Good day ... 🙂
I'm sorry for my bad english)
Want through OpenVPN go online. That is, there is a remote VDS, it installed OpenVPN server with the following settings servef.conf:
port 1194
local 37.*.*.181
proto tcp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh2048.pem
server 10.68.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.68.1.0 255.255.255.0"
client-config-dir /etc/openvpn/ccd
route 10.68.3.0 255.255.255.0
route 10.68.4.0 255.255.255.0
route 10.68.5.0 255.255.255.0
route 10.68.6.0 255.255.255.0
route 10.68.7.0 255.255.255.0
route 10.68.8.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
keepalive 5 240
client-to-client
tls-server
tls-auth /etc/openvpn/keys/ta.key 0
tls-timeout 120
auth SHA512
cipher AES-256-CBC # AES
comp-lzo
status-version 2
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log-append /etc/openvpn/openvpn-tun.log
verb 3
mute 10
management localhost 7557
But the client configuration:
client
dev tun
remote 37.*.*.181 1194
proto tcp
resolv-retry infinite
nobind
pull
ca ca.crt
cert centos_client1.crt
key centos_client1.key
dh dh2048.pem
tls-client
tls-auth ta.key 1
auth-nocache
auth SHA512
cipher AES-256-CBC
keysize 256
ns-cert-type server
comp-lzo
persist-key
persist-tun
verb 3
status openvpn-status.log
log-append /etc/openvpn/openvpn-tun.log
But the iptables configuration:
*nat
-A POSTROUTING -s 10.68.0.0/24 -o venet0:0 -j SNAT --to-source 37.*.*.181
COMMIT
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -m conntrack --ctstate NEW -i tun0 -s 10.68.0.1/24 -j ACCEPT
#-P FORWARD DROP
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i venet0:0 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 8081 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 6139 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 6138 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 1194 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A FORWARD -i tun0 -o venet0:0 -s 10.68.0.0/24 -j ACCEPT
-A FORWARD -i venet0:0 -o tun0 -d 10.68.0.0/24 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
Server and client CentOS 6.6 x64.
The output of
iptables -L -v on the server
# iptables -L -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
7566 1298K ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
15 1557 ACCEPT icmp -- any any anywhere anywhere
0 0 ACCEPT all -- lo any anywhere anywhere
0 0 ACCEPT all -- venet0:0 any anywhere anywhere
0 0 ACCEPT tcp -- any any anywhere anywhere state NEW tcp dpt:tproxy
0 0 ACCEPT tcp -- any any anywhere anywhere state NEW tcp dpt:6139
225 11700 ACCEPT tcp -- any any anywhere anywhere state NEW tcp dpt:6138
6 360 ACCEPT tcp -- any any anywhere anywhere state NEW tcp dpt:openvpn
5 208 ACCEPT tcp -- any any anywhere anywhere state NEW tcp dpt:ssh
95 5835 REJECT all -- any any anywhere anywhere reject-with
icmp-host-prohibited
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- any any anywhere anywhere ctstate RELATED,ESTABLISHED
73 4980 ACCEPT all -- tun0 any 10.68.0.0/24 anywhere ctstate NEW
0 0 ACCEPT all -- tun0 venet0:0 10.68.0.0/24 anywhere
0 0 ACCEPT all -- venet0:0 tun0 anywhere 10.68.0.0/24
0 0 REJECT all -- any any anywhere anywhere reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT 8084 packets, 1477K bytes)
pkts bytes target prot opt in out source destination
The output of
iptables -L -v on the client:
# iptables -L -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
39766 39M ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
1 84 ACCEPT icmp -- any any anywhere anywhere
0 0 ACCEPT all -- lo any anywhere anywhere
32253 2613K ACCEPT all -- eth0 any anywhere anywhere
0 0 ACCEPT tcp -- any any anywhere anywhere state NEW tcp dpt:ssh
0 0 ACCEPT tcp -- any any anywhere anywhere state NEW tcp dpt:http
0 0 ACCEPT tcp -- any any anywhere anywhere state NEW tcp dpt:ndmp
4 1312 REJECT all -- any any anywhere anywhere reject-withicmp-host-prohibited
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
4193 916K ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
1 84 ACCEPT icmp -- any any anywhere anywhere
0 0 ACCEPT all -- lo any anywhere anywhere
1628 82488 ACCEPT all -- eth0 any anywhere anywhere
174 10732 ACCEPT all -- any eth0 anywhere anywhere
0 0 ACCEPT tcp -- eth0 any anywhere 192.168.2.5 state NEW tcp dpt:ssh
0 0 REJECT all -- any any anywhere anywhere reject-withicmp-host-prohibited
Chain OUTPUT (policy ACCEPT 27708 packets, 3112K bytes)
pkts bytes target prot opt in out source destination
The client is a gateway and the dhcp server for the LAN.
And my goal is to put all local traffic through the OpenVPN.
The output of
iptables -L -t nat -v on the server
# iptables -L -t nat -v
Chain PREROUTING (policy ACCEPT 378 packets, 21129 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 282 packets, 17093 bytes)
pkts bytes target prot opt in out source destination
0 0 SNAT all -- any venet0:0 10.68.0.0/24 anywhere to:37.*.*.181
Chain OUTPUT (policy ACCEPT 233 packets, 14129 bytes)
pkts bytes target prot opt in out source destination
As a result, I can ping 10.68.0.1, but I can not get internet
Team routetratse rests on 10.68.0.1
and I do not understand. it is a problem with the server or iptables openvpn?
But I ping the server, then openvpn normally sroyu job done. the idea ...
Prompt please.
Thank you.
