Hi everyone,
I'm trying to setup OpenVPN with static key authentication(instead of TLS) on
TCP port 443, the client is also running behind an HTTP proxy, and it all connects just fine, except that the internet is not accessible.
Here's my current setup:
Server
It's a Debian VPS running on OpenVZ with TUN/TAP enabled.
Here's the configuration file:
dev tun
proto tcp-server
port 443
tun-mtu 1500
ifconfig 10.8.0.1 10.8.0.2
secret /etc/openvpn/static.key
comp-lzo
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
And here's the iptables script that I applied too:
#!/bin/sh
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -P INPUT ACCEPTED
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p udp --dport 1194 -j ACCEPT
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
#My desperate attempts
iptables -A FORWARD -s 10.8.0.2/32 -j ACCEPT
iptables -A FORWARD -s 10.8.0.2/24 -j ACCEPT
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
iptables -A FORWARD -s 10.8.0.1/24 -j ACCEPT
iptables -A FORWARD -s 10.8.0.1/32 -j ACCEPT
iptables -A FORWARD -j REJECT
iptables -t nat -A POSTROUTING -o venet0 -j SNAT --to-source <server_public_ip>
iptables -t nat -A POSTROUTING -o vetnet0:0 -j SNAT --to-source <server_public_ip>
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -A INPUT -p tcp -m tcp --tcp-flags ACK ACK -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 1024:65535 --sport 53 -j ACCEPT
iptables -A INPUT -p icmp -m icmp --icmp-type echo-reply -j ACCEPT
iptables -A INPUT -p icmp -m icmp --icmp-type destination-unreachable -j ACCEPT
iptables -A INPUT -p icmp -m icmp --icmp-type source-quench -j ACCEPT
iptables -A INPUT -p icmp -m icmp --icmp-type time-exceeded -j ACCEPT
iptables -A INPUT -p icmp -m icmp --icmp-type parameter-problem -j ACCEPT
iptables -A INPUT -p icmp -m icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 33434:33523 -j ACCEPT
iptables -L -v
Client
The client is a Windows 8.1 machine running OpenVPN 2.3
Here's the configuration file:
remote <server_ip> 443
dev tun
proto tcp-client
tun-mtu 1500
ifconfig 10.8.0.2 10.8.0.1
secret "C:\\Program Files\\OpenVPN\\config\\static.key"
http-proxy <proxy_host> 80 "C:\\Program Files\\OpenVPN\\config\\proxy_auth.txt" basic
comp-lzo
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
verb 6
Upon connecting the client, a connection is created on Windows for OpenVPN, but it doesn't have access to the internet(I also made sure it was on top of the connections list).
Please feel free to request any information you may need.
Thank you.
