Hey guys, I'm having an issue nat'ing client traffic to the internet. Currently when a client connects, the client is unable to access/ping anything on the internet. I thought the issue may be my iptables rules but everything seems correct. server.conf [code] port 1194 proto udp dev tun ca ca.crt cert mydomain.crt dh dh1024.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "redirect-gateway def1" push "dhcp-option DNS 208.67.222.222" keepalive 10 120 comp-lzo persist-key persist-tun status openvpn-status.log verb 3 [/code] my iptables [code] *nat :PREROUTING ACCEPT [113:6983] :POSTROUTING ACCEPT [85:5677] :OUTPUT ACCEPT [6:376] -A POSTROUTING -o vnet0:0 -j MASQUERADE -A POSTROUTING -s 10.8.0.0/24 -o venet0:0 -j MASQUERADE COMMIT *filter :INPUT ACCEPT [189387:22609148] -A INPUT -i lo -j ACCEPT -A INPUT -f -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT -A INPUT -p udp -m state --state NEW --dport 1194 -j ACCEPT :FORWARD ACCEPT [1018:66893] :OUTPUT ACCEPT [86:4860] -A OUTPUT -o tun+ -j ACCEPT -A OUTPUT -p icmp -j ACCEPT -A OUTPUT -p udp -j ACCEPT -A OUTPUT -p tcp -j ACCEPT COMMIT *mangle :PREROUTING ACCEPT [838358:104378039] :INPUT ACCEPT [837339:104311094] -A FORWARD -i tun0 -j ACCEPT -A FORWARD -i tun0 -o venet0:0 -m state --state RELATED,ESTABLISHED -j ACCEPT -A FORWARD -i venet0:0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT :OUTPUT ACCEPT [956907:175496868] :POSTROUTING ACCEPT [957925:175563761] COMMIT *raw :PREROUTING ACCEPT [838358:104378039] :OUTPUT ACCEPT [956907:175496868] COMMIT [/code] ifconfig [code] lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:14 errors:0 dropped:0 overruns:0 frame:0 TX packets:14 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:1040 (1.0 KB) TX bytes:1040 (1.0 KB) venet0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:127.0.0.2 P-t-P:127.0.0.2 Bcast:0.0.0.0 Mask:255.255.255.255 inet6 addr: 2a04:ad80::70ce:67d9/128 Scope:Global inet6 addr: 2a04:ad80::bc79:ef29/128 Scope:Global inet6 addr: 2a04:ad80::1a35:c0bf/128 Scope:Global inet6 addr: 2a04:ad80::db9:d432/128 Scope:Global inet6 addr: 2a04:ad80::4e34:95b2/128 Scope:Global inet6 addr: 2a04:ad80::f1e1:69f9/128 Scope:Global inet6 addr: 2a04:ad80::4f8d:f42e/128 Scope:Global inet6 addr: 2a04:ad80::78cf:d4f7/128 Scope:Global inet6 addr: 2a04:ad80::5e97:2edb/128 Scope:Global inet6 addr: 2a04:ad80::57c8:763b/128 Scope:Global UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1 RX packets:902784 errors:0 dropped:0 overruns:0 frame:0 TX packets:1004900 errors:0 dropped:18787 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:117037489 (117.0 MB) TX bytes:184544769 (184.5 MB) venet0:0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:x.x.x.x P-t-P:x.x.x.x Bcast:x.x.x.x Mask:255.255.255.255 UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1 [/code] Please let me know what other information I need to provide. Thanks

The only iptables rule required to NAT your client correctly is:[quote]iptables -t nat -A POSTROUTING -s [b]VPN_Network[/b] -o [b]Interface[/b] -j MASQUERADE[/quote]where [b]VPN_Network[/b] is your chosen VPN IP: eg 10.8.0.0/24 and [b]Interface [/b]is the output interface: eg eth0 (in your case this looks like it is probably venet0:0) If you are having problems with iptables, I suggest you clear all iptables rules except the NAT rule until you can verify you have it correct. Then add your other rules.

Issue with nat'ing traffic over public interface

mast3rmind

Hey guys,

I'm having an issue nat'ing client traffic to the internet. Currently when a client connects, the client is unable to access/ping anything on the internet.
I thought the issue may be my iptables rules but everything seems correct.

server.conf

port 1194
proto udp
dev tun
ca ca.crt
cert mydomain.crt
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS 208.67.222.222"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

my iptables

*nat
:PREROUTING ACCEPT [113:6983]
:POSTROUTING ACCEPT [85:5677]
:OUTPUT ACCEPT [6:376]
-A POSTROUTING -o vnet0:0 -j MASQUERADE
-A POSTROUTING -s 10.8.0.0/24 -o venet0:0 -j MASQUERADE
COMMIT
*filter
:INPUT ACCEPT [189387:22609148]
-A INPUT -i lo -j ACCEPT
-A INPUT -f -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p udp -m state --state NEW --dport 1194 -j ACCEPT
:FORWARD ACCEPT [1018:66893]
:OUTPUT ACCEPT [86:4860]
-A OUTPUT -o tun+ -j ACCEPT
-A OUTPUT -p icmp -j ACCEPT
-A OUTPUT -p udp -j ACCEPT
-A OUTPUT -p tcp -j ACCEPT
COMMIT
*mangle
:PREROUTING ACCEPT [838358:104378039]
:INPUT ACCEPT [837339:104311094]
-A FORWARD -i tun0 -j ACCEPT
-A FORWARD -i tun0 -o venet0:0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i venet0:0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
:OUTPUT ACCEPT [956907:175496868]
:POSTROUTING ACCEPT [957925:175563761]
COMMIT
*raw
:PREROUTING ACCEPT [838358:104378039]
:OUTPUT ACCEPT [956907:175496868]
COMMIT

ifconfig

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:14 errors:0 dropped:0 overruns:0 frame:0
          TX packets:14 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:1040 (1.0 KB)  TX bytes:1040 (1.0 KB)

venet0    Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:127.0.0.2  P-t-P:127.0.0.2  Bcast:0.0.0.0  Mask:255.255.255.255
          inet6 addr: 2a04:ad80::70ce:67d9/128 Scope:Global
          inet6 addr: 2a04:ad80::bc79:ef29/128 Scope:Global
          inet6 addr: 2a04:ad80::1a35:c0bf/128 Scope:Global
          inet6 addr: 2a04:ad80::db9:d432/128 Scope:Global
          inet6 addr: 2a04:ad80::4e34:95b2/128 Scope:Global
          inet6 addr: 2a04:ad80::f1e1:69f9/128 Scope:Global
          inet6 addr: 2a04:ad80::4f8d:f42e/128 Scope:Global
          inet6 addr: 2a04:ad80::78cf:d4f7/128 Scope:Global
          inet6 addr: 2a04:ad80::5e97:2edb/128 Scope:Global
          inet6 addr: 2a04:ad80::57c8:763b/128 Scope:Global
          UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1
          RX packets:902784 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1004900 errors:0 dropped:18787 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:117037489 (117.0 MB)  TX bytes:184544769 (184.5 MB)

venet0:0  Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:x.x.x.x  P-t-P:x.x.x.x  Bcast:x.x.x.x  Mask:255.255.255.255
          UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1

Please let me know what other information I need to provide.

Thanks

Traffic

The only iptables rule required to NAT your client correctly is:

iptables -t nat -A POSTROUTING -s VPN_Network -o Interface -j MASQUERADE

where VPN_Network is your chosen VPN IP: eg 10.8.0.0/24 and Interface is the output interface: eg eth0 (in your case this looks like it is probably venet0:0)

If you are having problems with iptables, I suggest you clear all iptables rules except the NAT rule until you can verify you have it correct. Then add your other rules.