I am trying to finalize setup of the network, sitting behind the firewall and NAT (or NATs), including providers NAT
I use following setup:
[OpenVPN Client (tun0: 10.8.0.7)] => [Online VPS, OVPN Server, 10.8.0.0/24] <= [OpenVPN Client/ Network (10.8.0.5) : Internal LAN 192.168.5.0/24]
Client on the lan is RoadWarrior arbitrary client, e.g. some PC, IPad, etc. I call it further "external client"
Client on the Right is a service-providing network with servers, which is providing service to the external clients
In the middle is OpenVPN server with public IP, has proper DNS, accessible IP etc.
Everything works, but I'd like to disable client-to-client option, since I want clients to access a specific servers only. And never External_Client <=> External Client.
When I do so, and add iptables rules, as it is suggested here
https://openvpn.net/index.php/open-source/documentation/howto.html , "Configuring client-specific rules and access policies", I have no connectivity:
Here is my
working configuration, which is passing packets, pings etc. Client-to-client is enabled:
server.conf
port 17019
proto udp
dev tun
server 10.8.0.0 255.255.255.0
route 192.168.5.0 255.255.255.0 #pfsense @Home
client-config-dir /etc/openvpn/clients
route 10.8.0.0 255.255.255.0
client-to-client
push "route 192.168.5.0 255.255.255.0" #pfsense @Home
user nobody
group nogroup
/etc/openvpn/clients/pfsense
iroute 192.168.5.0 255.255.255.0
ifconfig-push 10.8.0.5 10.8.0.6
Now if I disable (prepend with semicolumn) client-to-client and add some of groups I tried on VPS (OpenVPN) server:
sudo iptables -A FORWARD -i tun0 -s 10.8.0.0/24 -d 192.168.5.0/24 -j ACCEPT
sudo iptables -A FORWARD -i tun0 -s 192.168.0.5/24 -d 10.8.0.0/24 -j ACCEPT
or
iptables -A FORWARD -i tun0 -s 10.8.0.0/24 -d 10.8.0.0/24 -j ACCEPT
or even
# Allow TUN interface connections to OpenVPN server
iptables -A INPUT -i tun+ -j ACCEPT
# Allow TUN interface connections to be forwarded through other interfaces
iptables -A FORWARD -i tun+ -j ACCEPT
Neither ping nor something else goes from remote client to the service net.
But I can ping Remote client => VPS (Server)
Server => Service net
If I ping Remote Client, "ping 192.168.5.1"
tcpdump on OpenVPN servers shows no reply from service net
21:50:16.725763 IP 10.8.0.7 > 192.168.5.1: ICMP echo request, id 19657, seq 1, length 64
21:50:17.734836 IP 10.8.0.7 > 192.168.5.1: ICMP echo request, id 19657, seq 2, length 64
. . .
If I ping from OpenVPN server to the same client:
21:51:24.818415 IP 10.8.0.1 > 192.168.5.1: ICMP echo request, id 3184, seq 2, length 64
21:51:24.840380 IP 192.168.5.1 > 10.8.0.1: ICMP echo reply, id 3184, seq 2, length 64
. .
Here is my route output, when client-to-client is disabled or enabled, doesn't matter:
Remote client:
vetal@VetalMobile ~ $ route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default rMarkins 0.0.0.0 UG 0 0 0 wlan0
10.8.0.1 10.8.0.8 255.255.255.255 UGH 0 0 0 tun0
10.8.0.8 * 255.255.255.255 UH 0 0 0 tun0
192.168.1.0 * 255.255.255.0 U 9 0 0 wlan0
192.168.5.0 10.8.0.8 255.255.255.0 UG 0 0 0 tun0
OpenVPN Server:
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default a.b.c.d 0.0.0.0 UG 0 0 0 eth0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
10.8.0.2 * 255.255.255.255 UH 0 0 0 tun0
104.131.0.0 * 255.255.192.0 U 0 0 0 eth0
192.168.5.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
192.168.6.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
iptables, ufw is disabled for clarity:
vetal@ovpnGateway:~$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- 10.8.0.0/24 192.168.5.0/24
ACCEPT all -- 192.168.0.0/24 10.8.0.0/24
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
vetal@ovpnGateway:~$ sudo iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
Any ideas?
