Hi there,
i hope someone can help me,
first of all my vpn tunnels are being build up properly and authenticating them self's with certificates.
What i need is help with post-routing and masquerading through iptables.
I am not sure if this iptable setup is safe or any use, what do you think?
Also it seems that if i connect via tun0 i cant reach wan / names are not resolved..
Most important is that tun0 should only have one way access to wan not to lan.
I am open for any suggestions
Here you can see my current setup i am trying to achieve.
server.conf acting as server for TUN0 10.8.0.0/24
mode server
port 443
proto tcp
dev tun
ca /etc/openvpn/easy-rsa2/keys/ca.crt
cert /etc/openvpn/easy-rsa2/keys/server.crt
key /etc/openvpn/easy-rsa2/keys/server.key
dh /etc/openvpn/easy-rsa2/keys/dh1024.pem
log-append /var/log/openvpn/openvpn.log
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /etc/openvpn/ipp.txt
push "route-gateway 192.168.1.1"
push "redirect-gateway def1"
push "dhcp-option DNS 192.168.1.1"
keepalive 10 120
comp-lzo
user openvpn
group openvpn
persist-key
persist-tun
verb 3
mute 20
client.conf connecting as client TUN1 10.5.5.0/24:
# OpenVPN client configuration
client
dev tun
proto tcp
port 443
remote somedynamic.address.net
resolv-retry infinite
nobind
comp-lzo
persist-key
persist-tun
ca /etc/openvpn/easy-rsa2/keys/clientkeys/ca.crt
cert /etc/openvpn/easy-rsa2/keys/clientkeys/client_aalbert.crt
key /etc/openvpn/easy-rsa2/keys/clientkeys/client_aalbert.key
ns-cert-type server
verb 3
pull
mssfix 1300
Here my iptables config:
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [7478:491365]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 25566 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 9987 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 30033 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 10011 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 32400 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 32400 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 9090 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 2243 -j ACCEPT
-A INPUT -s 192.168.1.0/24 -p tcp -m state --state NEW -m tcp --dport 8081 -j ACCEPT
-A INPUT -s 192.168.1.0/24 -p tcp -m state --state NEW -m tcp --dport 5050 -j ACCEPT
-A INPUT -s 192.168.1.0/24 -p tcp -m state --state NEW -m tcp --dport 445 -j ACCEPT
-A INPUT -s 192.168.1.0/24 -p tcp -m state --state NEW -m tcp --dport 10000 -j ACCEPT
-A INPUT -s 192.168.1.0/24 -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -s 192.168.1.0/24 -p udp -m state --state NEW -m udp --dport 445 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -i eth1 -o tun1 -s 192.168.1.0/24 -d 172.16.16.0/24 -m conntrack --ctstate NEW -j ACCEPT
-A FORWARD -i tun1 -o eth1 -s 10.5.5.0/24 -d 192.168.1.0/24 -m conntrack --ctstate NEW -j ACCEPT
-A FORWARD -i tun0 -o eth1 -s 10.8.0.0/24 -d 192.168.1.1/32 -m conntrack --ctstate NEW -j ACCEPT
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
*nat
:PREROUTING ACCEPT [24:4135]
:POSTROUTING ACCEPT [4:264]
:OUTPUT ACCEPT [4:264]
-A POSTROUTING -o eth1 -s 10.8.0.0/24 -j MASQUERADE
COMMIT
Sysctl.conf
# Controls IP packet forwarding
net.ipv4.ip_forward = 1
The Router has a setup static route to the clients of tun1
ID Destination Network Subnet Mask Default Gateway Status
1 172.16.16.0 255.255.255.0 192.168.1.3 Enabled
