0

I have a OpenVPN server set up to redirect all traffic through the VPN (gateway).

That's working fine from the router (everything gets redirected). The router is set up to also serve a lan (eth1). Whenever I start the VPN server, all clients on the lan lose internet access. The idea is that all the lan clients also have their traffic redirected through the VPN server.

What am I missing?

# Generated by iptables-save v1.4.14 on Sat Jul 11 15:28:22 2015
*nat
:PREROUTING ACCEPT [256:26080]
:INPUT ACCEPT [37:4105]
:OUTPUT ACCEPT [28:1928]
:POSTROUTING ACCEPT [142:7940]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Sat Jul 11 15:28:22 2015
# Generated by iptables-save v1.4.14 on Sat Jul 11 15:28:22 2015
*filter
:INPUT ACCEPT [494:30153]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [832:131016]
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth1 -j ACCEPT
-A INPUT -i tun0 -j ACCEPT
-A INPUT ! -i eth1 -p udp -m udp --dport 67 -j REJECT --reject-with icmp-port-unreachable
-A INPUT ! -i eth1 -p udp -m udp --dport 53 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT ! -i eth1 -p tcp -m tcp --dport 0:1023 -j DROP
-A INPUT ! -i eth1 -p udp -m udp --dport 0:1023 -j DROP
-A FORWARD -d 10.13.37.0/24 -i eth1 -j DROP
-A FORWARD -s 10.13.37.0/24 -i eth1 -j ACCEPT
-A FORWARD -d 10.13.37.0/24 -i eth0 -j ACCEPT
-A FORWARD -d 10.13.37.0/24 -i tun0 -j ACCEPT
COMMIT
# Completed on Sat Jul 11 15:28:22 2015 
0

Okay, I simply forgot the masquerading:

-A POSTROUTING -o eth0 -j MASQUERADE
-A POSTROUTING -o tun0 -j MASQUERADE

It's solved.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.