stu2000
Dear all,
I have looked far and wide, gone through every tutorial, and I still cant get internet access when I am connected to my Rackspace cloud OpenVPN server.
My iptables file:
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
# Apply the same firewall rules for both input and forwarding
#-A INPUT -j RH-Firewall-1-INPUT
-A INPUT -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.8.0.0/24 -j ACCEPT
-A FORWARD -j REJECT
# Accept all traffic on the loopback device
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
# No idea wtf this is
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
# WTF is this!? 5353 is for what
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
# cups for printing etc, dont need this
#-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
#-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
# Adding this allows vpn access
-A RH-Firewall-1-INPUT -p udp -m udp --dport 1194 -j ACCEPT
# Accept established connections
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow SSH without this kiss goodbye to remote access
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
"/etc/sysconfig/iptables" 40L, 1232C
# Block anything that gets to here (has not fit a previous rule)
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
As you can see, out of frustration i have set it to just accept anything that comes in for the time being, just for testing ( -A INPUT -j ACCEPT )
I have made sure packet filtering setting is set to 1 and not 0 and performed the 'sysctl -p' or whatever.
The only changes to the server.conf file within /etc/openvpn/
# Push routes to the client to allow it
# to reach other private subnets behind
# the server. Remember that these
# private subnets will also need
# to know to route the OpenVPN client
# address pool (10.8.0.0/255.255.255.0)
# back to the OpenVPN server.
;push "route 192.168.10.0 255.255.255.0"
;push "route 192.168.20.0 255.255.255.0"
push "redirect-gateway def1"
push "dhcp-option DNS 10.8.0.1"
I am 90% sure it is a NAT issue, I have trid using this rule:
iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE
I have also tried combos with:
# All traffic going out on tun0 will have source changed to 10.8.0.6 after sent
iptables -t nat -A POSTROUTING --out-interface tun0 -j SNAT --to-source 10.8.0.6 -v
# change this so x.x.x.x is the ip of the server
iptables -t nat -A PREROUTING --source x.x.x.x --in-interface tun0 -j DNAT --to 10.8.0.6 -v
I am unable to ping 10.8.0.1 from the client but can from the server. I am unable to ping my clients ip at 10.8.0.6 from the server but obviously can from the client.
ifconfig is showing that the packets are being counted on tun0 on the client, but not on the server.
Any help is appreciated. I bought a book on 'linux networking' All that has been able to do for me is make me be able to translate the nat rules to english, but I have absolutely no concept of how this actually plugs together. Im guess it it should go like this:
client -> local gateway -> WAN -> server external ip address -> server internal ip 10.8.0.6 -> wan internet 50.56.x.x -> sites and then back again.
Get the feeling its just going like this when connected:
client -> local gateway -> WAN -> server external ip address -> packet lost / dropped
Stu
