Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a server A running OpenVPN, an OpenVPN client B (a rooted Android phone as it happens) and a third party C (a laptop, tablet etc.) tethered to B.

B can use the VPN to access the internet via A; C can use the tethered connection WITHOUT the VPN to access the internet via B.

However, with the VPN on B active, I cannot load information from the internet on C.

A appears to log similar traffic inbound and outbound when B or C attempt to load a webpage, say, but the VPN on device B reports no inbound traffic when the connection originated from C.

Where should I look for packets being dropped, and what ip rules should I use to make sure they are passed back through the VPN and into the local network B <-> C?

(I'll obviously post whatever further information is needed.)

Further info

Without VPN:

root@android:/ # ip route
default via [B's External Gateway] dev rmnet0
[B's External Subnet] dev rmnet0  proto kernel  scope link  src [B's External IP]
[B's External Gateway] dev rmnet0  scope link
192.168.43.0/24 dev wlan0  proto kernel  scope link  src 192.168.43.1

With VPN:

root@android:/ # ip route
0.0.0.0/1 dev tun0  scope link
default via [B's External Gateway] dev rmnet0
[B's External Subnet] dev rmnet0  proto kernel  scope link  src [B's External IP]
[B's External Gateway] dev rmnet0  scope link
[External address of A] dev tun0  scope link
128.0.0.0/1 dev tun0  scope link
172.16.0.0/24 dev tun0  scope link
172.16.0.8/30 dev tun0  proto kernel  scope link  src 172.16.0.10
192.168.43.0/24 dev wlan0  proto kernel  scope link  src 192.168.43.1
192.168.168.0/24 dev tun0  scope link
share|improve this question
    
Check the routing table with and without VPN connection. OpenVPN probably changes it when you establish the connection. –  Ansgar Wiechers Sep 30 '12 at 13:01
    
I've provided the results of running ip route on B, with and without OpenVPN running there. The reason I'm posting on SF is that I realized I don't fully understand this output and I definitely don't know how to fix it! –  Sharkos Sep 30 '12 at 13:06
    
Typically on a Linux machine (acting as B) - you would enable ipv4.forwarding and provide an associated MASQUERADE rule on IPTables to route between C and A. I'm not exactly sure how this is handled on Android, but I'd assume this is the issue. –  Ben Lessani - Sonassi Sep 30 '12 at 14:26
    
@sonassi - thanks; ipv4.forwarding is definitely enabled (this happens by default when one tethers, and I've checked it). However, ìptables does not show any MASQUERADE commands - I have access to a pretty standard version of iptables on the Android device, so can you give an example of what command to issue? I'm confused about 'who should do what unto whom'. –  Sharkos Sep 30 '12 at 16:08
    
MASQUERADE isn't a command. It's an IPTables module. Google it. –  Magellan Sep 30 '12 at 18:40

1 Answer 1

Ah, fixed it by running the following on B (the phone):

iptables -t nat -A POSTROUTING -s 192.168.43.0/255.255.255.0 -o tun0 -j MASQUERADE
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 192.168.43.0/255.255.255.0 -j ACCEPT
iptables -A FORWARD -j REJECT --reject-with icmp-port-unreachable

This pretty much corresponds to the usual basic setup for a VPN server; I was having problems because I got confused about which network was which, which interface was which, and then when I had those right I realized I still had the wrong gateway set on C.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.