0

I'm running OpenVPN on Ubuntu 15.04.

When I connect to the server, I can connect and authenticate correctly (I use PAM auth because I'm lazy). Once connected I can't ping the server or access the internet except when I use my servers public IP then I get my website in a fashion because it can't load the style scripts and javascript in etc...

I'm pretty sure this is a iptables problem...

My goal is that clients can talk to each other and talk to the server while having unrestricted access to the internet.

I can post config files if needed.

Many thanks, Zac

Improve this question

1 Answer 1

Reset to default
0

sorry, this is not an answer but my reputation is to low to add a comment on your post. Please post your OpenVPN server config and all your iptables rules. (iptables -L -v and iptables -L -v -t nat)

My first guess would be that you have to add a SNAT or MASQUERADE in your iptables POSTROUTING chain.

Example: (10.8.0.0/24 is your VPN network, eth0 is your network interface connected to the internet)

iptables -t nat -A POSTROUTING -o eth0 -s 10.8.0.0/24 -j MASQUERADE

Also you would have to allow traffic in your FORWARDING chain.

Improve this answer
9
  • Hello, please find outputs pastebin.com/2rktvdmu I have tried adding some iptable rules but no luck so i flushed the (-F) and rebooted. Im running it on a vps so im guessing i need to use venet0 not eth0? Ignore all the other rules in the iptables, im running vestacp and need them for that. thanks for getting back to me.
    – user350312
    Apr 19, 2016 at 18:44
  • You can use the ifconfig command to see your network interfaces, but you're right, on a vps its often called venet0. You should replace the interface parameter within your iptables rules then. (Please also remove your public IP from the pastebin file)
    – user350306
    Apr 19, 2016 at 18:53
  • after running your command above and changing the interface, i get this back: "iptables v1.4.21: Can't use -i with POSTROUTING Try `iptables -h' or 'iptables --help' for more information."
    – user350312
    Apr 19, 2016 at 18:56
  • Sorry, it's -o venet0 (?) because its the outgoing interface. My bad. Where did you get this line in your server config from? 'push "route 0.0.0.0 255.0.0.0"' Doesn't make that much sense, does it? If you want to reach the local subnet of your server from the client, you have to put it in this line.
    – user350306
    Apr 19, 2016 at 19:05
  • tried that command and still no luck. I also removed the push "route 0.0.0.0 255.0.0.0 from my config and still no luck...
    – user350312
    Apr 19, 2016 at 20:51

You must log in to answer this question.