nekromaniak
hi there, im trying to configure my OpenVPN server to restrict all traffics from the connecting clients to route through the server. i've gone through the manual as well as some past topics created on this forum regarding the same issue, but still i cant get it to work. The clients are able to go into my local networks, but not to the Internet. Not sure if this is a misconfiguration on Shorewall or OpenVPN, since im still fairly new to both.
My VPN server is running on Debian OS with Shorewall firewall installed. Also i've 2 instances of VPN running, one is without forcing the traffic to go through the server, another is to force it. And here's the server config for the latter:
cert /etc/openvpn/keys/cool-i.crt
key /etc/openvpn/keys/cool-i.key
dh /etc/openvpn/keys/dh1024.pem
server 10.138.138.0 255.255.255.0
;ifconfig-pool-persist ipp-gw.txt (i tried both with and without this line)
push "redirect-gateway def1"
push "route 172.28.29.0 255.255.255.0" (dmz area)
push "route 172.19.133.0 255.255.255.0" (local area)
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
duplicate-cn
keepalive 10 120
comp-lzo
user nobody
group users
persist-key
persist-tun
status openvpn-gw-status.log
log openvpn-gw.log
verb 3
plugin /usr/lib/openvpn/openvpn-auth-pam.so system-auth
I set my shorewall to allow all traffics from tunnel to net (outgoing interface):
###############################################################################
#SOURCE DEST POLICY LOG LEVEL LIMIT:BURST
vpn1 net ACCEPT
vpn1 loc ACCEPT
vpn1 dmz ACCEPT
This is what i get with iptables -t nat -L -n on server
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
dnat all -- 0.0.0.0/0 0.0.0.0/0
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
eth2_masq all -- 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain dnat (1 references)
target prot opt source destination
net_dnat all -- 0.0.0.0/0 0.0.0.0/0
net_dnat all -- 0.0.0.0/0 0.0.0.0/0
Chain eth2_masq (1 references)
target prot opt source destination
SNAT all -- 10.138.138.0/24 0.0.0.0/0 to:192.168.0.250
SNAT all -- 192.168.19.0/24 0.0.0.0/0 to:192.168.0.250
SNAT all -- 10.0.0.0/8 0.0.0.0/0 to:192.168.0.250
SNAT all -- 169.254.0.0/16 0.0.0.0/0 to:192.168.0.250
SNAT all -- 172.16.0.0/12 0.0.0.0/0 to:192.168.0.250
SNAT all -- 192.168.0.0/16 0.0.0.0/0 to:192.168.0.250
and here's my VPN client config running on vm windows 7:
client
dev tun
proto udp
remote x.x.x.x 31368
resolv-retry infinite
nobind
auth-user-pass
persist-key
persist-tun
ca ca.crt
cert cool-i-client.crt
key cool-i-client.key
comp-lzo
verb 3
route-method exe
route-delay 2
this is what i get with route print on client PC:
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 172.19.133.252 172.19.133.251 266
0.0.0.0 128.0.0.0 10.138.138.9 10.138.138.10 31
10.138.138.1 255.255.255.255 10.138.138.9 10.138.138.10 31
10.138.138.8 255.255.255.252 On-link 10.138.138.10 286
10.138.138.10 255.255.255.255 On-link 10.138.138.10 286
10.138.138.11 255.255.255.255 On-link 10.138.138.10 286
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
128.0.0.0 128.0.0.0 10.138.138.9 10.138.138.10 31
172.19.133.0 255.255.255.0 On-link 172.19.133.251 266
172.19.133.0 255.255.255.0 10.138.138.9 10.138.138.10 31
172.19.133.251 255.255.255.255 On-link 172.19.133.251 266
172.19.133.255 255.255.255.255 On-link 172.19.133.251 266
172.28.29.0 255.255.255.0 10.138.138.9 10.138.138.10 31
175.139.187.97 255.255.255.255 172.19.133.252 172.19.133.251 11
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 172.19.133.251 266
224.0.0.0 240.0.0.0 On-link 10.138.138.10 286
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 172.19.133.251 266
255.255.255.255 255.255.255.255 On-link 10.138.138.10 286
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.0.0 0.0.0.0 172.19.133.252 Default
===========================================================================
Did i screw up somewhere?
maikcat
hi there,
keep in mind that when you use redirect gateway you are pushing ALL
the traffic through vpn tunnel thus pushing other routes makes no meaning.
you dont post the output of
iptables -L -v
chain FORWARD is what i need to see...
Michael.
nekromaniak
here you go:
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
1004K 87M dynamic all -- any any anywhere anywhere ctstate INVALID,NEW
524K 27M TCPMSS tcp -- any any anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
0 0 ppp0_fwd all -- ppp0 any anywhere anywhere
13M 13G eth2_fwd all -- eth2 any anywhere anywhere
11M 2759M eth3_fwd all -- eth3 any anywhere anywhere
1606K 909M dmz_frwd all -- eth0 any anywhere anywhere
1309 167K vpn0_frwd all -- tun0 any anywhere anywhere (this is the vpn without all traffic going through it)
2834 196K vpn1_frwd all -- tun1 any anywhere anywhere (this is the vpn with all traffic going through it)
0 0 ACCEPT all -- any any anywhere anywhere ctstate RELATED,ESTABLISHED
0 0 Reject all -- any any anywhere anywhere
0 0 LOG all -- any any anywhere anywhere LOG level info prefix `Shorewall:FORWARD:REJECT:'
0 0 reject all -- any any anywhere anywhere [goto]
nekromaniak
more detailed:
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
8930K 675M dynamic all -- any any anywhere anywhere ctstate INVALID,NEW
5130K 263M TCPMSS tcp -- any any anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
0 0 ppp0_fwd all -- ppp0 any anywhere anywhere
133M 129G eth2_fwd all -- eth2 any anywhere anywhere
130M 64G eth3_fwd all -- eth3 any anywhere anywhere
11M 5257M dmz_frwd all -- eth0 any anywhere anywhere
47331 4294K vpn0_frwd all -- tun0 any anywhere anywhere
19257 1359K vpn1_frwd all -- tun1 any anywhere anywhere
0 0 ACCEPT all -- any any anywhere anywhere ctstate RELATED,ESTABLISHED
2 80 Reject all -- any any anywhere anywhere
0 0 LOG all -- any any anywhere anywhere LOG level info prefix `Shorewall:FORWARD:REJECT:'
0 0 reject all -- any any anywhere anywhere [goto]
Chain eth2_fwd (1 references)
pkts bytes target prot opt in out source destination
0 0 smurfs all -- any any anywhere anywhere ctstate INVALID,NEW
73M 85G tcpflags tcp -- any any anywhere anywhere
133M 129G net_frwd all -- any any anywhere anywhere
Chain eth3_fwd (1 references)
pkts bytes target prot opt in out source destination
8665K 658M smurfs all -- any any anywhere anywhere ctstate INVALID,NEW
66M 17G tcpflags tcp -- any any anywhere anywhere
115M 57G loc_frwd all -- any any 172.19.133.0/24 anywhere
15M 6292M loc2_frwd all -- any any 192.168.19.0/24 anywhere
Chain dmz_frwd (1 references)
pkts bytes target prot opt in out source destination
250K 15M smurfs all -- any any anywhere anywhere ctstate INVALID,NEW
11M 5757M tcpflags tcp -- any any anywhere anywhere
0 0 dmz2net all -- any ppp0 anywhere anywhere
1552K 93M dmz2net all -- any eth2 anywhere anywhere
9926K 5674M dmz2loc all -- any eth3 anywhere 172.19.133.0/24
0 0 dmz2loc2 all -- any eth3 anywhere 192.168.19.0/24
0 0 dmz2vpn0 all -- any tun0 anywhere anywhere
4 437 dmz2vpn1 all -- any tun1 anywhere anywhere
Chain vpn0_frwd (1 references)
pkts bytes target prot opt in out source destination
1829 85164 smurfs all -- any any anywhere anywhere ctstate INVALID,NEW
47331 4294K tcpflags tcp -- any any anywhere anywhere
0 0 vpn02net all -- any ppp0 anywhere anywhere
25433 3309K vpn02net all -- any eth2 anywhere anywhere
21898 986K vpn02loc all -- any eth3 anywhere 172.19.133.0/24
0 0 vpn02loc2 all -- any eth3 anywhere 192.168.19.0/24
0 0 vpn02dmz all -- any eth0 anywhere anywhere
0 0 vpn02vpn1 all -- any tun1 anywhere anywhere
Chain vpn1_frwd (1 references)
pkts bytes target prot opt in out source destination
4521 316K smurfs all -- any any anywhere anywhere ctstate INVALID,NEW
396 21302 tcpflags tcp -- any any anywhere anywhere
0 0 vpn12net all -- any ppp0 anywhere anywhere
19050 1346K vpn12net all -- any eth2 anywhere anywhere
55 2844 vpn12loc all -- any eth3 anywhere 172.19.133.0/24
105 6748 vpn12loc2 all -- any eth3 anywhere 192.168.19.0/24
4 258 vpn12dmz all -- any eth0 anywhere anywhere
0 0 vpn12vpn0 all -- any tun0 anywhere anywhere
16 1176 ACCEPT all -- any tun1 anywhere anywhere
Chain loc_frwd (1 references)
pkts bytes target prot opt in out source destination
0 0 loc2net all -- any ppp0 anywhere anywhere
106M 52G loc2net all -- any eth2 anywhere anywhere
188K 16M loc2loc2 all -- any eth3 anywhere 192.168.19.0/24
9752K 4923M loc2dmz all -- any eth0 anywhere anywhere
23529 15M loc2vpn0 all -- any tun0 anywhere anywhere
0 0 loc2vpn1 all -- any tun1 anywhere anywhere
Chain loc2_frwd (1 references)
pkts bytes target prot opt in out source destination
0 0 loc22net all -- any ppp0 anywhere anywhere
15M 6293M loc22net all -- any eth2 anywhere anywhere
162K 18M loc22loc all -- any eth3 anywhere 172.19.133.0/24
0 0 loc22dmz all -- any eth0 anywhere anywhere
0 0 loc22vpn0 all -- any tun0 anywhere anywhere
41 14927 loc22vpn1 all -- any tun1 anywhere anywhere
maikcat
hi there,
i think a rule (forward chain) droping traffic from tun interface destined your local lan
would do the trick...
Michael.
nekromaniak
sorry i dont quite get it. do you mean creating a rule in my Forward chain to drop traffic from tun to local?
maikcat
hi there,
im trying to configure my OpenVPN server to restrict all traffics from the connecting clients to route through the server
do you mean creating a rule in my Forward chain to drop traffic from tun to local?
yeap...
Michael.
nekromaniak
ok i'll give it a try and see how, since im configurating netfilter using shorewall, so not quite sure whats the equivalent iptables command. hope i dont bring down the whole thing.
but wouldnt the rule you suggested block the connecting client from accessing my local networks? i need them to be able to access the local networks and the internet, but all through the vpn server.
maikcat
maybe i misunderstood you...
can you please write once more which traffic do you want to allow and which to deny?
(from where to where)
:?
Michael.
nekromaniak
Sorry for the confusion, all right what i'm trying to do is i've one physical server/gateway with 2 instances of OPENVPN running. i need one of the OPENVPN instances to have all the clients traffic to pass through it. Here're the scenarios:
1. The 1st instance of OPENVPN runs on tun0 and it doesnt force all connecting client's traffic to route through the VPN server. Only traffic going into my local and DMZ networks go through the VPN while traffic to internet go out on default route. We can ignore this instance since i can get it to work without any problem.
2. The 2nd instance of OPENVPN runs on tun1 and it forces ALL connecting client's traffic to route through the VPN server. This includes traffic to my LAN, DMZ as well as to the internet. When the client gets connected, i can access the LAN and DMZ area without problem, but when i try to, say, ping 8.8.8.8 or access a web page, i failed to get any respond.
Let me know should you need any further clarification and thanks in advance.
maikcat
but when i try to, say, ping 8.8.8.8 or access a web page, i failed to get any respond.
if you do a tracert 8.8.8.8 what do you see?
Michael
nekromaniak
It managed to reach the server only.
C:\Users\user>tracert 8.8.8.8
Tracing route to 8.8.8.8 over a maximum of 30 hops
1 59 ms 59 ms 59 ms 10.138.138.1
2 * * * Request timed out.
3 * * * Request timed out.
4 * * * Request timed out.
5 * * * Request timed out.
....
....
dropje
Have you enabled IP forwarding? sysctl -A | grep 'net.ipv4.conf.all.forwarding'
Try tcpdumping on both the LAN interface of your server and the gateway of your local LAN with icmp requests. Tell us what you see.
nekromaniak
net.ipv4.conf.all.forwarding = 1
Well, i've multiple interfaces on my vpn (gateway) server. Local, dmz, internet, tun0 & tun1.. which interface should i run tcpdump with?
And connecting client is running on vm win7, so i use windump on TAP or local area connection?
i tried to run tcpdump on tun1 of VPN server and TAP of win7 client followed by ping request to 8.8.8.8 before, but all i could see is echo request on both interfaces but no reply. plus something like these:
16:52:28.088455 IP 10.138.138.6.62365 > google-public-dns-a.google.com.domain: 32359+ PTR? 7.138.138.10.in-addr.arpa. (43)
16:52:29.073675 IP 10.138.138.6.62365 > google-public-dns-a.google.com.domain: 32359+ PTR? 7.138.138.10.in-addr.arpa. (43)
16:52:29.074052 IP 10.138.138.6.62365 > google-public-dns-b.google.com.domain: 32359+ PTR? 7.138.138.10.in-addr.arpa. (43)
16:52:30.073155 IP 10.138.138.6.62365 > google-public-dns-b.google.com.domain: 32359+ PTR? 7.138.138.10.in-addr.arpa. (43)
maikcat
My VPN server is running on Debian OS with Shorewall firewall installed.
i dont think shorewall would leave ip forwarding off...
can you please post the output of ifconfig on your openvpn server?
Michael.
nekromaniak
eth0 Link encap:Ethernet HWaddr d8:5d:4c:83:00:a3
inet addr:172.28.29.250 Bcast:172.28.29.255 Mask:255.255.255.0
inet6 addr: fe80::da5d:4cff:fe83:a3/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:37864705 errors:0 dropped:79 overruns:0 frame:0
TX packets:38122138 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:15962205538 (14.8 GiB) TX bytes:20670067236 (19.2 GiB)
Interrupt:20 Base address:0xac00
eth1 Link encap:Ethernet HWaddr 74:ea:3a:80:21:41
inet6 addr: fe80::76ea:3aff:fe80:2141/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:71678 errors:0 dropped:0 overruns:0 frame:0
TX packets:32995 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:5270548 (5.0 MiB) TX bytes:990672 (967.4 KiB)
Interrupt:16 Base address:0xe000
eth2 Link encap:Ethernet HWaddr d8:5d:4c:83:22:88
inet addr:192.168.0.250 Bcast:192.168.0.255 Mask:255.255.255.0
inet6 addr: fe80::da5d:4cff:fe83:2288/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:232977070 errors:0 dropped:0 overruns:0 frame:0
TX packets:196988332 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:243066402097 (226.3 GiB) TX bytes:77659541107 (72.3 GiB)
Interrupt:22 Base address:0xa800
eth3 Link encap:Ethernet HWaddr 00:16:17:58:90:d0
inet addr:172.19.133.250 Bcast:172.19.133.255 Mask:255.255.255.0
inet6 addr: fe80::216:17ff:fe58:90d0/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:228053710 errors:0 dropped:0 overruns:0 frame:0
TX packets:258726855 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:90848861143 (84.6 GiB) TX bytes:251268416296 (234.0 GiB)
Interrupt:17
eth3:0 Link encap:Ethernet HWaddr 00:16:17:58:90:d0
inet addr:192.168.19.2 Bcast:192.168.19.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
Interrupt:17
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:208 errors:0 dropped:0 overruns:0 frame:0
TX packets:208 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:17331 (16.9 KiB) TX bytes:17331 (16.9 KiB)
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 -00
inet addr:10.128.128.1 P-t-P:10.128.128.2 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:47543 errors:0 dropped:0 overruns:0 frame:0
TX packets:58951 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:4309030 (4.1 MiB) TX bytes:52946429 (50.4 MiB)
tun1 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 -00
inet addr:10.138.138.1 P-t-P:10.138.138.2 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:35326 errors:0 dropped:0 overruns:0 frame:0
TX packets:102 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:2499678 (2.3 MiB) TX bytes:15999 (15.6 KiB)
maikcat
can you post the default gateway of the shorewall?
Michael.
nekromaniak
Destination Gateway Genmask Flags Metric Ref Use Iface
10.138.138.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
10.128.128.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun1
10.128.128.0 10.128.128.2 255.255.255.0 UG 0 0 0 tun1
192.168.19.0 0.0.0.0 255.255.255.0 U 0 0 0 eth3
192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth2
172.28.29.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
10.138.138.0 10.138.138.2 255.255.255.0 UG 0 0 0 tun0
172.19.133.0 0.0.0.0 255.255.255.0 U 0 0 0 eth3
0.0.0.0 192.168.0.1 0.0.0.0 UG 0 0 0 eth2
nekromaniak
still cant get it to work.. i wonder if this is caused by misconfiguration on vpn or some restriction on firewall/forwarding.
