Hi All, I'm setting up a VPS to use as VPN server, running Debian 6. I'm following this guide, [url]http://library.linode.com/networking/openvpn/debian-6-squeeze[/url]. I'm down to the point titled "Tunnel All Connections through the VPN", and I'm getting an error when I enter the iptables commands. Here are their commands: [code]iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT iptables -A FORWARD -j REJECT iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE[/code] The first 3 are accepted, but on the last one I get the error message "No chain/target/match by that name." Here's the output of iptables -L. [code] lenwood@server:~# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT all -- 10.8.0.0/24 anywhere REJECT all -- anywhere anywhere reject-with icmp-port-unreachable Chain OUTPUT (policy ACCEPT) target prot opt source destination [/code] Can anyone help me? Thanks!

If that helps this is what I had to add in my Iptables to allow NAT from the vpn *nat :PREROUTING ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A POSTROUTING -s 10.8.0.0/16 -o venet0 -j MASQUERADE COMMIT and also make sure you forward packets too Jofre

iptables configuration

lenwood

Hi All, I'm setting up a VPS to use as VPN server, running Debian 6. I'm following this guide, http://library.linode.com/networking/openvpn/debian-6-squeeze. I'm down to the point titled "Tunnel All Connections through the VPN", and I'm getting an error when I enter the iptables commands.

Here are their commands:

iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
iptables -A FORWARD -j REJECT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

The first 3 are accepted, but on the last one I get the error message "No chain/target/match by that name." Here's the output of iptables -L.

lenwood@server:~# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     all  --  10.8.0.0/24          anywhere            
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Can anyone help me? Thanks!

vic0

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

if using a vps the interface is in most cases (virtual machine) "venet0" or something but not "eth0"
try ifconfig to figure out which interfaces you have

heimdall

Having eth-named interfaces on a VPS is common..

Type "iptables -t nat -L", this should list all chains in the nat table, what do you see there?

frankuit

it might be caused by the fact that there is no IPT_NAT support in your kernel.

try:

modprobe -l |grep ipt

That should return something like :

kernel/net/ipv4/netfilter/iptable_filter.ko
kernel/net/ipv4/netfilter/iptable_mangle.ko
kernel/net/ipv4/netfilter/iptable_nat.ko
kernel/net/ipv4/netfilter/iptable_raw.ko
kernel/net/ipv4/netfilter/iptable_security.ko
kernel/net/ipv4/netfilter/ipt_addrtype.ko
kernel/net/ipv4/netfilter/ipt_ah.ko
kernel/net/ipv4/netfilter/ipt_ecn.ko
kernel/net/ipv4/netfilter/ipt_CLUSTERIP.ko
kernel/net/ipv4/netfilter/ipt_ECN.ko
kernel/net/ipv4/netfilter/ipt_LOG.ko
kernel/net/ipv4/netfilter/ipt_MASQUERADE.ko
kernel/net/ipv4/netfilter/ipt_NETMAP.ko
kernel/net/ipv4/netfilter/ipt_REDIRECT.ko
kernel/net/ipv4/netfilter/ipt_REJECT.ko
kernel/net/ipv4/netfilter/ipt_ULOG.ko

if so, try:

modprobe ipt-MASQUERADE
modprobe ipt_NETMAP
modprobe iptable_nat

If that doesnt work, you might have a statically compiled kernel, in that case you might need to search and add the above options to your kernel and recompile..
just my thoughts on it, so i might be wrong!

Good luck,

Kind regards,
Frank Uittenbosch

jofre

If that helps this is what I had to add in my Iptables to allow NAT from the vpn

*nat
😛REROUTING ACCEPT [0:0]
😛OSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -s 10.8.0.0/16 -o venet0 -j MASQUERADE
COMMIT

and also make sure you forward packets too
Jofre