Need Help Configuring iptables on VPN Server

tehtomi

Hi,
My Goal is to use my VPS Server as a VPN Server and tunnel all my traffic through it.
I am running an OpenVZ Debian6 VPS Server. TUN/TAP Enabled.

I have tried so many things i just don't know where to start debugging my issues with iptables.
The knowledge i have of linux is just not enough to grasp how iptables needs to be configured so it
does the fairly simple things i'd like, so i need your help. 🙂

At home i have a LAN that consists of 3 (accessible) routers, behind which my Windows 7 VPN Client sits.
It needs to be connected to my VPS via VPN.

The behaviour right now is that i am able to connect to the VPN network, i get an IP, though no Gateway is set,
but it shows up on my LAN Adapter and not on my WiFi adapter which i am actually connected through..is this an issue?

BUT as soon as i am connected i lose resolving capabilities (and nothing works) it has to do something with how the routing
is on the server and what iptables config i am using. I can ping 8.8.8.8 from the server, but i cannot ping it from my client.

See this ipconfig output:

ipconfig (Win7/Client)

Windows IP Configuration


Ethernet adapter Local Area Connection 2:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::69fa:470c:625c:c36c%41
   IPv4 Address. . . . . . . . . . . : 10.8.0.6
   Subnet Mask . . . . . . . . . . . : 255.255.255.252
   Default Gateway . . . . . . . . . :

Wireless LAN adapter Wireless Network Connection 8:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Wireless LAN adapter Wireless Network Connection 5:

   Connection-specific DNS Suffix  . : chello.at
   Link-local IPv6 Address . . . . . : fe80::a9aa:409e:ab8d:700f%20
   IPv4 Address. . . . . . . . . . . : 192.168.3.100
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.3.1

Tunnel adapter isatap.chello.at:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Tunnel adapter Teredo Tunneling Pseudo-Interface:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Tunnel adapter Reusable ISATAP Interface {EB1D384B-5A31-446B-BBC9-CE8D6DC0DB03}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Tunnel adapter Local Area Connection* 9:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Tunnel adapter isatap.{D6856724-9857-422B-86CA-B501BCB77893}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Tunnel adapter isatap.{7E84A531-D74B-41C3-905F-2C14EA1B39DF}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

I can ping the 10.8.0.1 VPN Server, and i can ping the Client from the Server. So they should be connected..
I can access the Server via SSH whilst connected without problems.

I will show you my files, maybe you know what could be the issue.

server.conf

;local 151.236.11.124
port 53
proto udp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
;route 192.168.3.100 255.255.0.0
;route 192.168.2.0 255.255.255.0
client-to-client
;push "route 151.236.11.124 255.255.0.0"
;push "dhcp-option DNS 10.8.0.1"
push "dhcp-option DNS 8.8.8.8"
keepalive 5 30
comp-lzo
persist-key
persist-tun
status openvpn-status.log
push "explicit-exit-notify 3"
verb 3

client.ovpn

client
dev tun
proto udp
remote 151.236.11.124 53
dhcp-option DNS 8.8.8.8
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert tomi.crt
key tomi.key
comp-lzo
verb 3

iptables

#Open Up!
iptables -F
iptables -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

## Open ports related to our services (http, https, ssh, etc)
iptables -A INPUT -p tcp --dport 10000 -j ACCEPT # Example: webmin port
iptables -A INPUT -p tcp --dport 22 -j ACCEPT # Example: ssh port
iptables -A INPUT -p tcp --dport 80 -j ACCEPT # Example: http port
iptables -A INPUT -p tcp --dport 53 -j ACCEPT # OpenVPN TCP!?
iptables -A INPUT -p tcp --dport 1194 -j ACCEPT # OpenVPN UDP!?
iptables -A INPUT -p tcp --dport 5900 -j ACCEPT # VNC POrt??
iptables -A INPUT -p tcp --dport 4040 -j ACCEPT # Subsonic POrt??

# Allow traffic initiated from VPN to access LAN
iptables -I FORWARD -i tun0 -o eth0 \
         -s 10.8.0.0/24 -d 192.168.0.0/24 \
         -m conntrack --ctstate NEW -j ACCEPT

# Allow traffic initiated from VPN to access "the world"
iptables -I FORWARD -i tun0 -o eth1 \
         -s 10.8.0.0/24 -m conntrack --ctstate NEW -j ACCEPT

# Allow traffic initiated from LAN to access "the world"
iptables -I FORWARD -i eth0 -o eth1 \
         -s 192.168.0.0/24 -m conntrack --ctstate NEW -j ACCEPT

# Allow established traffic to pass back and forth
iptables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED \
         -j ACCEPT

iptables -I INPUT 1 -p tcp --dport 53 -j ACCEPT
iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -t nat -A POSTROUTING -s venet0 -j SNAT --to-source 151.236.11.124

# iptables-save > /root/rootIPtables.ipt

route -n

root@heavy-detail:~# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.8.0.2        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
0.0.0.0         0.0.0.0         0.0.0.0         U     0      0        0 venet0

ifconfig

root@heavy-detail:~# ifconfig
lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:56240 errors:0 dropped:0 overruns:0 frame:0
          TX packets:56240 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:39585762 (37.7 MiB)  TX bytes:39585762 (37.7 MiB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:3177 errors:0 dropped:0 overruns:0 frame:0
          TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:205276 (200.4 KiB)  TX bytes:657 (657.0 B)

venet0    Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:127.0.0.2  P-t-P:127.0.0.2  Bcast:0.0.0.0  Mask:255.255.255.255
          inet6 addr: 2a03:f80:ed15:ed15:ed15:ed15:eb7c:6318/128 Scope:Global
          inet6 addr: 2a03:f80:ed15:ed15:ed15:ed15:3d1e:a2c7/128 Scope:Global
          inet6 addr: 2a03:f80:ed15:ed15:ed15:ed15:580c:7949/128 Scope:Global
          inet6 addr: 2a03:f80:ed15:ed15:ed15:ed15:f132:e051/128 Scope:Global
          inet6 addr: 2a03:f80:ed15:ed15:ed15:ed15:5b9:5f1a/128 Scope:Global
          inet6 addr: 2a03:f80:ed15:ed15:ed15:ed15:3081:d572/128 Scope:Global
          inet6 addr: 2a03:f80:ed15:ed15:ed15:ed15:d4c3:6976/128 Scope:Global
          inet6 addr: 2a03:f80:ed15:ed15:ed15:ed15:946d:ace7/128 Scope:Global
          inet6 addr: 2a03:f80:ed15:ed15:ed15:ed15:2ca9:7e0f/128 Scope:Global
          inet6 addr: 2a03:f80:ed15:ed15:ed15:ed15:a6eb:845e/128 Scope:Global
          UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1
          RX packets:181231 errors:0 dropped:0 overruns:0 frame:0
          TX packets:277514 errors:0 dropped:3176 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:31977313 (30.4 MiB)  TX bytes:322992800 (308.0 MiB)

venet0:0  Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:151.236.11.124  P-t-P:151.236.11.124  Bcast:0.0.0.0  Mask:255.255.255.255
          UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1

this is the Client Logfile

Sun Jun 02 06:03:06 2013 Note: option http-proxy-fallback ignored because no TCP-based connection profiles are defined
Sun Jun 02 06:03:06 2013 OpenVPNAS 2.1.1oOAS Win32-MSVC++ [SSL] [LZO2] built on Jul 29 2010
Sun Jun 02 06:03:06 2013 MANAGEMENT: Connected to management server at 127.0.0.1:39091
Sun Jun 02 06:03:06 2013 MANAGEMENT: CMD 'log on'
Sun Jun 02 06:03:06 2013 MANAGEMENT: CMD 'state on'
Sun Jun 02 06:03:06 2013 MANAGEMENT: CMD 'echo on'
Sun Jun 02 06:03:06 2013 MANAGEMENT: CMD 'bytecount 5'
Sun Jun 02 06:03:06 2013 MANAGEMENT: CMD 'hold off'
Sun Jun 02 06:03:06 2013 MANAGEMENT: CMD 'hold release'
Sun Jun 02 06:03:06 2013 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Sun Jun 02 06:03:06 2013 NOTE: OpenVPNAS 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sun Jun 02 06:03:06 2013 LZO compression initialized
Sun Jun 02 06:03:06 2013 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Jun 02 06:03:06 2013 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sun Jun 02 06:03:06 2013 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Jun 02 06:03:06 2013 Local Options hash (VER=V4): '41690919'
Sun Jun 02 06:03:06 2013 Expected Remote Options hash (VER=V4): '530fdded'
Sun Jun 02 06:03:06 2013 UDPv4 link local: [undef]
Sun Jun 02 06:03:06 2013 UDPv4 link remote: 151.236.11.124:53
Sun Jun 02 06:03:06 2013 MANAGEMENT: >STATE:1370145786,WAIT,,,
Sun Jun 02 06:03:06 2013 MANAGEMENT: >STATE:1370145786,AUTH,,,
Sun Jun 02 06:03:06 2013 TLS: Initial packet from 151.236.11.124:53, sid=83cbe2bc e8211754
Sun Jun 02 06:03:06 2013 VERIFY OK: depth=1, /C=AT/ST=Austria/L=Linz/O=James_Brown/OU=NGO01/CN=HD01/name=None/emailAddress=james.brown@hotmail.au
Sun Jun 02 06:03:06 2013 VERIFY OK: depth=0, /C=AT/ST=AT/L=Linz/O=Funtown/OU=Section01/CN=HD01/name=James_Brown/emailAddress=james.brown@hotmail.au
Sun Jun 02 06:03:06 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Jun 02 06:03:06 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jun 02 06:03:06 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Jun 02 06:03:06 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jun 02 06:03:06 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sun Jun 02 06:03:06 2013 [HD01] Peer Connection Initiated with 151.236.11.124:53
Sun Jun 02 06:03:07 2013 MANAGEMENT: >STATE:1370145787,GET_CONFIG,,,
Sun Jun 02 06:03:08 2013 SENT CONTROL [HD01]: 'PUSH_REQUEST' (status=1)
Sun Jun 02 06:03:08 2013 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,explicit-exit-notify 3,route 10.8.0.0 255.255.255.0,topology net30,ping 5,ping-restart 30,ifconfig 10.8.0.6 10.8.0.5'
Sun Jun 02 06:03:08 2013 OPTIONS IMPORT: timers and/or timeouts modified
Sun Jun 02 06:03:08 2013 OPTIONS IMPORT: explicit notify parm(s) modified
Sun Jun 02 06:03:08 2013 OPTIONS IMPORT: --ifconfig/up options modified
Sun Jun 02 06:03:08 2013 OPTIONS IMPORT: route options modified
Sun Jun 02 06:03:08 2013 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sun Jun 02 06:03:08 2013 ROUTE default_gateway=192.168.3.1
Sun Jun 02 06:03:08 2013 MANAGEMENT: >STATE:1370145788,ASSIGN_IP,,10.8.0.6,
Sun Jun 02 06:03:08 2013 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{7E84A531-D74B-41C3-905F-2C14EA1B39DF}.tap
Sun Jun 02 06:03:08 2013 TAP-Win32 Driver Version 9.7 
Sun Jun 02 06:03:08 2013 TAP-Win32 MTU=1500
Sun Jun 02 06:03:08 2013 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {7E84A531-D74B-41C3-905F-2C14EA1B39DF} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Sun Jun 02 06:03:08 2013 Successful ARP Flush on interface [41] {7E84A531-D74B-41C3-905F-2C14EA1B39DF}
Sun Jun 02 06:03:13 2013 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Sun Jun 02 06:03:13 2013 Route: Waiting for TUN/TAP interface to come up...
Sun Jun 02 06:03:18 2013 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Sun Jun 02 06:03:18 2013 C:\Windows\system32\route.exe ADD 151.236.11.124 MASK 255.255.255.255 192.168.3.1
Sun Jun 02 06:03:18 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4
Sun Jun 02 06:03:18 2013 Route addition via IPAPI succeeded [adaptive]
Sun Jun 02 06:03:18 2013 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5
Sun Jun 02 06:03:18 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sun Jun 02 06:03:18 2013 Route addition via IPAPI succeeded [adaptive]
Sun Jun 02 06:03:18 2013 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.5
Sun Jun 02 06:03:18 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sun Jun 02 06:03:18 2013 Route addition via IPAPI succeeded [adaptive]
Sun Jun 02 06:03:18 2013 MANAGEMENT: >STATE:1370145798,ADD_ROUTES,,,
Sun Jun 02 06:03:18 2013 C:\Windows\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.5
Sun Jun 02 06:03:18 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sun Jun 02 06:03:18 2013 Route addition via IPAPI succeeded [adaptive]
Sun Jun 02 06:03:18 2013 Initialization Sequence Completed
Sun Jun 02 06:03:18 2013 MANAGEMENT: >STATE:1370145798,CONNECTED,SUCCESS,10.8.0.6,151.236.11.124
Sun Jun 02 06:11:09 2013 MANAGEMENT: CMD 'exit'
Sun Jun 02 06:11:09 2013 MANAGEMENT: Client disconnected
Sun Jun 02 06:11:09 2013 MANAGEMENT: Triggering management exit
Sun Jun 02 06:11:09 2013 SIGTERM received, sending exit notification to peer
Sun Jun 02 06:11:12 2013 TCP/UDP: Closing socket
Sun Jun 02 06:11:12 2013 C:\Windows\system32\route.exe DELETE 10.8.0.0 MASK 255.255.255.0 10.8.0.5
Sun Jun 02 06:11:12 2013 Route deletion via IPAPI succeeded [adaptive]
Sun Jun 02 06:11:12 2013 C:\Windows\system32\route.exe DELETE 151.236.11.124 MASK 255.255.255.255 192.168.3.1
Sun Jun 02 06:11:12 2013 Route deletion via IPAPI succeeded [adaptive]
Sun Jun 02 06:11:12 2013 C:\Windows\system32\route.exe DELETE 0.0.0.0 MASK 128.0.0.0 10.8.0.5
Sun Jun 02 06:11:12 2013 Route deletion via IPAPI succeeded [adaptive]
Sun Jun 02 06:11:12 2013 C:\Windows\system32\route.exe DELETE 128.0.0.0 MASK 128.0.0.0 10.8.0.5
Sun Jun 02 06:11:12 2013 Route deletion via IPAPI succeeded [adaptive]
Sun Jun 02 06:11:12 2013 Closing TUN/TAP interface
Sun Jun 02 06:11:12 2013 SIGTERM[soft,exit-with-notification] received, process exiting
Sun Jun 02 06:11:12 2013 MANAGEMENT: >STATE:1370146272,EXITING,exit-with-notification,,

this is the maybe relevant section from /var/log/syslog:

Jun  2 00:42:19 heavy-detail ovpn-server[605]: OpenVPN 2.1.3 x86_64-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Feb 21 2012
Jun  2 00:42:19 heavy-detail ovpn-server[605]: NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Jun  2 00:42:19 heavy-detail ovpn-server[605]: Diffie-Hellman initialized with 1024 bit key
Jun  2 00:42:19 heavy-detail ovpn-server[605]: /usr/bin/openssl-vulnkey -q -b 1024 -m <modulus omitted>
Jun  2 00:42:19 heavy-detail ovpn-server[605]: TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Jun  2 00:42:19 heavy-detail ovpn-server[605]: Socket Buffers: R=[245760->131072] S=[245760->131072]
Jun  2 00:42:19 heavy-detail ovpn-server[605]: ROUTE: default_gateway=UNDEF
Jun  2 00:42:19 heavy-detail ovpn-server[605]: TUN/TAP device tun0 opened
Jun  2 00:42:19 heavy-detail ovpn-server[605]: TUN/TAP TX queue length set to 100
Jun  2 00:42:19 heavy-detail ovpn-server[605]: /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Jun  2 00:42:19 heavy-detail ovpn-server[605]: /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Jun  2 00:42:19 heavy-detail ovpn-server[605]: Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Jun  2 00:42:19 heavy-detail ovpn-server[609]: UDPv4 link local (bound): [undef]
Jun  2 00:42:19 heavy-detail ovpn-server[609]: UDPv4 link remote: [undef]
Jun  2 00:42:19 heavy-detail ovpn-server[609]: MULTI: multi_init called, r=256 v=256
Jun  2 00:42:19 heavy-detail ovpn-server[609]: IFCONFIG POOL: base=10.8.0.4 size=62
Jun  2 00:42:19 heavy-detail ovpn-server[609]: IFCONFIG POOL LIST
Jun  2 00:42:19 heavy-detail ovpn-server[609]: HD01,10.8.0.4
Jun  2 00:42:19 heavy-detail ovpn-server[609]: Initialization Sequence Completed

ROUTE: default_gateway=UNDEF this sounds interesting, but i don't know how to remedy the situation..
Please help me i am trying to figure this out for days now and i just want it to work 🙁

Best regards,
t.

Wheelz

Do you have IP forwarding enabled on the OpenVPN server?
Also I noticed that your server and client configuration files have the proto set to UDP and your iptables are only allowing TCP. Maybe add the same rules specifing UDP.