[SOLVED] Client cant reach external internet

GoldenStake

I'm trying to set up an openvpn server with tls auth and ip forwarding.

So far I can connect to the server just fine, but when I try to access any external website, even a DNS server (can't ping 8.8.8.8), I can't reach it.

Therefore I believe that it is a routing problem, probably something in my iptables.
But I cant figure out anything wrong.

Here are my configs

server external ip : 99.100.101.102
openvpn internal ip : 10.0.0.x
vpn port: 2345

openvpn server.conf

    port 2345
    proto udp
    dev tun
    ca      ca.crt
    cert    server.crt
    key     server.key
    dh      dh1024.pem
    
    server 10.0.0.0 255.255.255.0  # internal tun0 connection IP
    ifconfig-pool-persist ipp.txt
    push "redirect-gateway def1"
    keepalive 10 120
    comp-lzo
    persist-key
    persist-tun
    verb 3 
    client-to-client

client.config

client
dev tun
port 2345
proto udp

remote 99.100.101.102 2345
nobind

ca ca.crt
cert client.crt
key client.key

comp-lzo
persist-key
persist-tun

server routing table

    >/etc/openvpn# netstat -nr
    Kernel IP routing table
    Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
    0.0.0.0         99.100.101.1    0.0.0.0         UG        0 0          0 eth0
    10.0.0.0        10.0.0.2        255.255.255.0   UG        0 0          0 tun0
    10.0.0.2        0.0.0.0         255.255.255.255 UH        0 0          0 tun0
    99.100.101.0    0.0.0.0         255.255.255.0   U         0 0          0 eth0

server iptables

    -A POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE
    -A INPUT -i lo -j ACCEPT
    -A INPUT -d 127.0.0.0/8 -j REJECT --reject-with icmp-port-unreachable
    -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
    -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
    -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
    -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
    -A INPUT -p udp -m udp --dport 2345 -j ACCEPT
    -A INPUT -p tcp -m tcp --dport 2345 -j ACCEPT
    -A INPUT -p icmp -j ACCEPT
    -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
    -A INPUT -j DROP
    -A FORWARD -j DROP
    -A FORWARD -i eth0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
    -A FORWARD -s 10.0.0.0/24 -o eth0 -j ACCEPT
    -A OUTPUT -j ACCEPT
    COMMIT
    # Completed on Sat May 25 12:48:10 2013

I also tried to use NAT instead of MASQUERADE without success

    iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -j SNAT --to 99.100.101.102

Thanks all of you for your help!

GoldenStake

I found the solution
the problem was that my iptables chain was reversed

You can see that this is backwards

-A FORWARD -j DROP
-A FORWARD -i eth0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -o eth0 -j ACCEPT

before any forwarded packet is accepted. it is dropped immediately.
Simply reversing the rule fixed the issue

-A FORWARD -i eth0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -o eth0 -j ACCEPT
-A FORWARD -j DROP

once I fixed it everything else worked just fine. The only problem is that I feel a little silly

janjust

thx for sharing, closing topic :mrgreen: