Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I mean real newbie - linux here.. Please help me configuring my openvpn through iptables.

My main goal here is to open port for regular browsing (80, 443), email (110, 25), etc just like isp does but i want to block p2p traffic. So I will need to open only few port.

Here are my iptables config

    # Flush all current rules from iptables
    #
    iptables -F
    iptables -t nat -F
    iptables -t mangle -F

    #
    # Allow SSH connections on tcp port 22 (or whatever port you want to use)
    #
    iptables -A INPUT -p tcp --dport 22 -j ACCEPT

    #
    # Set default policies for INPUT, FORWARD and OUTPUT chains
    #
    iptables -P INPUT DROP                #using DROP for INPUT is not always recommended. Change to ACCEPT if you prefer.
    iptables -P FORWARD ACCEPT
    iptables -P OUTPUT ACCEPT

    #
    # Set access for localhost
    #
    iptables -A INPUT -i lo -j ACCEPT

    #
    # Accept packets belonging to established and related connections
    #
    iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

    #
    #Accept connections on 1194 for vpn access from clients
    #Take note that the rule says "UDP", and ensure that your OpenVPN server.conf says UDP too
    #
    iptables -A INPUT -p udp --dport 1194 -j ACCEPT

    #
    #Apply forwarding for OpenVPN Tunneling
    #
    iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
    iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT     #10.8.0.0 ? Check your OpenVPN server.conf to be sure
    iptables -A FORWARD -j REJECT
    iptables -t nat -A POSTROUTING -o venet0 -j SNAT --to-source 100.200.255.256   #Use your OpenVPN server's real external IP here

    #
    #Enable forwarding
    #
    echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -A INPUT -p tcp --dport 25 -j ACCEPT
iptables -A INPUT -p tcp --dport 26 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 110 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
    iptables -L -v

But when I connect to my vpn, i can't browsing and also got RTO on pinging yahoo, etc

share|improve this question
    
Since the default FORWARD behavior is ACCEPT, is there a reason you have a REJECT in there after your OpenVPN 10.8.0.0/24 subnet? –  Magellan Mar 20 '12 at 14:18

1 Answer 1

It looks like your using the defaults from someone's tutorial for your NAT settings.

The 'to-source' is clearly invalid since you cannot have an IPv4 quarter with a value > 255. The value should be the IP of the external interface of your server.

share|improve this answer
    
no.. it's just example.. on the original i use my own server ip –  Mook Mar 20 '12 at 6:07
    
OK. You did say 'real newbie'. =) –  Magellan Mar 20 '12 at 14:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.