Using openvpn to mask my ip address

alfuananzo

Hello everyone!

Im currently exploring openVPN for a school project. Im using it on a centOS 6.3.
After some trouble configuring it on my machine i managed to establish a VPN connection with the openVPN client.

Unfortunatly, it doesnt seem to mask my IP address or forward my traffic. I can still connect to my server just fine, but the internet is not accesible I have tried multiple tutorials or firewall rules but it doesnt seem to work.

My best guess would be some ports are blocked for my VPS. If i understand openVPN correctly, the connection is established on a user defined port in the server.conf, but where does the data go trough? The same port? In any case my configuration files are:

Client config file: http://pastebin.com/MFzBQt7J
Server config file: http://pastebin.com/RZJ2heks

The following output is shown when i manually start my server.conf file with openvpn server.conf and connect my vpn user.
http://pastebin.com/jcAKePLW

For my firewall i entered this rule:

*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -o eth0 -j MASQUERADE

I hope someone can help me solve my problem, and make me understand how openVPN works.
If you need anything else to better understand my problem, please let me know.

-Alfuananzo

P.S English is not my first language, i apoligize for any spelling mistakes

maikcat

hi there,

i will copy your configs here,

client

    client
    dev tun
    proto tcp
    remote #server ip# #my custom port#
    resolv-retry infinite
    nobind
    tun-mtu 1500
    tun-mtu-extra 32
    mssfix 1450
    persist-key
    persist-tun
    ca ca.crt
    auth-user-pass
    comp-lzo
    reneg-sec 0
    verb 3

server.conf

    port #my custom port#
    proto tcp
    dev tun
    tun-mtu 1500
    tun-mtu-extra 32
    mssfix 1450
    reneg-sec 0
    ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
    cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
    key /etc/openvpn/easy-rsa/2.0/keys/server.key
    dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
    plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so /etc/pam.d/login
    client-cert-not-required
    username-as-common-name
    server 10.8.0.0 255.255.255.0
    push "redirect-gateway def1"
    push "dhcp-option DNS 8.8.8.8"
    push "dhcp-option DNS 8.8.4.4"
    keepalive 5 30
    comp-lzo
    persist-key
    persist-tun
    status 1194.log
    verb 3

maikcat

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

alfuananzo

Thanks for taking your time to help me figure out this problem.

> can you ping 10.8.0.1 from your client?
Yes

> can you ping openvpn servers LAN ip address?
Yes

> did you enabled ip forwarding on centos?

net.ipv4.ip_forward = 1

> can you post the output of sestatus on centos?

SELinux status:                 disabled

> can you the post the output of iptables -L -t nat -v on centos?

Chain PREROUTING (policy ACCEPT 2777 packets, 361K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 132K packets, 5859K bytes)
 pkts bytes target     prot opt in     out     source               destination
 1082  255K MASQUERADE  all  --  any    eth0    anywhere             anywhere

Chain OUTPUT (policy ACCEPT 133K packets, 6114K bytes)
 pkts bytes target     prot opt in     out     source               destination


Chain OUTPUT (policy ACCEPT 133K packets, 6113K bytes)
 pkts bytes target     prot opt in     out     source               destination

> can you the post the output of iptables -L -vt on centos?
It seems its missing an argument, did you mean iptables -L -vt mangle?

> can you the post the output of ifconfig on centos?

eth0      Link encap:Ethernet  HWaddr 00:50:56:A3:00:87
          inet addr:145.92.6.64  Bcast:145.92.7.255  Mask:255.255.254.0
          inet6 addr: fe80::250:56ff:fea3:87/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:70635 errors:0 dropped:0 overruns:0 frame:0
          TX packets:9615 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:5280038 (5.0 MiB)  TX bytes:3052094 (2.9 MiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:288010 errors:0 dropped:0 overruns:0 frame:0
          TX packets:288010 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:13075132 (12.4 MiB)  TX bytes:13075132 (12.4 MiB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:537 errors:0 dropped:0 overruns:0 frame:0
          TX packets:88 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:34754 (33.9 KiB)  TX bytes:8293 (8.0 KiB)

maikcat

> can you the post the output of iptables -L -vt on centos?
It seems its missing an argument, did you mean iptables -L -vt mangle?

my bad... 🙂 typo error..

iptables -L -v

if you do a traceroute to 8.8.8.8 what it shows...?

Michael.

alfuananzo

> iptables -L -v

I edited out my SSH port for security, i hope thats not a problem.

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
 149K 7592K ACCEPT     all  --  any    any     anywhere             anywhere            state RELATED,ESTABLISHED
  703 58670 ACCEPT     icmp --  any    any     anywhere             anywhere
 132K 5813K ACCEPT     all  --  lo     any     anywhere             anywhere
   19  1644            tcp  --  any    any     anywhere             anywhere            tcp dpt:#ssh port# recent: SET name: ssh side: source
   17  1540 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:#ssh port# !recent: CHECK seconds: 60 hit_count: 4 name: ssh side: source
    2   104 LOG        tcp  --  any    any     anywhere             anywhere            tcp dpt:#ssh port# LOG level warning
    5   256            tcp  --  any    any     anywhere             anywhere            tcp dpt:http recent: SET name: HTTP side: source
    5   256 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:http !recent: CHECK seconds: 10 hit_count: 20 name: HTTP side: source
    2    88            tcp  --  any    any     anywhere             anywhere            tcp dpt:https recent: SET name: HTTPS side: source
    2    88 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:https !recent: CHECK seconds: 10 hit_count: 20 name: HTTPS side: source
   32  1664 ACCEPT     tcp  --  any    any     anywhere             anywhere            state NEW tcp dpt:irdmi
    6   312 ACCEPT     tcp  --  any    any     anywhere             anywhere            state NEW tcp dpt:8015
    3   152 ACCEPT     tcp  --  any    any     anywhere             anywhere            state NEW tcp dpt:ca-audit-da
 2074  341K REJECT     all  --  any    any     anywhere             anywhere            reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
 2492  160K REJECT     all  --  any    any     anywhere             anywhere            reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT 283K packets, 14M bytes)
 pkts bytes target     prot opt in     out     source               destination

> if you do a traceroute to 8.8.8.8

Tracing route to 8.8.8.8 over a maximum of 30 hops

  1     *       32 ms     *     10.8.0.1
  2     *        *        *     Request timed out.
  3     *     10.8.0.1  reports: Destination host unreachable.

Trace complete.

It seems to not pass my server.
If it helps only a few ports on my server are open (not by my server firewall, but one for the VMware cluster(22, 80, 443, 25 and the range 8000 - 8080)). Could this be the problem? My vpn connection is established on port 8015.

maikcat

hi there,

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
2492 160K REJECT all -- any any anywhere anywhere reject-with icmp-host-prohibited

can you disable this rule for testing....?

Michael.

alfuananzo

Hey,

Great! its working now. All traffic is put trough and my IP address is masked correctly.
Is it a security issue if i leave the firewall rule disabled?

Thanks for the help so far!

maikcat

Is it a security issue if i leave the firewall rule disabled?

yes, you should refine traffic for that rule,

generally try to use drop for default action and allow the filter you want..

regards,

Michael.

alfuananzo

Hey,

What do you exactly mean with refine the traffic? (Sorry, im not that great at iptables).
Is there a way to only forward the traffic from my subnet 10.8.0.0/24?

maikcat

hi there,

the forwarding chain "catches" all traffic passing through network interfaces,

the most simple for you to do is add an allow rule BEFORE the reject one allowing
traffic between eth & tun interfaces...

Michael.

alfuananzo

Hey,

Thanks for all the help so far! I think i got it configured correctly now.

I am currently using the following rules to manage the traffic in between my interfaces:

-A FORWARD -j ACCEPT -i tun0 -o eth0 --source 10.8.0.0/24
-A FORWARD -j ACCEPT -i eth0 -o tun0
-A FORWARD -j DROP

Is this a safe configuration? The way i figured it is that only my subnet can sent out of my server (From tun0 to eth0) and all other web servers / services can route trough my tunnel so they van reach my VPN network.

maikcat

looks ok....

you should also block NEW connections from eth to tun...

Michael.