Hi Forum!
I found several threads with that Problem but dont find a solution.
My config is really basic but still no success.
Ping:
client -> Server does
client -> Servers public ip does through tunnel
client -> some host in the internet does also through tunnel
server -> any client does not.
server -> tun0 ip does
Serverconfig:
local xxx.xxx.xxx.xxx
port 1024
proto udp
dev tun0
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/vps.crt
key /etc/openvpn/keys/vps.key
dh /etc/openvpn/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 5 30
#comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
client-to-client
Server iptables-save:
# Generated by iptables-save v1.4.14 on Sat Sep 7 15:17:10 2013
*filter
:INPUT ACCEPT [5937771:766307434]
:FORWARD ACCEPT [14094940:12647108325]
:OUTPUT ACCEPT [9857093:13026716868]
COMMIT
# Completed on Sat Sep 7 15:17:10 2013
# Generated by iptables-save v1.4.14 on Sat Sep 7 15:17:10 2013
*mangle
:PREROUTING ACCEPT [20032711:13413415759]
:INPUT ACCEPT [5937771:766307434]
:FORWARD ACCEPT [14094940:12647108325]
:OUTPUT ACCEPT [9857093:13026716868]
:POSTROUTING ACCEPT [23952033:25673825193]
COMMIT
# Completed on Sat Sep 7 15:17:10 2013
# Generated by iptables-save v1.4.14 on Sat Sep 7 15:17:10 2013
*nat
:PREROUTING ACCEPT [12442:738353]
:POSTROUTING ACCEPT [1141:72283]
:OUTPUT ACCEPT [1209:76507]
-A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source 31.220.42.14
-A POSTROUTING -s 10.8.1.0/24 -j SNAT --to-source 31.220.42.14
COMMIT
# Completed on Sat Sep 7 15:17:10 2013
Servers Route:
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.8.0.2 * 255.255.255.255 UH 0 0 0 tun0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
default * 0.0.0.0 U 0 0 0 venet0
Clientconfig:
client
dev tun
proto udp
remote xxx.xxx.xxx.xxx 1024
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/router1.crt
key /etc/openvpn/router1.key
verb 3
Client iptables-save:
# Completed on Sat Sep 7 15:19:50 2013
# Generated by iptables-save v1.4.19.1 on Sat Sep 7 15:19:50 2013
*mangle
:PREROUTING ACCEPT [78319:22873754]
:INPUT ACCEPT [25657:7885151]
:FORWARD ACCEPT [52231:14854938]
:OUTPUT ACCEPT [33903:12921540]
:POSTROUTING ACCEPT [86134:27776478]
:fwmark - [0:0]
:mssfix - [0:0]
-A PREROUTING -j fwmark
-A FORWARD -j mssfix
-A mssfix -o eth0.2 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "wan (mtu_fix)" -j TCPMSS --clamp-mss-to-pmtu
-A mssfix -o eth0.2 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "wan (mtu_fix)" -j TCPMSS --clamp-mss-to-pmtu
-A mssfix -o tun0 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "vpn (mtu_fix)" -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Sat Sep 7 15:19:50 2013
# Generated by iptables-save v1.4.19.1 on Sat Sep 7 15:19:50 2013
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:delegate_forward - [0:0]
:delegate_input - [0:0]
:delegate_output - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_vpn_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_vpn_rule - [0:0]
:input_wan_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_vpn_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_vpn_dest_ACCEPT - [0:0]
:zone_vpn_forward - [0:0]
:zone_vpn_input - [0:0]
:zone_vpn_output - [0:0]
:zone_vpn_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_ACCEPT - [0:0]
:zone_wan_src_REJECT - [0:0]
-A INPUT -j delegate_input
-A FORWARD -j delegate_forward
-A OUTPUT -j delegate_output
-A delegate_forward -m comment --comment "user chain for forwarding" -j forwarding_rule
-A delegate_forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A delegate_forward -i br-lan -j zone_lan_forward
-A delegate_forward -i eth0.2 -j zone_wan_forward
-A delegate_forward -i eth0.2 -j zone_wan_forward
[b]-A delegate_forward -i tun0 -j zone_vpn_forward[/b]
-A delegate_forward -j reject
-A delegate_input -i lo -j ACCEPT
-A delegate_input -m comment --comment "user chain for input" -j input_rule
-A delegate_input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A delegate_input -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j syn_flood
-A delegate_input -i br-lan -j zone_lan_input
-A delegate_input -i eth0.2 -j zone_wan_input
-A delegate_input -i eth0.2 -j zone_wan_input
-A delegate_input -i tun0 -j zone_vpn_input
-A delegate_output -o lo -j ACCEPT
-A delegate_output -m comment --comment "user chain for output" -j output_rule
-A delegate_output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A delegate_output -o br-lan -j zone_lan_output
-A delegate_output -o eth0.2 -j zone_wan_output
-A delegate_output -o eth0.2 -j zone_wan_output
-A delegate_output -o tun0 -j zone_vpn_output
-A reject -p tcp -j REJECT --reject-with tcp-reset
-A reject -j REJECT --reject-with icmp-port-unreachable
-A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -j RETURN
-A syn_flood -j DROP
-A zone_lan_dest_ACCEPT -o br-lan -j ACCEPT
-A zone_lan_forward -m comment --comment "user chain for forwarding" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "forwarding lan -> wan" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m comment --comment "forwarding lan -> vpn" -j zone_vpn_dest_ACCEPT
-A zone_lan_forward -j zone_lan_src_ACCEPT
-A zone_lan_input -m comment --comment "user chain for input" -j input_lan_rule
-A zone_lan_input -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "user chain for output" -j output_lan_rule
-A zone_lan_output -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -j ACCEPT
[b]-A zone_vpn_dest_ACCEPT -o tun0 -j ACCEPT
-A zone_vpn_forward -m comment --comment "user chain for forwarding" -j forwarding_vpn_rule
-A zone_vpn_forward -j zone_vpn_src_ACCEPT
-A zone_vpn_input -m comment --comment "user chain for input" -j input_vpn_rule
-A zone_vpn_input -p icmp -m icmp --icmp-type 8 -m comment --comment Allow-Ping -j ACCEPT
-A zone_vpn_input -d 192.168.1.1/32 -p tcp -m tcp --dport 65321 -m conntrack --ctstate DNAT -m comment --comment 65321 -j ACCEPT
-A zone_vpn_input -j zone_vpn_src_ACCEPT
-A zone_vpn_output -m comment --comment "user chain for output" -j output_vpn_rule
-A zone_vpn_output -j zone_vpn_dest_ACCEPT
-A zone_vpn_src_ACCEPT -i tun0 -j ACCEPT[/b]
-A zone_wan_dest_ACCEPT -o eth0.2 -j ACCEPT
-A zone_wan_dest_ACCEPT -o eth0.2 -j ACCEPT
-A zone_wan_forward -m comment --comment "user chain for forwarding" -j forwarding_wan_rule
-A zone_wan_forward -d 192.168.1.112/32 -p udp -m udp --dport 1194 -m comment --comment vpn -j zone_lan_dest_ACCEPT
-A zone_wan_forward -j zone_wan_src_REJECT
-A zone_wan_input -m comment --comment "user chain for input" -j input_wan_rule
-A zone_wan_input -p udp -m udp --dport 68 -m comment --comment Allow-DHCP-Renew -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 15312 -m comment --comment snake -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 65321 -m comment --comment New -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 65322 -m comment --comment Newc2 -j ACCEPT
-A zone_wan_input -j zone_wan_src_ACCEPT
-A zone_wan_output -m comment --comment "user chain for output" -j output_wan_rule
-A zone_wan_output -j zone_wan_dest_ACCEPT
-A zone_wan_src_ACCEPT -i eth0.2 -j ACCEPT
-A zone_wan_src_ACCEPT -i eth0.2 -j ACCEPT
-A zone_wan_src_REJECT -i eth0.2 -j reject
-A zone_wan_src_REJECT -i eth0.2 -j reject
COMMIT
# Completed on Sat Sep 7 15:19:50 2013
Clients route:
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 10.8.0.9 128.0.0.0 UG 0 0 0 tun0
default 192.168.178.1 0.0.0.0 UG 0 0 0 eth0.2
10.8.0.1 10.8.0.9 255.255.255.255 UGH 0 0 0 tun0
10.8.0.9 * 255.255.255.255 UH 0 0 0 tun0
31.220.42.14 192.168.178.1 255.255.255.255 UGH 0 0 0 eth0.2
128.0.0.0 10.8.0.9 128.0.0.0 UG 0 0 0 tun0
192.168.1.0 * 255.255.255.0 U 0 0 0 br-lan
192.168.178.0 * 255.255.255.0 U 0 0 0 eth0.2
I am guessing that the clients know "the way" for 10.8.0.0/24 but the Server does not.
So i played arround with iptables here but did many hings wrong so everythig was in the but then 😉.
After all i had to reinstall everything. Can someone schow me how to do this please?
Thanks!
derdigge
