Hi
I'm a IT consultant and my customer ask me to install and configure a Qnap NAS into their network to share data folder
and activate an OpenVpn channel to make data available for mobile worker. The OpneVpn server is built into QTS (Qnap linux distro).
I configured OpenVpn server, installed on a Windows7 machine the OpenVpn Windows client (OpenVPN Desktop Client) tested the
access to the data folder, ssh access by means of putty and all works fine.
The problem is that despite the OpenVpn server configuration, on the client the internet access doesn't work when OpenVpn channel is up.
I suspect some problem on the firewall gateway but after some modification on iptables the probelm persist.
First of all I have to depict the network configuration I found.
The Qnap server (And OpenVpn server of course) are linked to the internal lan. The DHCP and DNS server on the internal lan
is a Windows 2008 server (also acting like AD), a linux box has the role of firewall gateway (and nat) using two interface eth1 on the internal lan
and eth0 linked to the public adsl router. Also the firewall eth0 interface has a public ip addressable from internet.
Simple figure
Internal Lan side Public internet network side
Qnap Server ------------------ Firewall/NAT --------------------- Router
(address: 10.0.0.248) (eth1 Internal LAN: 10.0.0.254) (Public IP : 95.242.65.38)
(OpenVpn adderss 10.8.0.1) (eth0 Public IP : 95.242.65.33)
(DHCP/DNS server: 10.0.0.251)
After some test on the OpenVpn channel I found:
a) from the client I can access the shared data folder, use putty and WinScp on the Qnap Server and Firewall
b) from client I can ping the Qnap server, OpenVpn server, Firewall and so on
c) from the Qnap server I can ping firewall, some external dns at address 8.8.8.8
d) from firewall I can ping teh Qnap server and some external dns at address 8.8.8.8
e) from the Qnap server I don't ping the OpenVpn Client nor the OpenVpn server
f) from the Firewall I don't ping the OpenVpn Client nor the OpenVpn server
g) from the client I can't access website on the internet, only the Qnap Web server at address 10.0.0.248 is
reachable
Follow you'll find:
OpenVpn server conf file, OpenVpn client conf file, the running iptables on the firewall, the pre and post (related to OpenVpn channel activation) windows client route view.
--------------------- server conf -----------------
port 1194
proto udp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/myserver.crt
key /etc/openvpn/keys/myserver.key
auth-user-pass-verify /usr/sbin/vpn_check_account via-env
client-cert-not-required
username-as-common-name
no-name-remapping
dh /etc/openvpn/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /var/log/ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
client-to-client
duplicate-cn
keepalive 10 60
reneg-sec 0
cipher AES-128-CBC
comp-lzo
max-clients 10
client-connect /etc/openvpn/connect.sh
client-disconnect /etc/openvpn/disconnect.sh
management localhost 7505
persist-key
persist-tun
status /var/log/openvpn-status.log
#log /tmp/openvpn.log
verb 3
--------------------- end server conf -------------
--------------------- client conf -------------
client
dev tun
script-security 4
proto udp
remote 95.242.65.33 1194
resolv-retry infinite
nobind
ca ca.crt
ns-cert-type server
auth-user-pass
reneg-sec 0
cipher AES-128-CBC
comp-lzo
--------------------- end client conf -------------
--------------------- firewall iptables ------------
# Generated by iptables-save v1.4.2 on Tue Feb 25 10:08:42 2014
*nat
đŸ˜›REROUTING ACCEPT [8665567:642049274]
đŸ˜›OSTROUTING ACCEPT [1531487:93656908]
:OUTPUT ACCEPT [1531487:93656908]
-A POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE
# openvpn configuration
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
-A PREROUTING -p udp --dport 1194 -j DNAT --to-destination 10.0.0.248:1194
-A PREROUTING -p tcp --dport 1194 -j DNAT --to-destination 10.0.0.248:1194
#-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-destination 10.0.0.248
# end openvpn configuration
COMMIT
# Completed on Tue Feb 25 10:08:42 2014
# Generated by iptables-save v1.4.2 on Tue Feb 25 10:08:42 2014
*filter
:INPUT ACCEPT [104615908:27141088761]
:FORWARD DROP [4804736:314730277]
:OUTPUT ACCEPT [190395627:134138090153]
-A INPUT -s 85.18.248.64/28 -i eth0 -j ACCEPT
-A INPUT -s 10.0.0.0/24 -i eth0 -j ACCEPT
-A INPUT -s 95.242.65.32/29 -i eth0 -j ACCEPT
-A INPUT -i eth0 -p icmp -j ACCEPT
-A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
# openvpn configuration
-A INPUT -p udp -i eth0 --dport 1194 -j ACCEPT
-A OUTPUT -p udp -o eth0 --sport 1194 -j ACCEPT
# end openvpn configuration
-A INPUT -i eth0 -j DROP
-A FORWARD -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
# OpenVpn
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.0.0.251/32 -j ACCEPT
-A FORWARD -d 10.0.0.251/32 -j ACCEPT
-A FORWARD -s 10.0.0.252/32 -j ACCEPT
-A FORWARD -d 10.0.0.252/32 -j ACCEPT
-A FORWARD -d 10.0.0.204/32 -j ACCEPT
-A FORWARD -s 10.0.0.204/32 -j ACCEPT
-A FORWARD -s 10.0.0.245/32 -j ACCEPT
-A FORWARD -d 10.0.0.245/32 -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -p icmp -j ACCEPT
-A FORWARD -d 10.0.0.0/24 -p icmp -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -p tcp -m tcp --dport 23 -j ACCEPT
-A FORWARD -d 10.0.0.0/24 -p tcp -m tcp --sport 23 -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -p tcp -m tcp --dport 25 -j ACCEPT
-A FORWARD -d 10.0.0.0/24 -p tcp -m tcp --sport 25 -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -p tcp -m tcp --dport 110 -j ACCEPT
-A FORWARD -d 10.0.0.0/24 -p tcp -m tcp --sport 110 -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -p tcp -m tcp --dport 143 -j ACCEPT
-A FORWARD -d 10.0.0.0/24 -p tcp -m tcp --sport 143 -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -p tcp -m tcp --dport 1723 -j ACCEPT
-A FORWARD -d 10.0.0.0/24 -p tcp -m tcp --sport 1723 -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -p tcp -m tcp --dport 3389 -j ACCEPT
-A FORWARD -d 10.0.0.0/24 -p tcp -m tcp --sport 3389 -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -p tcp -m tcp --dport 5900 -j ACCEPT
-A FORWARD -d 10.0.0.0/24 -p tcp -m tcp --sport 5900 -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -p tcp -m tcp --dport 53 -j ACCEPT
-A FORWARD -d 10.0.0.0/24 -p tcp -m tcp --sport 53 -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -p udp -m udp --dport 53 -j ACCEPT
-A FORWARD -d 10.0.0.0/24 -p udp -m udp --sport 53 -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -p tcp -m tcp --dport 123 -j ACCEPT
-A FORWARD -d 10.0.0.0/24 -p tcp -m tcp --sport 123 -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -p udp -m udp --dport 123 -j ACCEPT
-A FORWARD -d 10.0.0.0/24 -p udp -m udp --sport 123 -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -p tcp -m tcp --dport 21 -j ACCEPT
-A FORWARD -d 10.0.0.0/24 -p tcp -m tcp --sport 21 -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -p tcp -m tcp --dport 20 -j ACCEPT
-A FORWARD -d 10.0.0.0/24 -p tcp -m tcp --sport 20 -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -p tcp -m tcp --dport 993 -j ACCEPT
-A FORWARD -d 10.0.0.0/24 -p tcp -m tcp --sport 993 -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -p tcp -m tcp --dport 995 -j ACCEPT
-A FORWARD -d 10.0.0.0/24 -p tcp -m tcp --sport 995 -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -p tcp -m tcp --dport 587 -j ACCEPT
-A FORWARD -d 10.0.0.0/24 -p tcp -m tcp --sport 587 -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -p tcp -m tcp --dport 465 -j ACCEPT
-A FORWARD -d 10.0.0.0/24 -p tcp -m tcp --sport 465 -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -d 80.86.21.170/32 -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -d 217.133.190.139/32 -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -d 77.238.26.176/28 -j ACCEPT
# OpenVpn configuration
-A FORWARD -d 10.0.0.248 -p udp --dport 1194 -j ACCEPT
-A FORWARD -s 10.8.0.0/24 -p tcp -m tcp --dport 53 -j ACCEPT
-A FORWARD -d 10.8.0.0/24 -p tcp -m tcp --sport 53 -j ACCEPT
-A FORWARD -s 10.8.0.0/24 -p udp -m udp --dport 53 -j ACCEPT
-A FORWARD -d 10.8.0.0/24 -p udp -m udp --sport 53 -j ACCEPT
-A FORWARD -s 10.8.0.0/24 -j ACCEPT
# end OpenVpn configuration
COMMIT
# Completed on Tue Feb 25 10:08:42 2014
--------------------- end firewall iptables ----------------
------------------- client route before connect to OpenVpn ------------
===========================================================================
Interface list
21...00 ff 86 27 a9 e8 ......TAP-Win32 Adapter OAS
15...00 1a 6b 73 4d 9f ......Bluetooth device (Personal Area Network)
11...00 1b 77 15 fd c8 ......Network connection Intel(R) PRO/Wireless 3945AB
1...........................Software Loopback Interface 1
16...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
17...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
13...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
18...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
20...00 00 00 00 00 00 00 e0 Scheda Microsoft 6to4
===========================================================================
IPv4 route table
===========================================================================
Active Route:
Indirizzo rete Mask Gateway Interfaccia Metrica
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.78 25
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.1.0 255.255.255.0 On-link 192.168.1.78 281
192.168.1.78 255.255.255.255 On-link 192.168.1.78 281
192.168.1.255 255.255.255.255 On-link 192.168.1.78 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.1.78 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.1.78 281
===========================================================================
Permanent Route:
None
IPv6 route table
===========================================================================
Active Route:
Interf Metrica Rete Destinazione Gateway
13 58 ::/0 On-link
1 306 ::1/128 On-link
13 58 2001::/32 On-link
13 306 2001:0:9d38:6abd:2cd4:1b4a:b0f7:104d/128
On-link
11 281 fe80::/64 On-link
13 306 fe80::/64 On-link
13 306 fe80::2cd4:1b4a:b0f7:104d/128
On-link
11 281 fe80::892e:3b23:3365:34fe/128
On-link
1 306 ff00::/8 On-link
13 306 ff00::/8 On-link
11 281 ff00::/8 On-link
===========================================================================
Permanent Route:
None
------------------------ end client route before ---------------------------
---------------------- client route with OpenVpn running ---------------
C:\Users\stegio>route print
===========================================================================
Interface list
21...00 ff 86 27 a9 e8 ......TAP-Win32 Adapter OAS
15...00 1a 6b 73 4d 9f ......Bluetooth (Personal Area Network)
11...00 1b 77 15 fd c8 ......network connection Intel(R) PRO/Wireless 3945ABG
1...........................Software Loopback Interface 1
16...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
17...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
13...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
20...00 00 00 00 00 00 00 e0 Scheda Microsoft 6to4
===========================================================================
IPv4 Tabella route
===========================================================================
Active Route:
Network address Mask Gateway Interfaccia Metrica
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.78 25
0.0.0.0 128.0.0.0 10.8.0.5 10.8.0.6 30
10.8.0.0 255.255.255.0 10.8.0.5 10.8.0.6 30
10.8.0.4 255.255.255.252 On-link 10.8.0.6 286
10.8.0.6 255.255.255.255 On-link 10.8.0.6 286
10.8.0.7 255.255.255.255 On-link 10.8.0.6 286
95.242.65.33 255.255.255.255 192.168.1.1 192.168.1.78 25
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
128.0.0.0 128.0.0.0 10.8.0.5 10.8.0.6 30
192.168.1.0 255.255.255.0 On-link 192.168.1.78 281
192.168.1.78 255.255.255.255 On-link 192.168.1.78 281
192.168.1.255 255.255.255.255 On-link 192.168.1.78 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.8.0.6 286
224.0.0.0 240.0.0.0 On-link 192.168.1.78 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 10.8.0.6 286
255.255.255.255 255.255.255.255 On-link 192.168.1.78 281
===========================================================================
Permanent Route :
none
IPv6 route table
===========================================================================
Active Route:
Interf Metrica Rete Destinazione Gateway
1 306 ::1/128 On-link
21 286 fe80::/64 On-link
11 281 fe80::/64 On-link
11 281 fe80::892e:3b23:3365:34fe/128
On-link
21 286 fe80::b8f5:a43a:1786:70fd/128
On-link
1 306 ff00::/8 On-link
21 286 ff00::/8 On-link
11 281 ff00::/8 On-link
===========================================================================
Permanent Route :
none
----------------------- end client route OpenVpn running --------------
I suspect something is wrong on the firewall but I can't see what is wrong on the iptables.
Any help or suggestion is kindly accepted, I'm going crazy !
regards
stefano
