Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to set up a simple VPN server on EC2 (Ubuntu 12.04) with the Android example ToyVpnServer. Its instructions:

// There are several ways to play with this program. Here we just give an
// example for the simplest scenario. Let us say that a Linux box has a
// public IPv4 address on eth0. Please try the following steps and adjust
// the parameters when necessary.
//
// # Enable IP forwarding
// echo 1 > /proc/sys/net/ipv4/ip_forward
//
// # Pick a range of private addresses and perform NAT over eth0.
// iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -o eth0 -j MASQUERADE
//
// # Create a TUN interface.
// ip tuntap add dev tun0 mode tun
//
// # Set the addresses and bring up the interface.
// ifconfig tun0 10.0.0.1 dstaddr 10.0.0.2 up
//
// # Create a server on port 8000 with shared secret "test".
// ./ToyVpnServer tun0 8000 test -m 1400 -a 10.0.0.2 32 -d 8.8.8.8 -r 0.0.0.0 0
//
// This program only handles a session at a time. To allow multiple sessions,
// multiple servers can be created on the same port, but each of them requires
// its own TUN interface. A short shell script will be sufficient. Since this
// program is designed for demonstration purpose, it performs neither strong
// authentication nor encryption. DO NOT USE IT IN PRODUCTION!

I followed the above but replaced 10.* with 192.168.* since EC2's network has already taken 10.*:

$ echo 1 > /proc/sys/net/ipv4/ip_forward
$ ip tuntap add dev tun0 mode tun
$ ifconfig tun0 192.168.0.1 dstaddr 192.168.0.2 up
$ iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o eth0 -j MASQUERADE
$ ./ToyVpnServer tun0 8000 test -m 1400 -a 192.168.0.2 32 -d 8.8.8.8 -r 0.0.0.0 0

I then establish the connection from the Android emulator, which works. When I then attempt a web request from the Android browser, the server gets packets, but they are not forwarded:

$ sudo tcpdump -i tun0 -n
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 65535 bytes
07:41:46.342823 IP 192.168.0.2.21668 > 8.8.8.8.53: 59997+ A? www.google.com. (32)
07:41:51.347913 IP 192.168.0.2.35397 > 8.8.8.8.53: 49390+ A? www.google.com. (32)
07:41:56.353276 IP 192.168.0.2.35397 > 8.8.8.8.53: 49390+ A? www.google.com. (32)
^C

$ sudo tcpdump -i eth0 not host 64.236.139.254 -n
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
^C

Other state of affairs:

$ ip route
default via 10.252.49.129 dev eth0  metric 100
10.252.49.128/26 dev eth0  proto kernel  scope link  src 10.252.49.153
192.168.0.2 dev tun0  proto kernel  scope link  src 192.168.0.1

$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 22:00:0a:fc:31:99 brd ff:ff:ff:ff:ff:ff
    inet 10.252.49.153/26 brd 10.252.49.191 scope global eth0
    inet6 fe80::2000:aff:fefc:3199/64 scope link 
       valid_lft forever preferred_lft forever
3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 500
    link/none 
    inet 192.168.0.1 peer 192.168.0.2/32 scope global tun0

$ cat /proc/sys/net/ipv4/ip_forward 
1

Any help would be greatly appreciated. Thanks.

share|improve this question

1 Answer 1

up vote 0 down vote accepted

I debugged this by adding:

sudo iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j LOG --log-prefix "blah blah: "

which showed in /var/log/syslog:

Feb  1 10:53:47 ip-10-252-194-250 kernel: [9722772.386808] [UFW BLOCK] IN=tun0 OUT=eth0 MAC= SRC=192.168.0.2 DST=8.8.8.8 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=30129 DF PROTO=UDP SPT=64512 DPT=53 LEN=40

Simply using ufw disable seems to have done the trick.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.