS resolution.

In any case given the current state of your firewall you really don't need that rule. Everything is already being accepted. (policy ACCEPT)

share|improve this answer
add comment

It might be invalid subnet for your hosting provider (10.x.x.x is private and unroutable in the Internet). But I belive there isn't any problem here, cause you will be using VPN and 10.x.x.x will be routed locally on your server.

share|improve this answer
    
Any idea how I can find out what are the valid subnets under linux without having to wait for them to respond? Can I create subnets under linux? Thanks. –  user57890 Oct 22 '10 at 6:15
1  
This one is valid, because it will be used for VPN traffic and packets with this ip addresses will not leave your server(they will be encapsulated into packets with external IP's, provided by your hosting provider). As Zoredache said, you don't really need this rule. Subnets are "created" with a help of 'ifconfig' command, but you should read some manuals or step-by-step guides, because it seems that you are new to linux. –  TiFFolk Oct 22 '10 at 7:05
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.