I have an openvpn setup that is working great. There are some 50 clients connected and everything is handy dandy. I need one of these clients to route all traffic trough the vpn. I setup a
ccd for that particular client and added the
push "redirect-gateway def1" to it. The routing table seems to be updated in the client. I can access all the hosts in the vpn but can't access anything else outside the vpn. When tracerouting from the client, everything goes to the vpn gateway, but after that not further. I believe the culprit is the iptables configuration in the server.
This is the setup
- I have an openvpn using the subnet 10.170.x.x with the vpn gateway at 10.170.0.1 (VPNGATEWAY)
- I have different subnet 10.171.x.x that gets its ip assigned via ccd records (this is the admin network and has 3 clients)
- The client that I want to have all its traffic trough the vpn is 10.171.0.1 (CLIENT)
From 10.171.0.1 (CLIENT) I can ping 10.170.0.1 (VPNGATEWAY). In fact I can ping all hosts in 10.170.x.x and 10.171.x.x. But can't ping 188.8.131.52.
This is the iptables conf
There are a bunch rules and I took out to make it simpler.
*filter :INPUT DROP [1000:900000] :FORWARD DROP [0:0] :OUTPUT DROP [0:0] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -s 127.0.0.1 -j ACCEPT # here were some rules accepting certain ports 22, 80, etc -A INPUT -p icmp -m icmp --icmp-type 8 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type 13 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type 30 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT # this is the client that needs internet thru the gateway # i've tried to make as permissive as possible but still to no avail -A INPUT -s 10.171.0.1 -j ACCEPT -A FORWARD -s 10.171.0.1 -j ACCEPT -A FORWARD -j REJECT --reject-with icmp-port-unreachable -A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT COMMIT
I've additionaly tried adding
iptables -t nat -A POSTROUTING -s 10.171.0.1 -o eth0 -j MASQUERADE
But still no work. Any ideas?