0

I have a server set up with OpenVPN. While connected to the VPN, all external websites work great, but when I try access a site that is hosted on the same server, it fails to connect. I can ssh into the server and pull the site up with lynx with no problem. Without iptables started on the server, it works over the vpn (and obviously from everywhere else). Here are my iptables rules. They are cobbled together from various online sources.

# Generated by iptables-save v1.4.14
*nat
:PREROUTING ACCEPT [14:1141]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [4:280]
:POSTROUTING ACCEPT [7:510]
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
COMMIT
# Completed
# Generated by iptables-save v1.4.14
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/8 ! -i lo -j REJECT --reject-with icmp-port-unreachable
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -s OFFICEIP/32 -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -s SERVERIP/32 -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -s OFFICEIP/32 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p udp -m udp --dport 1194 -j ACCEPT
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
-A INPUT -j DROP
-A INPUT -i tun+ -j ACCEPT
-A INPUT -i tap+ -j ACCEPT
-A FORWARD -i tun+ -j ACCEPT
-A FORWARD -i eth0 -o tun+ -j ACCEPT
-A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.8.0.0/24 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i tun+ -j ACCEPT
-A FORWARD -i tap+ -j ACCEPT
-A OUTPUT -j ACCEPT
COMMIT
2
  • Is your end of the OpenVPN connection the "OFFICEIP"? Or something else? Where does 10.8.0.0/24 fit in with respect to OFFICEIP and SERVERIP? Commented Feb 12, 2015 at 15:07
  • @roaima 10.8.0.0/24 should the the range of ips assigned to users connected to the VPN. OFFICEIP is the static ip of the office that should not have to connect to the VPN to view this website, that part works. SERVERIP is the external IP of the OpenVPN & HTTP server
    – edwlarkey
    Commented Feb 12, 2015 at 15:21

1 Answer 1

0

You have a policy of "ACCEPT everything that isn't explicitly denied". This isn't usually best practice but you may have a good reason for it. However, it does mean that one or more of your own DROP/REJECT rules are the ones causing the problem. (It's not a case of having missed an ACCEPT somewhere, and the policy then rejecting traffic.)

As a result, you can put a debug logging line ahead of each of the DROP/REJECT lines:

-A INPUT -d 127.0.0.0/8 ! -i lo -j LOG --log-prefix "iptables denied #1: " --log-level 7
-A INPUT -d 127.0.0.0/8 ! -i lo -j REJECT --reject-with icmp-port-unreachable
...
-A INPUT -j LOG --log-prefix "iptables denied #2: " --log-level 7
-A INPUT -j DROP
...
-A FORWARD -j LOG --log-prefix "iptables denied #3: " --log-level 7
-A FORWARD -j REJECT --reject-with icmp-port-unreachable
...
-A FORWARD -j LOG --log-prefix "iptables denied #4: " --log-level 7
-A FORWARD -j REJECT --reject-with icmp-port-unreachable

It's not clear whether you are using tun (routing) or tap (bridging) for your OpenVPN connection. Mostly you're covering yourself by accepting traffic for both, but in the FORWARD block you have three ACCEPT lines only for tun (routing). It would be worth either removing the tap lines or adding in the missing lines to remain consistent.

It appears to me that there is no general ACCEPT rule for traffic to port 80. Can your website running on this host be seen at all from the Internet at large? (I assume it should be.) Alternatively, if the website is only for internal use, there should be an ACCEPT rule for traffic from your 10.8.0.0/24 subnet.

1
  • Thanks for your answer. I have cleaned up my rules to be more consistent by only using tun. This is a really good illustration of setting up logging for iptables. Logging has revealed that my IP address is not really changing when connecting to the VPN.
    – edwlarkey
    Commented Feb 12, 2015 at 19:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .