bearrito
I'm not sure if this a problem with my vpn configuration or a strict routing issue.
Scenario
Server with single NIC
External address on eth0 : $EXTERNAL_IP
VPN Address : 10.8.0.1
VPN Client Address (Assigned by ccd) : 10.8.0.201
For simulation purposes I have been running python -m SimpleHTTPServer 8443 on both server and client in order to simulate my actual webservice.
I run the service on the server only to check my firewall and forwarding rules.
Goal
Forward web service request to a client listening port 8443
What works
From server I can ping 10.8.0.201
From the client I can ping 10.8.0.1
From the server I can curl the client at 10.8.0.201:8443
If I do not have a PREROUTING rule (see below) I can curl the server service on 8443 from any external network.
When I enable the PREROUTING rule I get no response. To me this means my PREROUTING rule is matched but is then dropped somewhere. I can tell the request is never received by the client as I don't see the request in the logs.
Vpn Server Routes
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 $EXTERNAL_IP_GATEWAY 0.0.0.0 UG 0 0 0 eth0
10.8.0.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0
$EXTERNAL 0.0.0.0 255.255.254.0 U 0 0 0 eth0
Server Conf
local $EXTERNAL_IP
port 1194
proto udp
dev tun
topology "subnet"
push "topology subnet"
mode server
tls-server
ifconfig 10.8.0.1 255.255.255.0
push "route-gateway 10.8.0.1"
ifconfig-pool 10.8.0.2 10.8.0.50 255.255.255.0
Server NAT
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
DNAT tcp -- 0.0.0.0/0 $EXTERNAL_IP tcp dpt:8443 to:10.8.0.201:8443
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
Server Forward and Input and Output
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
REJECT all -- 0.0.0.0/0 127.0.0.0/8 reject-with icmp-port-unreachable
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8443
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:2345
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state NEW
ACCEPT all -- 10.8.0.0/24 0.0.0.0/0
DROP all -- 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
