We're running OpenVPN AS servers which are accessable and working over a public IP. But some of our clients aren't allowed to access our VPN server directly (because of some nasty firewall admin - don't ask...). To bypass that problem, we've come up with a setup that will create a gateway in a virtual environment which will do a simple NAT to forward all incomming connections to our VPN server.
NAT is working properly (tcpdump on the server shows the same packets that were leaving our gateway). Our current iptables roules are (INPUT, FORWARD and OUTPUT are set to ACCEPT by default):
iptables -t nat -A PREROUTING -p udp --dport 1194 -j DNAT --to-destination $vpn_srv iptables -t nat -A POSTROUTING -j MASQUERADE
I know that there might be some further configuration need but as long as the VPN server isn't responding to the packets he surely receives, there's no need for us to enhance the rules.
Every time a packet arrives at the VPN server, the server produces following log output:
2012-12-31 13:03:29+0000 [-] OVPN 1 OUT: 'Mon Dec 31 13:03:29 2012 TLS Error: incoming packet authentication failed from 220.127.116.11:35077' 2012-12-31 13:03:31+0000 [-] OVPN 1 OUT: 'Mon Dec 31 13:03:31 2012 Authenticate/Decrypt packet error: packet HMAC authentication failed'
So I suppose that we need to tell the VPN server to accept and reply to forwarded packets from this host. How do we do that?
Note: All servers (VPN server and NAT Gateway) are public.
No Ideas? I know that it's possible to run an OpenVPN server behind a firewall (simple NAT as in any home network). How is my setup different from that one?
We would try any solution that allows us to forward the vpn traffic from a "gateway" to our vpn server. Preferably using an encryption because it seems that the firewall scans for specific vpn pakets which will be dumped.