Unable to access LAN/WAN through server

iverasp

Hi,

I realize this has been discussed before but I really can't seem to find out what I'm doing wrong. I have a feeling it has something to do with iptables; an area where I am somewhat of a newb.

I have OpenVPN installed on my router (Ubuntu 10.04) connected to WAN through eth2 (DHCP) and to LAN through br0 (192.168.1.1). I followed the ubuntu openvpn guide and can successfully connect from my android phone to the server, receiving an IP on the same subnet (192.168.1.201). The phone and server can ping/ssh/etc each other both ways. None of the other computers on the LAN can ping the phone and the phone can not ping the other computers (or the WAN).

I configured iptables according to the openvpn howto. Both tap0 and eth1 have promiscuous on and are bridged together (brctl show lists both).

The server.conf:

port 1194
proto udp
dev tap0
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh1024.pem
ifconfig-pool-persist ipp.txt
server-bridge 192.168.1.1 255.255.255.0 192.168.1.201 192.168.1.240
push "route 192.168.1.0 255.255.255.0"
keepalive 10 120
tls-auth ta.key 0 # This file is secret
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
push "dhcp-option DNS 192.168.1.1"
push "dhpc-option DOMAIN secret"
up "/etc/openvpn/up.sh br0"
down "/etc/openvpn/down.sh br0"

My iptables script (mostly copied from the gentoo router guide):

export LAN=br0
export WAN=eth2
export TAP=tap0

iptables -F
iptables -t nat -F

iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

iptables -I INPUT 1 -i ${LAN} -j ACCEPT
iptables -I INPUT 1 -i lo -j ACCEPT

# The rules from the openvpn howto
iptables -A INPUT -i ${TAP} -j ACCEPT
iptables -A INPUT -i ${LAN} -j ACCEPT
iptables -A FORWARD -i ${LAN} -j ACCEPT

iptables -A INPUT -p UDP --dport bootps ! -i ${LAN} -j REJECT
iptables -A INPUT -p UDP --dport domain ! -i ${LAN} -j REJECT

iptables -A INPUT -p UDP --dport openvpn -i ${WAN} -j ACCEPT

iptables -A INPUT -p TCP ! -i ${LAN} -d 0/0 --dport 0:1023 -j DROP
iptables -A INPUT -p UDP ! -i ${LAN} -d 0/0 --dport 0:1023 -j DROP

iptables -I FORWARD -i ${LAN} -d 192.168.1.0/255.255.255.0 -j DROP
iptables -A FORWARD -i ${LAN} -s 192.168.1.0/255.255.255.0 -j ACCEPT
iptables -A FORWARD -i ${WAN} -d 192.168.1.0/255.255.255.0 -j ACCEPT
iptables -t nat -A POSTROUTING -o ${WAN} -j MASQUERADE

Does anyone see the error? Thanks for any insight!

maikcat

did you enable ip forwarding on openvpn server?

also disable firewall during testing.

Michael.

iverasp

Yes, IP forwarding is enabled. I also tried after running "iptables -F && iptables -t nat -F" (which turns the firewall off, right?).

I tried OpenVPN on a virtual server behind the NAT which worked great using only these iptables rules

iptables -A INPUT -i tap0 -j ACCEPT
iptables -A INPUT -i br0 -j ACCEPT
iptables -A FORWARD -i br0 -j ACCEPT

The rest of the configuration is the same as on the router. The reason I tried using the router for VPN was that I read it would make the setup easier.