Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Looking for a few answers ;)

I'm running Zentyal on a gateway. The gateway is also an OpenVPN client, to a server I run out of another country. Interfaces are thus :

External : eth1 (dhcp from the modem 192.168.1.2) Internal : eth0 (static 10.1.1.1) OpenVPN : tun0 (from OpenVPN server 10.7.0.6)

I have connected the VPN and it functions. I can ping the server via

# ping 10.7.0.1

From the gateway machine.

These are the rules I have on the server, they have worked fine so far

iptables -t nat -A POSTROUTING -i tun0 -o eth0 -j SNAT --to-source # Generated by iptables-save v1.4.8 on Sat Mar 23 04:41:56 2013
*mangle
:PREROUTING ACCEPT [2036011512:705237252333]
:INPUT ACCEPT [332186284:78285843071]
:FORWARD ACCEPT [1703824348:626951360931]
:OUTPUT ACCEPT [405392399:436227187419]
:POSTROUTING ACCEPT [2109216747:1063178548350]
COMMIT
# Completed on Sat Mar 23 04:41:56 2013
# Generated by iptables-save v1.4.8 on Sat Mar 23 04:41:56 2013
*filter
:INPUT ACCEPT [332186284:78285843071]
:FORWARD ACCEPT [1019886723:183138161264]
:OUTPUT ACCEPT [405392397:436227186606]
-A FORWARD -i tun0 -o eth0 -j ACCEPT
-A FORWARD -i eth0 -o tun0 -j ACCEPT
COMMIT
# Completed on Sat Mar 23 04:41:56 2013
# Generated by iptables-save v1.4.8 on Sat Mar 23 04:41:56 2013
*nat
:PREROUTING ACCEPT [12528325:854813836]
:POSTROUTING ACCEPT [2920518:161107345]
:OUTPUT ACCEPT [882245:53661537]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Sat Mar 23 04:41:56 2013

I don't believe the issue is with the server, as I have had it working in the past, with the same rules. Also, if I connect directly with a single machine, it seems to work fine over NetworkManager

Here is my client OpenVPN config :

client
dev tun
proto udp
remote <server IP> 1194
resolv-retry infinite
redirect-gateway def1
nobind
user nobody
group nogroup
persist-key
persist-tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/client_home.crt
key /etc/openvpn/client_home.key
script-security 3
ns-cert-type server
comp-lzo
verb 3
mute 20
cipher AES-256-CBC
keysize 256

So now, what I want to do, is pipe the whole LAN (off eth0 10.1.1.1/32) through tun0 (openvpn 10.7.0.6). I can't get tun0 to show up within Zenyal, so I cant set it as the default gateway etc.

Can someone please help me writing a set of iptables rules for the gateway machine to force all data through the OpenVPN connection?

Thanks, I hope I can get this sorted. You know, the whole privacy thing is beginning to freak us all out a bit ;)

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.