paul
Pinging google.com from the client shows the server receiving ICMP packets through the tunnel. But there are no replies.
#tcpdump -itun0 -n 'icmp'
21:08:31.175803 IP 10.8.0.6 > 74.125.228.35: ICMP echo request, id 3612, seq 1, length 64
#tcpdump -ieth0 -n 'icmp'
shows nothing
Server routes
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 a.b.c.1 0.0.0.0 UG 0 0 0 eth0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
10.8.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
a.b.c.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255
eth0 Link encap:Ethernet HWaddr intentionally left blank
inet addr: a.b.c.d Bcast: a.b.c.255 Mask:255.255.255.0
Client routes
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 10.8.0.5 128.0.0.0 UG 0 0 0 tun0
0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0
10.8.0.1 10.8.0.5 255.255.255.255 UGH 0 0 0 tun0
10.8.0.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
a.b.c.d 192.168.1.1 255.255.255.255 UGH 0 0 0 eth0
128.0.0.0 10.8.0.5 128.0.0.0 UG 0 0 0 tun0
169.254.0.0 0.0.0.0 255.255.0.0 U 1000 0 0 eth0
192.168.1.0 0.0.0.0 255.255.255.0 U 1 0 0 eth0
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.6 P-t-P:10.8.0.5 Mask:255.255.255.255
eth0 Link encap:Ethernet HWaddr intentionally left blank
inet addr:192.168.1.13 Bcast:192.168.1.255 Mask:255.255.255.0
OpenVPN config files
--------------------
server,config
--------------------
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 10.8.0.1"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
log /var/log/openvpn.log
verb 6
--------------------
client.config
--------------------
client
dev tun
proto udp
remote my.real.host.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client2.crt
key client2.key
ns-cert-type server
comp-lzo
verb 5
-----------------------
server ipchains
-----------------------
#iptables -t nat -L -n
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 10.8.0.0/24 0.0.0.0/0
#iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N fail2ban-dovecot-pop3imap
-N fail2ban-ssh
-A INPUT -p tcp -m multiport --dports 110,995,143,993 -j fail2ban-dovecot-pop3imap
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/8 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 465 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 587 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 143 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 993 -j ACCEPT
-A INPUT -p udp -m udp --dport 1194 -j ACCEPT
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
-A INPUT -j DROP
-A INPUT -i tun0 -j ACCEPT
-A FORWARD -j DROP
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.8.0.0/24 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i tun0 -j ACCEPT
-A OUTPUT -j ACCEPT
-A OUTPUT -p udp -m udp --sport 1194 -j ACCEPT
-A OUTPUT -o tun0 -j ACCEPT
-A fail2ban-dovecot-pop3imap -j RETURN
-A fail2ban-ssh -j RETURN
#sysctl -a|grep net.ipv4.ip_forward
net.ipv4.ip_forward = 1
Traceroute from the client hangs as well.
traceroute to google.com (74.125.228.66), 30 hops max, 60 byte packets
1 10.8.0.1 (10.8.0.1) 79.971 ms 79.962 ms 79.956 ms
2 * * *
trasceroute requests are received on the server for tun0
#tcpdump -itun0 -n 'udp'
22:03:40.679827 IP 10.8.0.6.46544 > 74.125.228.64.33434: UDP, length 32
on the server, eth0 appears to be sending trafic related to the tun0 request
22:05:04.942421 IP my.ips.ip.41080 > my.servers.ip.1194: UDP, length 101
The client gets no replies from ping or traceroute for this setup
Any repsonses on what to look for or tweek are much appreciated..
Thanks,
Paul.
