Hi,
A little background:-
Setting up an OpenVPN server so that a VPN client can connect to the server and then route all traffic through that server, this is so that one can accomplish things like accessing servers on Amazon AWS which are IP whitelisted. The VPN server will sit on an office premises which have naturally inherit the right IP to have allow HTTP and SSH access to server on Amazon AWS.
I have OpenVPN installed via apt-get install on a Xubuntu Box, version 2.3.2 was installed.
I followed the following documentation to install and test the installation (I did testing by having a computer sitting on the same LAN, so my test client has the same LAN subnet as the OpenVPN server). My intention is to use this to test that a client can route HTTP and SSH traffic through the OpenVPN server. I hope testing in this way will not cause any problems.
We are provided with Internet by the building operators whom own the Router and NAT for our internet connection. My intention is not to involve them until i know i have a working system and then ask them to port forward packets from real clients as well as ensure the DHCP server gives the OpenVPN server the same IP address always.
Installation:-
I followed the following documentation to configure the ovpn files for server and client as well as the certificate keys for both server and client.
https://openvpn.net/index.php/open-source/documentation/howto.html#pki
pinging the OpenVPN server (10.8.0.1) worked!
I then went straight to the following section to route all client packets through the OpenVPN server.
https://openvpn.net/index.php/open-source/documentation/howto.html#redirect
At this point i unable to successfully ping 10.8.0.1, I was also unable to successfully perform a traceroute to
http://www.google.com.
The clients route table looked like this:-
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 10.8.0.5 128.0.0.0 UG 0 0 0 tun0
0.0.0.0 10.29.66.1 0.0.0.0 UG 0 0 0 eth0
10.8.0.1 10.8.0.5 255.255.255.255 UGH 0 0 0 tun0
10.8.0.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
10.29.66.0 0.0.0.0 255.255.255.0 U 1 0 0 eth0
10.29.66.236 10.29.66.1 255.255.255.255 UGH 0 0 0 eth0
128.0.0.0 10.8.0.5 128.0.0.0 UG 0 0 0 tun0
I uncommented net.ipv4.ip forward=1 after searching some blog articles on setting up OpenVPN, this did not work either.
I searched on this forum and found that maybe i haven't done enough IPTables stuff (I'm a software engineer not a Unix admin so my knowledge of IPTables is very rudimentary).
I used the script for IPTables found in this topic post
https://forums.openvpn.net/topic7694.html#p9977, for ease of reference i have posted the shell script here
#!/bin/sh
# Accept responses to pings
iptables -A INPUT -p icmp -m icmp --icmp-type echo-reply -j ACCEPT
# Respond to pings
iptables -A INPUT -p icmp -m icmp --icmp-type echo-request -j ACCEPT
# Accept traceroutes
iptables -A INPUT -p udp -m udp --dport 33434:33523 -j ACCEPT
#Enable forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
#Allow all TUN
iptables -A INPUT -i tun+ -j ACCEPT
iptables -A OUTPUT -o tun+ -j ACCEPT
iptables -A FORWARD -o tun+ -j ACCEPT
#Accept connections on 1194
iptables -A INPUT -p udp --dport 1194 -j ACCEPT
#Apply forwarding
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
iptables -A FORWARD -j REJECT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
# Display
iptables -L -v
I cleared IPTables by restarting the server and ran this shell script, i still could not get either the ping to work or traceroute, what i did notice is that using sudo iptables -L -v i could see the packet counts going up alot when i did anything that generated traffic from the client, which makes me think that OpenVPN is probably setup correctly, but i can't get the IPTables config right.
The following is the number of packets seen by iptables -L
Chain INPUT (policy ACCEPT 72 packets, 6505 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT icmp -- any any anywhere anywhere icmp echo-reply
0 0 ACCEPT icmp -- any any anywhere anywhere icmp echo-request
0 0 ACCEPT udp -- any any anywhere anywhere udp dpts:33434:33523
0 0 ACCEPT all -- tun+ any anywhere anywhere
103 8803 ACCEPT udp -- any any anywhere anywhere udp dpt:openvpn
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- any tun+ anywhere anywhere
0 0 ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
0 0 ACCEPT all -- any any 10.8.0.0/24 anywhere
0 0 REJECT all -- any any anywhere anywhere reject-with icmp-port-unreachable
Chain OUTPUT (policy ACCEPT 132 packets, 13019 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- any tun+ anywhere anywhere
What is wrong with the above shell script for routing all client traffic through the OpenVPN server when the client is sitting on the same LAN subnet? I assume the MASQUERADE part means that all packets going through tun0 should leave the OPenVPN server with ithe OpenVPN server's own IP address (i.e. 10.29.66.126), I have no idea if the packets are being sent forward by the OpenVPN server to it's default gateway (The managed internet router which should go to the internet)
