OpenVPN & iptables: NAT issues

turbomeister

New here, but I've searched the forum many times to get my OpenVPN installation working.

What I do is connect multiple clients to a single server over tcp port 443 (have to get past a firewall), then I use NAT to access the internet through the VPN on each client. This worked well, however idiot me failed to save my iptables rules and rebooted the server. Now I've lost the PREROUTING and POSTROUTING rules I had and can't get it working again for the life of me.

Any iptables experts willing to help, by any chance?

Here is the result of "iptables -L"

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
fail2ban-ssh  tcp  --  anywhere             anywhere             multiport dports ssh
ACCEPT     all  --  anywhere             anywhere            
REJECT     all  --  anywhere             127.0.0.0/8          reject-with icmp-port-unreachable
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:smtp
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:urd
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:submission
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:pop3
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:pop3s
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:imap2
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:imaps
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:25565
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:hkp
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:ssh
ACCEPT     icmp --  anywhere             anywhere             icmp echo-request
LOG        all  --  anywhere             anywhere             limit: avg 5/min burst 5 LOG level debug prefix "iptables denied: "
DROP       all  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
DROP       all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            

Chain fail2ban-ssh (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere

Here's my server config:

port 443
proto tcp
dev tun
ca ca.crt
cert ***.crt
key ***.key  # This file should be kept secret
dh dh2048.pem
server 192.168.2.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route-delay 10"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 192.168.2.1"
client-to-client
keepalive 10 120
comp-lzo
max-clients 3
persist-key
persist-tun
status openvpn-status.log
verb 4

And client config, for good measure:

client
dev tun
proto tcp
remote ****.com 443
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert ****.crt
key ****.key
ns-cert-type server
comp-lzo
verb 4
route-delay 5

brendan

look into fwbuilder. i use it and could not be happier with the firewall policy i have. it handles several firewall types (pfsense, iptables, PIX/ASA, etc) and their rulebases , NAT and routing. you can have multiple firewalls managed in it, too.

Skaperen

so your firewall is blocking UDP?

RobV

In rc.local this is included.

iptables -t nat -A INPUT -i eth0 -p udp -m udp --dport 1194 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.2.*

It works for me.

RobV

RobV wroteIn rc.local this is included.

iptables -t nat -A INPUT -i eth0 -p udp -m udp --dport 1194 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.2.*

It works for me.

The star of 192.168.2.* is a number.
So put in 192.168.2.200 for example.