Hi, I'm hoping that this is a simple fix that I'm just overlooking.
I've configured one OpenVPN to use UDP, and that works perfectly. I've set up a second OpenVPN server to allow TCP connections over 443, as a backup in case 1194 or UDP is blocked. Everything works fine, except that I cannot, from any client, access an HTTPS / 443 website. My logs show: " MULTI: bad source address from client, packet dropped tcp 443 openvpn". I've been trying to solve this for a bit, and just can't figure it out. I was hoping someone could help me figure out what I'm doing wrong. I paste my codes below. Thanks a ton!
# local 192.168.0.30 # This caused me probs with UDP, so I commented out
dev tun
proto tcp
port 443
ca /no issue
cert /no issue
key /no issue
dh /no issue
server 10.8.0.0 255.255.255.0
ifconfig 10.8.0.1 10.8.0.2
push "route 10.8.0.1 255.255.255.255"
push "route 10.8.0.0 255.255.255.0"
push "route 192.168.0.30 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
push "dhcp-option DNS 192.168.0.1" # This should already match your router address and not need to be changed.
push "redirect-gateway def1"
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-256-CBC
keysize 256
comp-lzo
user me
group me
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 6
# Flush all current rules from iptables
iptables -F
#
#
# Set access for localhost - necessary for many programs
iptables -A INPUT -i lo -j ACCEPT
#
#
# Accept packets belonging to established and related connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#
#
iptables -A INPUT -p tcp --dport 4000 -j ACCEPT
# iptables -A INPUT -p udp --dport 1194 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
#
#
# Allows VPN traffic to Forward
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
#
#
# Make and exception to 'iptables -P FORWARD DROP', allowing specifically 1194 connections to forward. Note that 192.168.0.30 could come with a port, i.e., 192.168.0.30:22 (or even a range of ports), allowing the VPN client to forward (access) only one port on the outbound. See http://www.thegeekstuff.com/2011/06/iptables-rules-examples/
#iptables -t nat -A PREROUTING -p udp --dport 1194 -j DNAT --to 192.168.0.30
iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to 192.168.0.30
#
#
# Allows proper routing of VPN subnet
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
#iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT ---source-to 192.168.0.30
#
#
#
#
# Set default policies for INPUT, FORWARD and OUTPUT chains
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
#
#
# Save settings
/sbin/service iptables save
#
#
# List rules, verbose
iptables -L -v
