I'm trying to configure a VPN on a new virtual server, powered with OpenVZ. I took the configuration of my current VPN, which is hosted on a Xen VPS and pasted it on my new server. After many tries, I look on different topics and see that OpenVZ doesn't support the
MASQUERADE option of
iptables. So I try to create a iptable.sh file, by following this blog post.
When I'm connected to the VPN, every page is fetched from my webserver (on the same machine as the VPN)... For example, if I try to access to http://www.google.com, I see the "It works" default page of the Apache2 server which is running. I don't really understand why... Here's my configuration:
mode server tls-server port 10735 proto udp dev tun0 # Certificates, blablah... # Virtual addr conf server 172.16.0.0 255.255.255.0 push "route 192.168.0.0 255.255.255.0" push "dhcp-option DNS 18.104.22.168" # Log, persitent connections, max clients, blabla..
Old iptable conf (on my previous server, with MASQUERADE working)
iptables -A FORWARD -s 172.16.0.0/24 -o eth0 -j ACCEPT iptables -t nat -A POSTROUTING -s 172.16.0.0/24 -o eth0 -j MASQUERADE
New iptables conf (stored in .sh file)
/sbin/iptables -F /sbin/iptables -P OUTPUT ACCEPT /sbin/iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT /sbin/iptables -A FORWARD -s 172.16.0.0/24 -j ACCEPT #/sbin/iptables -A FORWARD -j REJECT # Perform NATing on outgoing packets to change the IP address the packets come from /sbin/iptables -t nat -A POSTROUTING -s 172.16.0.0/24 -j SNAT --to-source 89.2xx.xxx.xxx <- my public addr /sbin/iptables -A INPUT -p udp --dport 10735 -j ACCEPT /sbin/iptables -A INPUT -p icmp -j ACCEPT /sbin/iptables -A INPUT -i lo -j ACCEPT /sbin/iptables -A INPUT -i tun0 -j ACCEPT /sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
Thanks in advance :)Additional information
No problem with the VPS connection, I can ping several domains/IP...
~# ping serverfault.com PING serverfault.com (22.214.171.124) 56(84) bytes of data. 64 bytes from stackoverflow.com (126.96.36.199): icmp_req=1 ttl=50 time=58.5 ms [...]
http://<public VPS IP>returns to the "It works" page I getted with the VPN.
1(IP forward activated)