Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've set up an openvpn server alongside an apache website that can only be accessed on port 8100 on the same machine. My /etc/openvpn/server.conf file looks like this:

port 1194
proto tcp
dev tun
ca ./easy-rsa2/keys/ca.crt
cert ./easy-rsa2/keys/server.crt
key ./easy-rsa2/keys/server.key  # This file should be kept secret
dh ./easy-rsa2/keys/dh1024.pem # Diffie-Hellman parameter
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
# make sure clients can still connect to the internet
push "redirect-gateway def1 bypass-dhcp"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

Now I tried to let only clients connected to the vpn network access the website on apache via port 8100. So I defined a few iptables rules:

#!/bin/sh
# My system IP/set ip address of server
SERVER_IP="10.0.0.10"
# Flushing all rules
iptables -F
iptables -X
# Setting default filter policy
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
# Allow incoming access to port 8100 from OpenVPN 10.8.0.1
iptables -A INPUT -i tun0 -p tcp --dport 8100 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o tun0 -p tcp --sport 8100 -m state --state ESTABLISHED -j ACCEPT
# outgoing http
iptables -A OUTPUT -o tun0 -p tcp --dport 8100 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i tun0 -p tcp --sport 8100 -m state --state ESTABLISHED -j ACCEPT

Now when I connect to the server from my client computer and try to access the website on 10.0.0.10:8100, my browser can't open it. Will I have to forward traffic from tun0 to eth0? Or is there anything else I'm missing?

FYI: I'm running ubuntu server 12.04.1 LTS. Iptables is installed.

share|improve this question

1 Answer 1

Since you are using subnet/IP different than the one provided by OpenVPN, you probably need to allow the server to do NATting for this to work.

Run the following commands:

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

You should fine tune the iptables rule to fit your need. This should get you working.

share|improve this answer
    
Thanks for the advice. I tried that one but didn't help. But I think, I just gave a bad example since I used the server id 192.168.0.2 first. In this case, it's actually 10.0.0.10 for the server and 10.8.0.1 for the openvpn server. –  Andy M Nov 24 '12 at 19:36
    
10.8.0.1/24 would't connect to 10.0.0.10 without some form of routing. Check you subnet configuration in your server.conf. –  melsayed Nov 24 '12 at 19:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.