iptables configuration of forwarding internal/external traffic

HHGAG

Hi @ll,

we've following constellation:

root@de /etc/iptables # ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 90:1b:0e:94:77:54 brd ff:ff:ff:ff:ff:ff
    inet6 2a01:fff:fff:fff::1/64 scope global 
       valid_lft forever preferred_lft forever
3: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 68:05:ca:24:7f:a7 brd ff:ff:ff:ff:ff:ff
    inet6 fdf4:2503:2f49:fe5c:276:0:3001:1/64 scope global 
       valid_lft forever preferred_lft forever
4: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 100
    link/none 
    inet6 fdf4:2503:2f49:fe5c:276:0:3101:1/112 scope global 
       valid_lft forever preferred_lft forever

root@de /etc/openvpn # cat s2s.server.conf 
local fdf4:2503:2f49:fe5c:0276:0000:3001:0001

port 1195
proto udp6
dev tun

ca ca.crt
cert server.crt
key server.key
dh dh4096.pem

tls-auth ta.key 0
crl-verify crl.pem

client-config-dir ccd

ifconfig-pool-persist ipp.txt
status openvpn-status.log

server 10.0.30.0 255.255.255.0
server-ipv6 fdf4:2503:2f49:fe5c:0276:0000:3101:0000/112

client-to-client
keepalive 10 120
cipher AES-256-CBC

comp-lzo

user nobody
group nogroup

persist-key
persist-tun

verb 3

tun-ipv6
push tun-ipv6

mode server
tls-server

auth SHA256
push "explicit-exit-notify 3"

root@de /etc/iptables # cat rules.v6 
# Generated by ip6tables-save v1.6.0 on Wed May 18 19:57:27 2016
*nat
:PREROUTING ACCEPT [51:6124]
:INPUT ACCEPT [75:8572]
:OUTPUT ACCEPT [6:1848]
:POSTROUTING ACCEPT [6:1848]
-A PREROUTING -i eth0 -p udp -m udp --dport 1195 -j DNAT --to-destination [fdf4:2503:2f49:fe5c:276:0:3001:1]:1195
-A POSTROUTING -p udp --dport 1195 -j MASQUERADE
COMMIT
# Completed on Wed May 18 19:57:27 2016

root@de /etc/iptables # tcpdump -i eth0 | grep target.client.com
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
12:30:55.778487 IP6 target.client.com.35957 > local.server.com.1195: UDP, length 428
12:30:56.695215 IP6 target.client.com.35414 > local.server.com.1195: UDP, length 1148
12:30:59.034105 IP6 target.client.com.35957 > local.server.com.1195: UDP, length 1148
12:30:59.034156 IP6 target.client.com.35957 > local.server.com.1195: UDP, length 428
12:31:01.434615 IP6 fdf4:2503:2f49:fe5c:276:0:3001:1.1195 > target.client.com.39040: UDP, length 54
12:31:02.344491 IP6 fdf4:2503:2f49:fe5c:276:0:3001:1.1195 > target.client.com.39040: UDP, length 62
12:31:03.374855 IP6 target.client.com.35957 > local.server.com.1195: UDP, length 1148
12:31:07.891690 IP6 target.client.com.35957 > local.server.com.1195: UDP, length 428
12:31:10.286902 IP6 fdf4:2503:2f49:fe5c:276:0:3001:1.1195 > target.client.com.43040: UDP, length 54
12:31:11.008608 IP6 target.client.com.35414 > local.server.com.1195: UDP, length 428
12:31:11.279386 IP6 target.client.com.35957 > local.server.com.1195: UDP, length 1148
12:31:11.919439 IP6 fdf4:2503:2f49:fe5c:276:0:3001:1.1195 > target.client.com.43040: UDP, length 62
12:31:12.215956 IP6 target.client.com.35414 > local.server.com.1195: UDP, length 1148
12:31:12.629235 IP6 target.client.com.44701 > local.server.com.1195: UDP, length 54
12:31:12.629734 IP6 local.server.com.1195 > target.client.com.44701: UDP, length 66
12:31:12.632864 IP6 target.client.com.44701 > local.server.com.1195: UDP, length 62
12:31:12.632915 IP6 target.client.com.44701 > local.server.com.1195: UDP, length 355
12:31:12.660444 IP6 local.server.com.1195 > target.client.com.44701: UDP, length 1160
12:31:12.660457 IP6 local.server.com.1195 > target.client.com.44701: UDP, length 1148
12:31:12.660471 IP6 local.server.com.1195 > target.client.com.44701: UDP, length 1148
12:31:12.660480 IP6 local.server.com.1195 > target.client.com.44701: UDP, length 1148
12:31:12.663618 IP6 target.client.com.44701 > local.server.com.1195: UDP, length 62
12:31:12.663641 IP6 target.client.com.44701 > local.server.com.1195: UDP, length 62
12:31:12.663643 IP6 target.client.com.44701 > local.server.com.1195: UDP, length 62
12:31:12.663706 IP6 local.server.com.1195 > target.client.com.44701: UDP, length 1136
12:31:12.664791 IP6 target.client.com.44701 > local.server.com.1195: UDP, length 62
189 packets captured
200 packets received by filter
0 packets dropped by kernel

Packages from

fdf4:2503:2f49:fe5c:276:0:3001:1.1195

don't get to target client. So the TLS handshake failes. Which iptable rules are missing. Thnx in advance.

Traffic

I should think iptables -F will help ..

HHGAG

Flushing iptables can't help 🙂 (proved anyway ^^)

WAN is at

eth0

, openvpn listens at

fdf4:2503:2f49:fe5c:276:0:3001:1

which is up at

enp1s0

Incoming traffic get's at

eth0

and has to be forwarded to openvpn at

enp1s0

, which seems to work, but the backward way seems to work only at the half of the traffic, but what is missing.

The packages from

fdf4:2503:2f49:fe5c:276:0:3001:1

to the target client seems to be send to a port, which isn't used from the client to the server, so ist could be dropped, while port hasn't been opened.

HHGAG

Ok, I think i've got it. Connection has been established.

These iptables entries seems to work. FORWARD rule was missing.

root@de /etc/iptables # cat rules.v6 
# Generated by ip6tables-save v1.6.0 on Wed May 18 19:57:27 2016
*nat
:PREROUTING ACCEPT [51:6124]
:INPUT ACCEPT [75:8572]
:OUTPUT ACCEPT [6:1848]
:POSTROUTING ACCEPT [6:1848]
-A PREROUTING -i eth0 -p udp -m udp --dport 1195 -j DNAT --to-destination [fdf4:2503:2f49:fe5c:276:0:3001:1]:1195
-A POSTROUTING -p udp --dport 1195 -j MASQUERADE
COMMIT
# Completed on Wed May 18 19:57:27 2016
# Generated by ip6tables-save v1.6.0 on Wed May 18 19:57:27 2016
*filter
:INPUT ACCEPT [6330:1732599]
:FORWARD ACCEPT [130:13322]
:OUTPUT ACCEPT [4873:1153766]
-A FORWARD -p udp -d fdf4:2503:2f49:fe5c:276:0:3001:1 --dport 1195 -j ACCEPT
COMMIT
# Completed on Wed May 18 19:57:27 2016