Hello,
I have been setting up a OpenVPN as a gateway with one user having a static internal IP and some ports being forwarded to him.
The port forwarding is working fine and I can reach my HTTP Server from the outside. Also the pings on the client are going out to external servers just fine. Yet once I try to open a webpage on that client it doesn't work. Also the FTP for the repository update is not working, too.
Server config (Debian)
server 10.8.0.0 255.255.255.0
dev tun
port 1194
proto udp
ca easy-rsa/keys/ca.crt
cert easy-rsa/keys/server.crt
key easy-rsa/keys/server.key
dh easy-rsa/keys/dh1024.pem
# Nächste 3 Zeilen erst aktivieren wenn die VPN Verbindung klappt
push "redirect-gateway def1" # leitet den Internettraffic am Client zum Server um
# push "dhcp-option DNS 123.123.123.123" # DNS-Server 1
# push "dhcp-option DNS 213.213.213.213" # DNS-Server 2 (falls vorhanden)
ping-timer-rem
keepalive 20 180
persist-key
persist-tun
# user nobody # hier könnt ihr einen unprivilegierten User einstellen unter dem OpenVPN nach dem Start läuft
# group nogroup # und eine Gruppe
comp-lzo
client-config-dir ccd
verb 5
mute 50
Client Conf (Debian)
client
dev tun
proto udp
remote 185.44.107.123 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
verb 5
ns-cert-type server
comp-lzo
The Iptables on the server are set to the following on boot (iptables-persistent package):
# Generated by iptables-save v1.4.14 on Sun Jun 1 21:14:37 2014
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT
# Completed on Sun Jun 1 21:14:37 2014
# Generated by iptables-save v1.4.14 on Sun Jun 1 21:14:37 2014
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -p tcp -m tcp --dport 51400:51410 -j DNAT --to-destination 10.8.0.6
-A PREROUTING -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.8.0.6
-A PREROUTING -p tcp -m tcp --dport 21 -j DNAT --to-destination 10.8.0.6
-A POSTROUTING -o eth0 -s 10.8.0.0/24 -j SNAT --to 185.44.107.123
COMMIT
# Completed on Sun Jun 1 21:14:37 2014
I have also tested the scenario with a Windows PC and an Android Smartphone. Both cannot open Webpages.
Example:
zerfer:/etc/openvpn/vzerfer# apt-get update && apt-get dist-upgrade && apt-get autoclean && apt-get autoremove
Ign file: debs/ InRelease
Ign file: debs/ Release.gpg
Ign file: debs/ Release
Ign file: debs/ Translation-en_US
Ign file: debs/ Translation-en
70% [Connecting to ftp2.de.debian.org (137.226.34.42)] [Connecting to ftp.de.de^C
zerfer:/etc/openvpn/vzerfer# ping ftp2.de.debian.org
PING ftp2.de.debian.org (137.226.34.42) 56(84) bytes of data.
64 bytes from ftp.halifax.rwth-aachen.de (137.226.34.42): icmp_seq=1 ttl=54 time=26.7 ms
64 bytes from ftp.halifax.rwth-aachen.de (137.226.34.42): icmp_seq=2 ttl=54 time=26.1 ms
64 bytes from ftp.halifax.rwth-aachen.de (137.226.34.42): icmp_seq=3 ttl=54 time=26.0 ms
^C
--- ftp2.de.debian.org ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 26.099/26.329/26.712/0.272 ms
I can also see something going on with verbosity set to 5 in the logs while he tries to connect to a page.
