Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Setting up an openvpn server with tls auth and ip forwarding.

I could connect to the vpn server just fine, but couldn't reach any outside connections

I could not successfully ping the google dns service

but I knew I could connect to the vpn server:

tcpdump -i tun0

where tun0 is my vpn interface and could see packets comming in from my client. But the problem was that my iptables chain was reversed

here is my old iptables

-A INPUT -i lo -j ACCEPT
-A INPUT -d -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p udp -m udp --dport 2345 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 2345 -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
-A FORWARD -i eth0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s -o eth0 -j ACCEPT

You can see that this is backwards

-A FORWARD -i eth0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s -o eth0 -j ACCEPT

before any forwarded packet is accepted. it is dropped immediately simply reversing it fixed the issue

-A FORWARD -i eth0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s -o eth0 -j ACCEPT

once I fixed it everything else worked just fine. The only problem is that I feel a little silly

share|improve this question
Can you post the full output of iptables-save? –  Isaac Freeman May 25 '13 at 17:47
@Isaac Freeman sure, edited into the post –  GoldenStake May 25 '13 at 17:56
Thanks. I was hoping there would be something else in the iptables causing problems, but it's pretty vanilla. Hopefully someone else will be able to help. :} –  Isaac Freeman May 25 '13 at 18:28
I think what you want is to use either the PREROUTING table or the FORWARD table instead of POSTROUTING, but I'm not positive. Try tinkering with those to see if you get anywhere. There's a pretty detailed guide on iptables routing here. –  Isaac Freeman May 25 '13 at 18:32
If you solved the problem, please post an Answer. Questions are for Questions. –  Michael Hampton May 27 '13 at 2:10

1 Answer 1

have you tried accessing a website/server via ip to exclude DNS as a error source? If that works try adding push "dhcp-option DNS" to your server.conf .This pushes the Google-DNS server to the client, helping to resolve the adresses

share|improve this answer
else this is my iptables pastebin.com –  niklaskar May 25 '13 at 20:34
yeah, from my client i cant ping any ip other than the vpn server –  GoldenStake May 25 '13 at 23:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.