Hi all,
I setup an Open VPN server on Centos 6 and can successfully connect from a Windows machine.
The problem:
Return traffic from the internet to the VPN server does not go into the tun0 interface.
It looks to get dropped.
I've narrowed it down to this part in my iptable script:
iptables -P FORWARD DROP
When I change this to ACCEPT it all works.
Below is my entire iptables script.
I can't see why that would block all VPN traffic when I have this:
iptables -A FORWARD -s 10.0.0.0/8 -j ACCEPT
script:
#!/bin/bash
#
# iptables example configuration script
#
# Flush all current rules from iptables
#
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
#
# Allow SSH connections on tcp port 22
#
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
#
#Set home network access permissions
# iptables -A INPUT -p tcp --dport 443 -j ACCEPT
#iptables -A INPUT -p tcp --dport 5001 -j ACCEPT
#iptables -A INPUT -p udp --dport 5001 -j ACCEPT
iptables -A INPUT -s 192.168.0.0/16 -j ACCEPT
iptables -A INPUT -s *mypublicIP*/29 -j ACCEPT
iptables -A INPUT -s 172.16.0.0/12 -j ACCEPT
iptables -A INPUT -s 10.0.0.0/8 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
iptables -A FORWARD -s 10.0.0.0/8 -j ACCEPT
# 12. Ping from inside to outside
iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
# 13. Ping from outside to inside
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
#
# Set access for localhost
#
iptables -A INPUT -i lo -j ACCEPT
#
# Accept packets belonging to established and related connections
#
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Set default policies for INPUT, FORWARD and OUTPUT chains
#
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
#
# Save settings
#
/sbin/service iptables save
#
# List rules
#
iptables -L -v
