Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to create a LAN to LAN VPN using OpenVPN and two RHEL5 machines. I have everything working, except that it fails after I reboot the client side(until I restart iptables).

The relevant openvpn configuration:

dev tun
proto tcp-client
remote full.host.name 443
ifconfig 192.168.1.14 192.168.1.13
secret static.key
route 192.168.1.0 255.255.255.0

The relevant iptables configuration:

-A POSTROUTING -o tun0 -s 192.168.2.53 -d 192.168.1.0/24 -j SNAT --to-source 192.168.1.14

I think it has something to do with iptables coming up before OpenVPN, and not being able to SNAT to an IP that it doesn't have yet. How can I get this to work after a reboot without having to restart iptables?

share|improve this question

1 Answer 1

Your system does it start iptables at boot ? If not, ask it, in /etc/rcS.d or something like that (it depends of your distribution). It is strange that it is not enable by your ditribution. Do you have multiple firewalls on this machine ?

share|improve this answer
    
It does start iptables at boot. The problem is that when I point another machine to it via a static route like: [192.168.2.53] --> [192.168.2.50] --OpenVPN-- [full.host.name] --> [192.168.1.0] : After a reboot it fails to NAT. When I restart iptables it starts NATing again. I think it is because 192.168.1.14 is the IP of the tun0 interface, which doesn't exist until OpenVPN starts. –  btk_ Nov 26 '10 at 17:17
    
iptables starts even if the interface is not up. To check, reboot, restart iptables, and then restart OpenVPN. Nat should be OK. I think there is a problem in the loading of iptables modules. –  Dom Nov 26 '10 at 17:29
    
I'm not sure that iptables will run if the interface is no there and you are using SNAT/DNAT. Tray to use MASQ - in this case for sure the rule will be loaded even interface is not present at that time. –  ntk Nov 26 '10 at 17:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.