1

I am not a very experienced user but I do have determination, after a week with no progres it is getting rough.

I have two NIC, one facing to the internet and one towards the internal network. Both computers from the internal network and roadwarriors from the internet connect with ipsec and access the server resources. The clients should be able to browse the internet while connected with ipsec. All internet trafic should be routed through openvpn tunnel.

-----------------------------|          SERVER         |-----------------------------
-----------------------------|192.168.1.1   192.168.2.1|-----------------------------
-------------{INTERNET}======{eth0                 eth1}==<ROUTER>==<INTERNAL NETWORK>
-----------------------------|    \               /    |-----------------------------
-----------------------------|    {openvpn---tun0}     |-----------------------------
-----------------------------|                  /      |-----------------------------
<ROADWARRIOR>==>{INTERNET}==>{eth0--------------       |-----------------------------
-----------------------------|192.168.1.1              |-----------------------------

IPSec works and I can connect to the server. OpenVPN works as well. It is the routing that is the major issue. How do I rout all traffic destined for the internet through the openVPN tunnel? I have the following iptables rules but they dont work. What am I missing?

iptables -P INPUT   DROP
iptables -P OUTPUT  DROP 
iptables -P FORWARD DROP

iptables -A INPUT -i tun0 -j ACCEPT
iptables -A INPUT -i eth0 -p udp -m conntrack --ctstate ESTABLISHED --dport 1194 -j ACCEPT

iptables -A OUTPUT -o tun0 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp -m conntrack --ctstate NEW,ESTABLISHED --dport 1194 -j ACCEPT

# allow IPSec INPUT on the EXTERNAL interface
iptables -A INPUT -p udp -d 192.168.1.1 -s 0.0.0.0/0 --dport 500 -j ACCEPT
iptables -A INPUT -p udp -d 192.168.1.1 -s 0.0.0.0/0 --dport 4500 -j ACCEPT
iptables -A INPUT -p esp -d 192.168.1.1 -s 0.0.0.0/0 -j ACCEPT

# allow IPSEC OUTPUT on the EXTERNAL interface
iptables -A OUTPUT -p udp -d 0.0.0.0/0 -s 192.168.1.1 --sport 500 -j ACCEPT
iptables -A OUTPUT -p udp -d 0.0.0.0/0 -s 192.168.1.1 --sport 4500 -j ACCEPT
iptables -A OUTPUT -p esp -d 0.0.0.0/0 -s 192.168.1.1 -j ACCEPT

# allow IPSec INPUT on the INTERNAL interface
iptables -A INPUT -p udp -d 192.168.2.1 -s 0.0.0.0/0 --dport 500 -j ACCEPT
iptables -A INPUT -p udp -d 192.168.2.1 -s 0.0.0.0/0 --dport 4500 -j ACCEPT
iptables -A INPUT -p esp -d 192.168.2.1 -s 0.0.0.0/0 -j ACCEPT

# allow IPSec OUTPUT on the INTERNAL interface
iptables -A OUTPUT -p udp -d 0.0.0.0 -s 192.168.2.1 --sport 500 -j ACCEPT
iptables -A OUTPUT -p udp -d 0.0.0.0 -s 192.168.2.1 --sport 4500 -j ACCEPT

EDIT: I had previously enabled ip_forward and unfortunately the rules you suggested did not aid me I'm afraid. I am still unable to access the internet. Am I missing something?

0

You need to set up a MASQUERADE rule for the traffic going from the OpenVPN interface to the internet. Also, have you enabled ip_forward?

iptables -t nat -A PREROUTING -i tun0 -j MARK --set 0x029a
iptables -A FORWARD -i tun0 -m mark --mark 0x29a -j ACCEPT
iptables -t nat -A POSTROUTING -o eth1 -m mark --mark 0x29a -j MASQUERADE

Basically, your current rules are dropping all forwarding traffic coming from tun0.

To enable ip_forward, you have to set this value on /etc/sysctl.conf:

net.ipv4.ip_forward = 1

That value will work upon reboot, but you can also change it immediately:

echo 1 > /proc/sys/net/ipv4/ip_forward

That should work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.