Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

First of all apologies if this has been answered anywhere else, but I Have been googling around for a few days and it is driving me crazy now.

I have installed OpenVPN server on a CentOS VPS hosted remotely. My goal is to use it to link a few sites together.

I can connect a client to the VPN successfully, and I can then ping the server from the client. However, I cannot ping the client from the server when iptables is running on the server. If I stop iptables on the server I can ping the client from the server. I guess this is obviously to do with my firewall rules but I am struggling to work out exactly what is wrong. I obviously don't want to leave iptables disabled on the server. What is strange

NB: For the purpose of testing I have disabled the client firewall.

Any help would be appreciated.

My OpenVPN server config:

port 1194
proto udp
dev tun
topology subnet
server 10.8.0.0 255.255.255.0
push "route 10.8.0.0 255.255.255.0"
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/myserver.crt
key /etc/openvpn/easy-rsa/2.0/keys/myserver.key
tls-auth /etc/openvpn/easy-rsa/2.0/keys/ta.key 0
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
persist-key
persist-tun
status openvpn-status.log
log-append /var/log/openvpn.log
verb 4

Client:

client
route-method exe
route-delay 2
pull
dev tun
remote x.x.x.x 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert certs/client2.crt
key certs/client2.key
tls-auth certs/ta.key 1
comp-lzo
verb 3

Iptables rules:

[root@245 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     icmp --  anywhere             anywhere
ACCEPT     icmp --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https
ACCEPT     udp  --  anywhere             anywhere            udp dpt:openvpn
ACCEPT     icmp --  anywhere             anywhere
ACCEPT     all  --  localhost            anywhere
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     icmp --  anywhere             anywhere
ACCEPT     icmp --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere            state NEW,RELATED,ESTABLISHED

My routing table:

[root@245 ~]# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.8.0.0        *               255.255.255.0   U     0      0        0 tun0
1xx.2xx.1xx.0   *               255.255.254.0   U     0      0        0 eth0
link-local      *               255.255.0.0     U     1002   0        0 eth0
default         x.x.x.x.i 0.0.0.0         UG    0      0        0 eth0

My OpenVPN log:

Tue May  7 12:17:54 2013 us=953751 OpenVPN 2.2.2 i686-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] built on Apr  5 2012
Tue May  7 12:17:54 2013 us=953889 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Tue May  7 12:17:54 2013 us=958523 Diffie-Hellman initialized with 1024 bit key
Tue May  7 12:17:54 2013 us=958823 WARNING: file '/etc/openvpn/easy-rsa/2.0/keys/myserver.key' is group or others accessible
Tue May  7 12:17:54 2013 us=959450 WARNING: file '/etc/openvpn/easy-rsa/2.0/keys/ta.key' is group or others accessible
Tue May  7 12:17:54 2013 us=959466 Control Channel Authentication: using '/etc/openvpn/easy-rsa/2.0/keys/ta.key' as a OpenVPN static key file
Tue May  7 12:17:54 2013 us=959484 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue May  7 12:17:54 2013 us=959497 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue May  7 12:17:54 2013 us=959519 TLS-Auth MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Tue May  7 12:17:54 2013 us=959548 Socket Buffers: R=[188416->131072] S=[188416->131072]
Tue May  7 12:17:54 2013 us=959908 TUN/TAP device tun0 opened
Tue May  7 12:17:54 2013 us=959933 TUN/TAP TX queue length set to 100
Tue May  7 12:17:54 2013 us=959967 /sbin/ip link set dev tun0 up mtu 1500
Tue May  7 12:17:54 2013 us=964470 /sbin/ip addr add dev tun0 10.8.0.1/24 broadcast 10.8.0.255
Tue May  7 12:17:54 2013 us=967426 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue May  7 12:17:54 2013 us=968501 UDPv4 link local (bound): [undef]:1194
Tue May  7 12:17:54 2013 us=968550 UDPv4 link remote: [undef]
Tue May  7 12:17:54 2013 us=968591 MULTI: multi_init called, r=256 v=256
Tue May  7 12:17:54 2013 us=968666 IFCONFIG POOL: base=10.8.0.2 size=252
Tue May  7 12:17:54 2013 us=968713 IFCONFIG POOL LIST
Tue May  7 12:17:54 2013 us=968734 client2,10.8.0.2
Tue May  7 12:17:54 2013 us=968745 client1,10.8.0.4
Tue May  7 12:17:54 2013 us=968777 Initialization Sequence Completed
Tue May  7 12:18:04 2013 us=546976 MULTI: multi_create_instance called
Tue May  7 12:18:04 2013 us=547026 x.x.x.x:61034 Re-using SSL/TLS context
Tue May  7 12:18:04 2013 us=547065 x.x.x.x:61034 LZO compression initialized
Tue May  7 12:18:04 2013 us=547273 x.x.x.x:61034 Control Channel MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Tue May  7 12:18:04 2013 us=547306 x.x.x.x:61034 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue May  7 12:18:04 2013 us=547355 x.x.x.x:61034 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Tue May  7 12:18:04 2013 us=547366 x.x.x.x:61034 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Tue May  7 12:18:04 2013 us=547395 x.x.x.x:61034 Local Options hash (VER=V4): '14168603'
Tue May  7 12:18:04 2013 us=547410 x.x.x.x:61034 Expected Remote Options hash (VER=V4): '504e774e'
Tue May  7 12:18:04 2013 us=547458 x.x.x.x:61034 TLS: Initial packet from x.x.x.x:61034, sid=0910e819 d94b5f43
Tue May  7 12:18:04 2013 us=692067 x.x.x.x:61034 VERIFY OK: depth=1, /C=GB/ST=UK/L=Maidenhead/O=Rainbow-Frog/OU=servers/CN=ovpn-srv/name=opvpn.local/emailAddress=root@localhost
Tue May  7 12:18:04 2013 us=692327 x.x.x.x:61034 VERIFY OK: depth=0, /C=GB/ST=UK/L=Maidenhead/O=Rainbow-Frog/OU=servers/CN=client2/name=ovpn.local/emailAddress=root@localhost
Tue May  7 12:18:04 2013 us=720543 x.x.x.x:61034 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue May  7 12:18:04 2013 us=720587 x.x.x.x:61034 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue May  7 12:18:04 2013 us=720645 x.x.x.x:61034 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue May  7 12:18:04 2013 us=720657 x.x.x.x:61034 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue May  7 12:18:04 2013 us=727674 x.x.x.x:61034 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue May  7 12:18:04 2013 us=727726 x.x.x.x:61034 [client2] Peer Connection Initiated with x.x.x.x:61034
Tue May  7 12:18:04 2013 us=727784 client2/x.x.x.x:61034 MULTI: Learn: 10.8.0.2 -> client2/x.x.x.x:61034
Tue May  7 12:18:04 2013 us=727798 client2/x.x.x.x:61034 MULTI: primary virtual IP for client2/x.x.x.x:61034: 10.8.0.2
Tue May  7 12:18:06 2013 us=732839 client2/x.x.x.x:61034 PUSH: Received control message: 'PUSH_REQUEST'
Tue May  7 12:18:06 2013 us=732917 client2/x.x.x.x:61034 SENT CONTROL [client2]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0' (status=1)

If anyone could provide any insight I would be very grateful. As I say, outbound pings via tun0 to 10.8.0.0 work when iptables is turned off, and not when it is on. Outbound pings to other addresses (e.g. google.com) work fine at all times.

Apologies if I haven't provided enough information about anything and I will be very grateful for any help as this has been driving me crazy for days.

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.