Can access clients but can't access VPN server

inmsweantitrust

The clients are able to talk to each other, but they can't access any services (SSH, web, etc) on the VPN server itself.
The VPN server is able to access the clients without any issue.

here is my server config:

port 1111
proto udp
dev tun
ca keys/qtosw/ca.crt
cert keys/qtosw/qtosw.crt
key keys/qtosw/qtosw.key
dh keys/qtosw/dh2048.pem
server 10.8.0.0 255.255.255.0
crl-verify keys/qtosw/crl.pem
ifconfig-pool-persist servers/QTOSW/logs/ipp.txt
cipher AES-256-CBC
user nobody
group nogroup
status servers/QTOSW/logs/openvpn-status.log
log-append servers/QTOSW/logs/openvpn.log
verb 2
mute 20
max-clients 100
management 127.0.0.1 9550
keepalive 10 120
client-config-dir /etc/openvpn/servers/QTOSW/ccd
client-to-client
comp-lzo
persist-key
persist-tun
ccd-exclusive

and here is iptables -L -v

Chain INPUT (policy ACCEPT 4690 packets, 685K bytes)
 pkts bytes target     prot opt in     out     source               destination
 5742  700K LOG        all  --  eth0   any     anywhere             anywhere            LOG level debug prefix `BANDWIDTH_IN:'
    1    60 ACCEPT     all  --  tun0   any     anywhere             anywhere

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 LOG        all  --  any    eth0    anywhere             anywhere            LOG level debug prefix `BANDWIDTH_OUT:'
    0     0 LOG        all  --  eth0   any     anywhere             anywhere            LOG level debug prefix `BANDWIDTH_IN:'
    5   276 ACCEPT     all  --  tun0   any     anywhere             anywhere

Chain OUTPUT (policy ACCEPT 5373 packets, 916K bytes)
 pkts bytes target     prot opt in     out     source               destination
 6811  936K LOG        all  --  any    eth0    anywhere             anywhere            LOG level debug prefix `BANDWIDTH_OUT:'

I think it's an iptables thing, but I couldn't figure out the commands needed to forward the traffic to the server.

maikcat

how do you try to access your vpn server? (fe via ssh)

can you post the output of

lsof -i | grep ssh

Michael.

inmsweantitrust

Any way over the VPN, really, but the ways I've tried is:

SSH (22)
Web (80)
Samba (139 and 445)
Webmin Management(10000)

All of them time out.

inmsweantitrust

If it helps though, here's the output of lsof -i | grep ssh

sshd 683 root 3u IPv4 7047 0t0 TCP *:https (LISTEN)
sshd 683 root 4u IPv6 7049 0t0 TCP *:https (LISTEN)
sshd 683 root 5u IPv4 7051 0t0 TCP *:ssh (LISTEN)
sshd 683 root 6u IPv6 7053 0t0 TCP *:ssh (LISTEN)

inmsweantitrust

Consider it solved, it was an iptables thing. There was a script that came up when googling that I was hesitant to use because I'm not in the same location as the server, but I bit the bullet, ran it, and it worked. The script is below:

#!/bin/sh
echo "Flushing iptables rules..."
sleep 1
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT