Hi all,
I have started setting up an OpenVPN setup, and am having a small number of hiccups that I am scratching my head at.
In short, I can access the OpenVPN from within my network, and have all my certs setup.
I cannot access my OpenVPN service from the internet however. I have followed guides online, but not had a lot of luck. Could I please ask for a review of my configurations below? Not at home currently, but will get the openvpn log when I am, and update the below. I am using DD-WRT on a Netgear 7000. My goal here is remote access to my home network. I already have DDNS etc setup, and that resolves no worries. If I do a tcpdump from the CLI of my router, I can see packets arrive on the correct port, but they don't go anywhere (so not an ISP firewall related issue).
interface names
Local lan - br0
internet inbound interface - ppp0
OpenVPn interface - tun0
iptables config
iptables -A INPUT -i tun0 -j ACCEPT
iptables -I INPUT 1 -p tcp –dport 15467 -j ACCEPT
iptables -I FORWARD 1 –source 192.168.100.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT
OpenVPN Server Configuration
port 15467
proto tcp
dev tun0
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
dh /tmp/openvpn/dh.pem
server 192.168.200.0 255.255.255.0
push "route 192.168.100.0 255.255.255.0"
push "dhcp-option DNS 192.168.200.1"
keepalive 10 120
cipher AES-256-CBC
comp-lzo
log-append openvpn.log
verb 6
mute 20
daemon
management localhost 14
CLI level iptables outputs
USERNAME@Nighthawk:~# iptables -L -n -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
13826 1055K ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 logdrop udp -- ppp0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:520
0 0 logdrop udp -- br0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:520
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:520
3 247 logdrop icmp -- ppp0 * 0.0.0.0/0 0.0.0.0/0
0 0 logdrop 2 -- * * 0.0.0.0/0 0.0.0.0/0
32 2043 ACCEPT 0 -- lo * 0.0.0.0/0 0.0.0.0/0 state NEW
3930 664K ACCEPT 0 -- br0 * 0.0.0.0/0 0.0.0.0/0 state NEW
911 96432 logdrop 0 -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- tun0 * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT 0 -- tun0 br0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- br0 tun0 0.0.0.0/0 0.0.0.0/0
43267 22M ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
3222 315K lan2wan 0 -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- br0 br0 0.0.0.0/0 0.0.0.0/0
0 0 logdrop tcp -- * ppp0 0.0.0.0/0 0.0.0.0/0 tcp dpt:1723
0 0 logdrop udp -- * ppp0 0.0.0.0/0 0.0.0.0/0 udp dpt:1701
0 0 logdrop udp -- * ppp0 0.0.0.0/0 0.0.0.0/0 udp dpt:500
0 0 TRIGGER 0 -- ppp0 br0 0.0.0.0/0 0.0.0.0/0 TRIGGER type:in match:0 relate:0
3222 315K trigger_out 0 -- br0 * 0.0.0.0/0 0.0.0.0/0
3172 313K ACCEPT 0 -- br0 * 0.0.0.0/0 0.0.0.0/0 state NEW
50 2000 logdrop 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 23771 packets, 19M bytes)
pkts bytes target prot opt in out source destination
Chain advgrp_1 (0 references)
pkts bytes target prot opt in out source destination
Chain advgrp_10 (0 references)
pkts bytes target prot opt in out source destination
Chain advgrp_2 (0 references)
pkts bytes target prot opt in out source destination
Chain advgrp_3 (0 references)
pkts bytes target prot opt in out source destination
Chain advgrp_4 (0 references)
pkts bytes target prot opt in out source destination
Chain advgrp_5 (0 references)
pkts bytes target prot opt in out source destination
Chain advgrp_6 (0 references)
pkts bytes target prot opt in out source destination
Chain advgrp_7 (0 references)
pkts bytes target prot opt in out source destination
Chain advgrp_8 (0 references)
pkts bytes target prot opt in out source destination
Chain advgrp_9 (0 references)
pkts bytes target prot opt in out source destination
Chain grp_1 (0 references)
pkts bytes target prot opt in out source destination
Chain grp_10 (0 references)
pkts bytes target prot opt in out source destination
Chain grp_2 (0 references)
pkts bytes target prot opt in out source destination
Chain grp_3 (0 references)
pkts bytes target prot opt in out source destination
Chain grp_4 (0 references)
pkts bytes target prot opt in out source destination
Chain grp_5 (0 references)
pkts bytes target prot opt in out source destination
Chain grp_6 (0 references)
pkts bytes target prot opt in out source destination
Chain grp_7 (0 references)
pkts bytes target prot opt in out source destination
Chain grp_8 (0 references)
pkts bytes target prot opt in out source destination
Chain grp_9 (0 references)
pkts bytes target prot opt in out source destination
Chain lan2wan (1 references)
pkts bytes target prot opt in out source destination
Chain logaccept (0 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain logdrop (9 references)
pkts bytes target prot opt in out source destination
888 95259 LOG 0 -- * * 0.0.0.0/0 0.0.0.0/0 state NEW LOG flags 7 level 4 prefix `DROP '
76 3420 LOG 0 -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID LOG flags 7 level 4 prefix `DROP '
964 98679 DROP 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain logreject (0 references)
pkts bytes target prot opt in out source destination
0 0 LOG 0 -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 7 level 4 prefix `WEBDROP '
0 0 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 reject-with tcp-reset
Chain trigger_out (1 references)
pkts bytes target prot opt in out source destination
CLI level iptables outputs (line numbers)
USERNAME@Nighthawk:~# iptables -n -L -v --line-numbers
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 13989 1073K ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
2 0 0 logdrop udp -- ppp0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:520
3 0 0 logdrop udp -- br0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:520
4 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:520
5 3 247 logdrop icmp -- ppp0 * 0.0.0.0/0 0.0.0.0/0
6 0 0 logdrop 2 -- * * 0.0.0.0/0 0.0.0.0/0
7 32 2043 ACCEPT 0 -- lo * 0.0.0.0/0 0.0.0.0/0 state NEW
8 4031 683K ACCEPT 0 -- br0 * 0.0.0.0/0 0.0.0.0/0 state NEW
9 919 96816 logdrop 0 -- * * 0.0.0.0/0 0.0.0.0/0
10 0 0 ACCEPT 0 -- tun0 * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT 0 -- tun0 br0 0.0.0.0/0 0.0.0.0/0
2 0 0 ACCEPT 0 -- br0 tun0 0.0.0.0/0 0.0.0.0/0
3 44035 22M ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
4 3257 318K lan2wan 0 -- * * 0.0.0.0/0 0.0.0.0/0
5 0 0 ACCEPT 0 -- br0 br0 0.0.0.0/0 0.0.0.0/0
6 0 0 logdrop tcp -- * ppp0 0.0.0.0/0 0.0.0.0/0 tcp dpt:1723
7 0 0 logdrop udp -- * ppp0 0.0.0.0/0 0.0.0.0/0 udp dpt:1701
8 0 0 logdrop udp -- * ppp0 0.0.0.0/0 0.0.0.0/0 udp dpt:500
9 0 0 TRIGGER 0 -- ppp0 br0 0.0.0.0/0 0.0.0.0/0 TRIGGER type:in match:0 relate:0
10 3257 318K trigger_out 0 -- br0 * 0.0.0.0/0 0.0.0.0/0
11 3207 316K ACCEPT 0 -- br0 * 0.0.0.0/0 0.0.0.0/0 state NEW
12 50 2000 logdrop 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 24003 packets, 19M bytes)
num pkts bytes target prot opt in out source destination
Chain advgrp_1 (0 references)
num pkts bytes target prot opt in out source destination
Chain advgrp_10 (0 references)
num pkts bytes target prot opt in out source destination
Chain advgrp_2 (0 references)
num pkts bytes target prot opt in out source destination
Chain advgrp_3 (0 references)
num pkts bytes target prot opt in out source destination
Chain advgrp_4 (0 references)
num pkts bytes target prot opt in out source destination
Chain advgrp_5 (0 references)
num pkts bytes target prot opt in out source destination
Chain advgrp_6 (0 references)
num pkts bytes target prot opt in out source destination
Chain advgrp_7 (0 references)
num pkts bytes target prot opt in out source destination
Chain advgrp_8 (0 references)
num pkts bytes target prot opt in out source destination
Chain advgrp_9 (0 references)
num pkts bytes target prot opt in out source destination
Chain grp_1 (0 references)
num pkts bytes target prot opt in out source destination
Chain grp_10 (0 references)
num pkts bytes target prot opt in out source destination
Chain grp_2 (0 references)
num pkts bytes target prot opt in out source destination
Chain grp_3 (0 references)
num pkts bytes target prot opt in out source destination
Chain grp_4 (0 references)
num pkts bytes target prot opt in out source destination
Chain grp_5 (0 references)
num pkts bytes target prot opt in out source destination
Chain grp_6 (0 references)
num pkts bytes target prot opt in out source destination
Chain grp_7 (0 references)
num pkts bytes target prot opt in out source destination
Chain grp_8 (0 references)
num pkts bytes target prot opt in out source destination
Chain grp_9 (0 references)
num pkts bytes target prot opt in out source destination
Chain lan2wan (1 references)
num pkts bytes target prot opt in out source destination
Chain logaccept (0 references)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain logdrop (9 references)
num pkts bytes target prot opt in out source destination
1 894 95563 LOG 0 -- * * 0.0.0.0/0 0.0.0.0/0 state NEW LOG flags 7 level 4 prefix `DROP '
2 78 3500 LOG 0 -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID LOG flags 7 level 4 prefix `DROP '
3 972 99063 DROP 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain logreject (0 references)
num pkts bytes target prot opt in out source destination
1 0 0 LOG 0 -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 7 level 4 prefix `WEBDROP '
2 0 0 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 reject-with tcp-reset
Chain trigger_out (1 references)
num pkts bytes target prot opt in out source destination
Let me know if there is anything more I can provide to assist.
