Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an openvpn setup that is working great. There are some 50 clients connected and everything is handy dandy. I need one of these clients to route all traffic trough the vpn. I setup a ccd for that particular client and added the push "redirect-gateway def1" to it. The routing table seems to be updated in the client. I can access all the hosts in the vpn but can't access anything else outside the vpn. When tracerouting from the client, everything goes to the vpn gateway, but after that not further. I believe the culprit is the iptables configuration in the server.

This is the setup

  • I have an openvpn using the subnet 10.170.x.x with the vpn gateway at 10.170.0.1 (VPNGATEWAY)
  • I have different subnet 10.171.x.x that gets its ip assigned via ccd records (this is the admin network and has 3 clients)
  • The client that I want to have all its traffic trough the vpn is 10.171.0.1 (CLIENT)

From 10.171.0.1 (CLIENT) I can ping 10.170.0.1 (VPNGATEWAY). In fact I can ping all hosts in 10.170.x.x and 10.171.x.x. But can't ping 8.8.8.8.

This is the iptables conf

There are a bunch rules and I took out to make it simpler.

*filter
:INPUT DROP [1000:900000]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -s 127.0.0.1 -j ACCEPT 

# here were some rules accepting certain ports  22, 80, etc

-A INPUT -p icmp -m icmp --icmp-type 8 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -p icmp -m icmp --icmp-type 13 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -p icmp -m icmp --icmp-type 30 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT 

# this is the client that needs internet thru the gateway
# i've tried to make as permissive as possible but still to no avail
-A INPUT -s 10.171.0.1 -j ACCEPT
-A FORWARD -s 10.171.0.1 -j ACCEPT

-A FORWARD -j REJECT --reject-with icmp-port-unreachable 
-A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT 
COMMIT

I've additionaly tried adding

iptables -t nat -A POSTROUTING -s 10.171.0.1 -o eth0 -j MASQUERADE

But still no work. Any ideas?

share|improve this question
1  
Your rule -A FORWARD -s 10.171.0.1 -j ACCEPT isn't stateful. Are you sure you don't need to add a rule to accept packets returning to 10.171.0.1? –  Zoredache Mar 29 '12 at 16:35
    
The openvpn server, is it the gateway machine for your network? –  cjc Mar 29 '12 at 16:36
    
BTW, if you do a tcpdump on the outside (eth0?) interface of the gateway, do you see the trace,ping,packets, from 10.171.0.1 leaving the system? –  Zoredache Mar 29 '12 at 16:36
    
@zoredache i will tryyour suggestion just to make sure. –  rmarimon Mar 29 '12 at 17:59
    
@cjc the openvpn server is a remote server that I would like to act as the gateway to the outside world for that one client. In this case it will be the server and the gateway. –  rmarimon Mar 29 '12 at 18:00

1 Answer 1

up vote 1 down vote accepted

You have these two rules which to permit your traffic. But these rules are probably not what you want.
or at least not only what you want.

-A INPUT -s 10.171.0.1 -j ACCEPT
-A FORWARD -s 10.171.0.1 -j ACCEPT

Your firewall rule set seems to be designed to be stateful, but these two rules are stateless. You either need to add two rules to handle the traffic in the other direction, or add some state matching.

share|improve this answer
    
Thanks @zoredache. This is a nice example of: would you please put that comment in the form of an answer... ;-) –  rmarimon Mar 30 '12 at 12:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.