I have managed to get openvpn setup and get it to issue static internal ips to clients. Now the trouble i have is I'm now trying to assign open port per client as they now have static internal ip it makes it easy be ready to add rules. Where im running into issues is with how to do this properly via iptables.
Client's pushed internal static ip 10.8.0.10 example would be to have port 1234 forwarded
I have tried this with no luck vpn does use udp and on port 1194 but have tried the below rules modified as udp and as tcp and both together. Please note vpn already works and has the masquerade rules but other then that iptables is empty.
iptables -t nat -A PREROUTING -p tcp --dport 1234 -j DNAT --to-destination 10.8.0.10 iptables -A FORWARD -s 10.8.0.10 -p tcp --dport 1234 -j ACCEPT
I have also tried 10.8.0.1 being gateway and 10.8.0.10 being client needing port all ports forwarded
iptables -t nat -A PREROUTING -d 10.8.0.1 -j DNAT --to-destination 10.8.0.10
I'm trying to accomplish 2 things first being able to forward a port per client and if necessary a static public ip if they need all ports forwarded.
local 220.127.116.11 #- your_server_ip goes here port 1194 #- port proto udp #- protocol client-config-dir /etc/openvpn/ccd push "route 10.8.0.0 255.255.0.0" ifconfig-pool-persist /etc/openvpn/openvpn.dhcp 30 dev tun tun-mtu 1500 tun-mtu-extra 32 mssfix 1450 ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt cert /etc/openvpn/easy-rsa/2.0/keys/server.crt key /etc/openvpn/easy-rsa/2.0/keys/server.key dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem plugin /etc/openvpn/radiusplugin.so /etc/openvpn/radiusplugin.cnf client-cert-not-required username-as-common-name server 10.8.0.0 255.255.255.0 push redirect-gateway def1 push dhcp-option DNS 18.104.22.168 push dhcp-option DNS 22.214.171.124 keepalive 5 30 comp-lzo persist-key persist-tun status 1194.log verb 3
# Generated by iptables-save v1.3.5 on Sun Aug 26 14:27:12 2012 *nat :PREROUTING ACCEPT [4834:503608] :POSTROUTING ACCEPT [1000:70847] :OUTPUT ACCEPT [1000:70847] -A POSTROUTING -s 10.8.0.0/255.255.255.0 -o eth0 -j MASQUERADE COMMIT # Completed on Sun Aug 26 14:27:12 2012 # Generated by iptables-save v1.3.5 on Sun Aug 26 14:27:12 2012 *filter :INPUT ACCEPT [21545:23742094] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [14867:1938275] COMMIT # Completed on Sun Aug 26 14:27:12 2012