Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I’m trying to do the setup of a IPSEC / XL2TPD VPN for our office, and I’m having some problems accessing the remote local machines after connecting to the VPN.

I can connect, and I can browse Internet sites trough the VPN, but as said, I’m unable to connect or even ping the local ones.

My Network setup is something like this:

INTERNET > eth0 > ROUTER / VPN > eth2 > LAN

These are some traceroutes behind the VPN:

traceroute to google.com (173.194.78.94), 64 hops max, 52 byte packets
 1  192.168.1.80 (192.168.1.80)  74.738 ms  71.476 ms  70.123 ms
 2  10.35.192.1 (10.35.192.1)  77.832 ms  77.578 ms  77.865 ms
 3  10.47.243.137 (10.47.243.137)  78.837 ms  85.409 ms  76.032 ms
 4  10.47.242.129 (10.47.242.129)  78.069 ms  80.054 ms  77.778 ms
 5  10.254.4.2 (10.254.4.2)  86.174 ms
    10.254.4.6 (10.254.4.6)  85.687 ms
    10.254.4.2 (10.254.4.2)  85.664 ms

traceroute to 192.168.1.3 (192.168.1.3), 64 hops max, 52 byte packets
 1  * * *
 2  *traceroute: sendto: No route to host
traceroute: wrote 192.168.1.3 52 chars, ret=-1
 *traceroute: sendto: Host is down
traceroute: wrote 192.168.1.3 52 chars, ret=-1
 *
traceroute: sendto: Host is down
 3 traceroute: wrote 192.168.1.3 52 chars, ret=-1
 *traceroute: sendto: Host is down
traceroute: wrote 192.168.1.3 52 chars, ret=-1

These are my iptables rules:

iptables -A INPUT -i lo -j ACCEPT

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# allow lan to router traffic
iptables -A INPUT -s 192.168.1.0/24 -i eth2 -j ACCEPT

# ssh
iptables -A INPUT -p tcp --dport ssh -j ACCEPT

# vpn
iptables -A INPUT -p 50 -j ACCEPT
iptables -A INPUT -p ah -j ACCEPT
iptables -A INPUT -p udp --dport 500 -j ACCEPT
iptables -A INPUT -p udp --dport 4500 -j ACCEPT
iptables -A INPUT -p udp --dport 1701 -j ACCEPT

# dns
iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -s 192.168.1.0/24 -p udp --dport 53 -j ACCEPT

iptables -t nat -A POSTROUTING -j MASQUERADE

# logging
iptables -I INPUT 5 -m limit --limit 1/min -j LOG --log-prefix "iptables denied: " --log-level 7

# block all other traffic
iptables -A INPUT -j DROP

And here are some firewall log lines:

Dec  6 11:11:57 router kernel: [8725820.003323] iptables denied: IN=ppp0 OUT= MAC= SRC=192.168.1.81 DST=192.168.1.3 LEN=60 TOS=0x00 PREC=0x00 TTL=255 ID=62174 PROTO=UDP SPT=61910 DPT=53 LEN=40 
Dec  6 11:12:29 router kernel: [8725852.035826] iptables denied: IN=ppp0 OUT= MAC= SRC=192.168.1.81 DST=224.0.0.1 LEN=44 TOS=0x00 PREC=0x00 TTL=1 ID=15344 PROTO=UDP SPT=56329 DPT=8612 LEN=24 
Dec  6 11:12:36 router kernel: [8725859.121606] iptables denied: IN=ppp0 OUT= MAC= SRC=192.168.1.81 DST=224.0.0.1 LEN=44 TOS=0x00 PREC=0x00 TTL=1 ID=11767 PROTO=UDP SPT=63962 DPT=8612 LEN=24 
Dec  6 11:12:44 router kernel: [8725866.203656] iptables denied: IN=ppp0 OUT= MAC= SRC=192.168.1.81 DST=224.0.0.1 LEN=44 TOS=0x00 PREC=0x00 TTL=1 ID=11679 PROTO=UDP SPT=57101 DPT=8612 LEN=24 
Dec  6 11:12:51 router kernel: [8725873.285979] iptables denied: IN=ppp0 OUT= MAC= SRC=192.168.1.81 DST=224.0.0.1 LEN=44 TOS=0x00 PREC=0x00 TTL=1 ID=39165 PROTO=UDP SPT=62625 DPT=8612 LEN=24 

I’m pretty sure that the problem should be related with iptables, but after trying a lot of different confs, I was unable to find the right one.

Any help will be greetly appreciated ;). Kind regards, Simon.

EDIT:

This is my route table:

default         62.43.193.33.st 0.0.0.0         UG    100    0        0 eth0
62.43.193.32    *               255.255.255.224 U     0      0        0 eth0
192.168.1.0     *               255.255.255.0   U     0      0        0 eth2
192.168.1.81    *               255.255.255.255 UH    0      0        0 ppp0
share|improve this question
    
Just a hint: "IN=ppp0" (ppp0 interface) –  FINESEC Dec 6 '12 at 12:45
    
yeah, I've tried different iptables lines regarding that interface without success... :( –  Simon Dec 6 '12 at 14:21

2 Answers 2

up vote 0 down vote accepted
+100

You are very likely having the exact same issue as this post

Your situation is as follow:

VPN client can reach VPN server and tunnel through VPN to the internet, but cannot reach server LAN nor any other VPN clients ip.

Tunneling to the internet work because you have iptables NAT rule. The rest you need to apply the following ON THE VPN SERVER:

Enable tcp/ip forwarding

Linux TCP/IP stack by default does not forward packets (either between interfaces or re-routing them between IP network). It has to be enabled

echo 1 > /proc/sys/net/ipv4/ip_forward

Without that, VPN server will accept VPN client packet locally, and route client packet according to NAT rule, but will not route traffic to local network.

Iptables

Iptables block all traffic by default. You need rules to allow traffic to get through(forward).

$IPTABLES -A FORWARD -s 192.168.1.0/24 -d 192.168.1.0/24 -j ACCEPT

PS: Each vpn connection is an individual(virtual) interface(nic), to allow packet to flow/route between them, you need FORWARD in iptables.

/etc/l2tpd.conf

When vpn client need to talk to each together, the vpn server is acting as a routing point and need to be on the same netowrk.

local ip 192.168.1.1
ip range 192.168.1.2 - 192.168.1.254

Modify the above according to your network setup. If your vpn server has a 192.168.1.x ip, use it for the "local ip".

Modified Iptables script

Be very careful if you don't have physical access to the vpn server.

(This script will need anti-spoofing on the wan interface, but lets focus on getting traffic from vpn to lan 1st.)

# Reset/Flush iptables
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

# Enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

# NAT
# -- iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -j MASQUERADE
#
# Updated NAT rule
#   External interface  = eth0
#   External IP     = 123.123.123.123
#   Internal LAN        = 192.168.1.0/24
#   To support dynamic interface : "-j SNAT" replace "-j MASQUERADE" 
#   NO NAT if destination is LAN 
iptables -t nat -A POSTROUTING -o eth0 -s 192.168.1.0/24 ! -d 192.168.1.0/24 -j SNAT --to-source 123.123.123.123

# New(1) - lo
# -- iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i lo   -m state --state NEW  -j ACCEPT
iptables -A OUTPUT -o lo   -m state --state NEW  -j ACCEPT

# -- iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# New(2) Allow inter-192.168.1.x routing
iptables -A INPUT  -s 192.168.1.0/24   -m state --state NEW  -j ACCEPT
iptables -A OUTPUT  -s 192.168.1.0/24   -m state --state NEW  -j ACCEPT
iptables -A FORWARD  -s 192.168.1.0/24   -m state --state NEW  -j ACCEPT

# -- allow lan to router traffic - Shadowed by New(2)
# -- This rule maybe your source of trouble too, it only accept 192.168.1.x from eth2
# -- iptables -A INPUT -s 192.168.1.0/24 -i eth2 -j ACCEPT

# ssh
iptables -A INPUT -p tcp --dport ssh -j ACCEPT

# vpn
iptables -A INPUT -p 50 -j ACCEPT
iptables -A INPUT -p ah -j ACCEPT
iptables -A INPUT -p udp --dport 500 -j ACCEPT
iptables -A INPUT -p udp --dport 4500 -j ACCEPT
iptables -A INPUT -p udp --dport 1701 -j ACCEPT

# dns - Shadowed by New(2)
# -- iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 53 -j ACCEPT
# -- iptables -A INPUT -s 192.168.1.0/24 -p udp --dport 53 -j ACCEPT

# logging
iptables -I INPUT 5 -m limit --limit 1/min -j LOG --log-prefix "iptables denied: " --log-level 7

# block all other traffic
iptables -A INPUT -j DROP
share|improve this answer
    
Hi, and thanks for your help, but it didn't work either. I think that the problem can be related to this comment: serverfault.com/questions/455649/… –  Simon Dec 11 '12 at 22:02
    
Can you post your ifconfig of your vpn server? Is your vpn server on the same ip network of vpn clients? What is "local ip" and "ip range" of your l2tp.conf? –  John Siu Dec 11 '12 at 22:17
    
Updated l2tpd.conf in answer. Let me know if client can ping vpn server 192.168.1.x ip after the change. –  John Siu Dec 11 '12 at 22:28
    
Hi and thanks for the help ;). This is my ifconfig: pastebin.com/ewMftDw3. And this is my xl2tpd.conf file pastebin.com/HB5mtzb7. I've tried to give the vpn clients their own subnetwork but in that case I can't browse internet through the vpn. –  Simon Dec 11 '12 at 23:55
    
I updated with a modified iptables script. Please test ping from client to server by ip. –  John Siu Dec 12 '12 at 2:56

Umm, a partial answer would seem to be : iptables -A OUTPUT -p tcp --dport dns -j ACCEPT

... similar statements to mirror '-A INPUT' in your description

Ok, I should have realized this at first: you are running NAT so...

iptables -A FORWARD -i eth1 -o ppp0 -j ACCEPT
iptables -A FORWARD -o eth1 -i ppp0 -j ACCEPT
sysctl -w net.ipv4.ip_forward=1
iptables -A FORWARD -i ppp0 -o eth1 -p tcp --dport 80 -d x.x.x.x -j ACCEPT
iptables -A FORWARD -i ppp0 -o eth1 -p tcp --dport 53 -d y.y.y.y -j ACCEPT
iptables -t filter -P FORWARD DROP

share|improve this answer
    
Nop, it does not seem to work, but thanks anyway. –  Simon Dec 9 '12 at 9:33
    
Ummm, PARTIAL is the operative road. Try hping...? –  ArrowInTree Dec 9 '12 at 13:58
    
Hi, I still can't ping the machines in the local network with that config, but the thing is that with my former setup, the vpn client is able to access the dns server in the router. –  Simon Dec 9 '12 at 18:20
    
Sorry, I hit enter... restarting: I still can't ping the machines in the local network with that config, but the thing is that with my former setup, the vpn client is able to access the dns server in the router. So, for example, after connecting to the vpn: ping remote_on_lan.example.org PING remote_on_lan.example.org (192.168.1.9): 56 data bytes Request timeout for icmp_seq 0 If I remove the lines that grant access to the dns server, the ping won't resolve the local address: ping remote_on_lan.example.org ping: cannot resolve remote_on_lan.example.org: Unknown host Continue –  Simon Dec 9 '12 at 18:29
    
So, with I have a vpn which can access Internet through it, could access the dns server behind it, but it's unable to ping or access local machines in the local network. For reference, I've tried your lines with some changes (eth2 instead of eth1, but I've tried eth0 too), and 192.168.1.0/24 and 0.0.0.0/24 as the ips (one network each time). And I couldn't make work it with the last line iptables -P FORWARD -j DROP cause it gave me a conflict: iptables v1.4.12: -X requires a chain and a policy. –  Simon Dec 9 '12 at 18:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.