Client to client with IPTABLE

rischfre

Hi

I have a openvpn based on ubuntu server in a VPS server on internet. That means that this server does not have any lan connected to only one singe IP it s public one.

So far i configured this server following the tutorial. And everything went well. In order to allow some clients to reach internet using the vpn as a gateway in configured CCN files specfics to each client. This CCD file is basic : specify the IP of the client

ifconfig-push 10.8.0.137 10.8.0.138

and this rule in the case this client is allowed to use the OpenVPN to reach Internet

push "redirect-gateway def1 bypass-dhcp"

both are working well.

Now my goal is to use this server in order to relationate several clients(single computers).
Some of the clients should be seen as "server" which means they can be seen but as well can see all clients
The rest of the clients should not see each other, only access the

To simplify that i splitted my VPN net (10.8.0.0) into 2 "zones" : clients with fixed ip in 10.8.0.0/25 should be considered as server and 10.8.0.128/25 should be considered as computers. Those groups are just symbolic in order to simplify the IPTABLE config: for the Openvpn config there is only 1 single network the 10.8.0.0 one.

I read some post in this formum(https://forums.openvpn.net/topic10909.html) which do not recomand client-to-client option in the openvpn, better using the IPTABLES RULES.

I tried both :

with client-to-client : all clients can ping any other computer whatever the IPTABLES "DROP" rules are

without client-to-client : nono of the client can seen other, whatever rules in the IPTABLES i wrote:

;in order to allow some clients to reach internet:
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

; as client-to-client is not set, by default all trafic is rejected, which means 
; i allow the "server group" to access all network
iptables -A FORWARD -s 10.8.0.0/25 -d 10.8.0.0/24 -j ACCEPT

; in order to allow everybody to access the "server group":
iptables -A FORWARD -s 10.8.0.0/24 -d 10.8.0.128/25 -j ACCEPT

; in order to allowed clients which are not server to answer petitions of the server:
iptables -A FORWARD -s 10.8.0.128/25 -d 10.8.0.0/25 -m state --state ESTABLISHED,RELATED -j ACCEPT

what is my mistake?

rischfre

Here is the Server config file:

port 9040
proto udp
dev tun
ca ca.crt
cert mycert.crt
key mycert.key
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ccd
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

and here the client config file:

client
dev tun

proto udp
remote myserverDNS 9040

resolv-retry infinite
nobind

user nobody
group nogroup

persist-key
persist-tun

ca /etc/openvpn/ca.crt
cert /etc/openvpn/client1.crt
key /etc/openvpn/client1.key

ns-cert-type server
comp-lzo
verb 3

on the server side the CCD is usualy this one:

ifconfig-push 10.8.0.9 10.8.0.10

only one client has this one:

ifconfig-push 10.8.0.137 10.8.0.138
push "redirect-gateway def1 bypass-dhcp"

Could you please advise?

Thank you for support!

rischfre

Hi,

thank you for your help.
At the end i managed to get that work with such config, without any additional IPTABLE rule:

Server side:

route 10.8.2.0 255.255.255.0 # clients

Client side (considered as a normal computer): [CCD rule]

ifconfig-push 10.8.2.6 10.8.2.5
push "route 10.8.0.0 255.255.255.0 10.8.2.5"

Client side (considered as a server): [CCD rule]

ifconfig-push 10.8.0.10 10.8.0.1
push "route 10.8.2.0 255.255.255.0 10.8.0.1"