2

I set up a network in my studio's office with a Raspberry Pi serving as a VPN server for remote clients to access LAN resources.

Router port-forwards 1194 port to RPi, so it's accessible from the Internet.

After some time, I successfully set up OpenVPN with Shorewall to grant VPN clients access to selected LAN servers. But for some reason, VPN clients can't access Internet at all.

Here's my Shorewall setup:

I set up my three zones in zones, interfaces and host files.

zones

#ZONE   TYPE
fw      firewall
net     ipv4
loc:net ipv4
vpn     ipv4

interfaces

#ZONE   INTERFACE   OPTIONS
net     eth0        dhcp,tcpflags,nosmurfs,routefilter,logmartians,sourceroute=0
vpn     tun0

hosts

#ZONE           HOSTS
loc             eth0:192.168.200.0/24 (LAN subnet)

There's an entry in tunnels file for OpenVPN server:

tunnels

#TYPE           ZONE    GATEWAY
openvpnserver   net     0.0.0.0/0

Packets from VPN to eth0 are masqueraded, since the default gateway for LAN clients is the router, not RPi.

masq

#INTERFACE      SOURCE                      ADDRESS
eth0            10.8.0.0/24 (VPN subnet)    192.168.200.54 (local RPi address)

policy rejects connections from vpn to loc and accepts connections from vpn to net. Specific connections from vpn to loc are accepted in rules file.

What did I miss? Why VPN clients can't access Internet?

1

The problem was not in Shorewall config at all. There actually WAS access from VPN to the Internet, but VPN clients had wrong DNS server address.

There was a line in OpenVPN's server.conf

push "dhcp-option DNS 192.168.0.1"

Which didn't make sense in given setup. I corrected the address, and now VPN clients do have access to the Internet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.