Hi guys,
I set up my own OpenVPN droplet using this
guide.
Everything works fine. My public IP has changed, my private IP is in this subnet: 10.0.0.0/16.
Now here's the thing, I have a Nagios Check_MK monitoring and I want it to be accessible by IP addresses in this subnet 10.0.0.0/16 only.
So I added these rules to my iptables:
iptables -A INPUT -p tcp -s 10.0.0.0/16 --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -s 10.0.0.0/16 --dport 443 -j ACCEPT
Now the problem is, I could not open the site even though I was already connected to VPN using my Macbook, except for my Android phone which was connected as well. Also, when I logged into my droplet, I noticed that my IP was not even private, again, except for my Android phone which has a 10.0.0.10 address.
[root@vpn01 ~]# w
17:00:16 up 20 days, 22:04, 2 users, load average: 0.05, 0.01, 0.00
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
root pts/0 123.45.67.890 16:35 0.00s 0.04s 0.00s w
root pts/1 10.0.0.10 17:00 3.00s 0.01s 0.01s -bash
[root@vpn01 ~]#
But I was able to ping my OpenVPN droplet from my Macbook.
myMBPr:~ root# ping -c 3 10.0.0.1
PING 10.0.0.1 (10.0.0.1): 56 data bytes
64 bytes from 10.0.0.1: icmp_seq=0 ttl=64 time=269.692 ms
64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=299.393 ms
64 bytes from 10.0.0.1: icmp_seq=2 ttl=64 time=315.473 ms
--- 10.0.0.1 ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 269.692/294.853/315.473/18.964 ms
myMBPr:~ root#
Here's my OpenVPN config:
[root@vpn01 openvpn]# grep -vE '^#|^;|^$' server.conf
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem
server 10.0.0.0 255.255.0.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 3
[root@vpn01 openvpn]#
My client's config:
client
dev tun
proto udp
remote vpn.mydomain.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo
verb 3
<ca>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
-----END PRIVATE KEY-----
</key>
Here's my iptables:
# Generated by iptables-save v1.4.7 on Mon Dec 23 15:32:07 2013
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [30:4092]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
-A INPUT -i lo -j ACCEPT
-A INPUT -p udp -m udp --dport 1194 -j ACCEPT
# Check_MK
-A INPUT -p tcp -s 10.0.0.0/16 --dport 80 -j ACCEPT
-A INPUT -p tcp -s 10.0.0.0/16 --dport 443 -j ACCEPT
# ICMP requests
-A INPUT -p icmp --icmp-type echo-request -s 10.0.0.0/16 -j ACCEPT
COMMIT
# Completed on Mon Dec 23 15:32:07 2013
# OpenVPN
*nat
:PREROUTING ACCEPT [128:5825]
:POSTROUTING ACCEPT [8:605]
:OUTPUT ACCEPT [8:605]
-A POSTROUTING -s 10.0.0.0/16 -o eth0 -j MASQUERADE
COMMIT
Here's my routing table:
[root@vpn01 ~]# ip route show | grep tun0
10.0.0.2 dev tun0 proto kernel scope link src 10.0.0.1
10.0.0.0/16 via 10.0.0.2 dev tun0
[root@vpn01 ~]#
If you need more info, please let me know.
Cheers,
JP
