Hi!
I'm tring to make an OpenVPN server on my VPS with FreeBSD 10.3, I installed openvpn package, create certificate etc... that's my server config:
port 1194
proto tcp
dev tun
ca /usr/local/etc/openvpn/keys/ca.crt
cert /usr/local/etc/openvpn/keys/openvpn-server.crt
key /usr/local/etc/openvpn/keys/openvpn-server.key # This file should be kept secret
dh /usr/local/etc/openvpn/keys/dh.pem
topology subnet
server 10.0.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.0.0.1 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
cipher AES-256-CBC
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
my client config:
client
dev tun
proto tcp
remote MYSERVER 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert redfoxy.crt
key redfoxy.key
remote-cert-tls server
cipher AES-256-CBC
comp-lzo
verb 3
My ipfw on server is open (for test) but to be sure I add some specific rules:
PF="ipfw -q add"
EXTIP="external ip"
EXTINT="vtnet0"
ipfw -q -f flush
ipfw -q nat 1 config if $EXTINT
$PF nat 1 all from 10.0.0.0/24 to any out via $EXTINT
$PF nat 1 all from any to any in via $EXTINT
# loopback
$PF 010 allow all from any to any via lo0
$PF 011 allow ip from any to any via tun0
$PF 015 deny all from any to 127.0.0.0/8
$PF 016 deny all from 127.0.0.0/8 to any
$PF 017 allow ip from 10.0.0.0/24 to any
$PF 020 deny tcp from any to any frag
#$PF 018 deny ip from any to any not antispoof in
$PF 030 allow ip from "table(3)" to me # White list
$PF 031 deny tcp from "table(1)" to any # Fail2ban
$PF 032 deny ip from "table(2)" to me # Black-List
# statefull
$PF 050 check-state
$PF 060 allow tcp from any to any established
$PF 070 allow all from any to any out keep-state
$PF 080 allow icmp from me to any # Ping da me
$PF 081 deny icmp from any to me # Ping da altri
# open port ftp (20,21), ssh (22), mail (25)
# http (80), dns (53) etc
$PF 110 allow tcp from any to any 21 # FTP
$PF 120 allow tcp from any to any 25 # SMTP
$PF 130 allow all from any to any 53 # DNS
$PF 140 allow tcp from any to any 80 # HTTP
$PF 150 deny all from any to any 110 # POP3
$PF 160 allow all from any to any 143 # IMAP
$PF 170 allow tcp from any to any 443 # HTTPS
$PF 180 allow tcp from any to any 5522 # SSH
$PF 150 allow tcp from any to any 993 # IMAPS
#$PF 150 deny all from any to any 995 # POP3s
#$PF 160 allow tcp from any to any 465 # SMTPS
$PF 00170 allow udp from any to any 1194 # OpenVPN
#$PF 120 allow tcp from any to any 21 out
#$PF 160 allow tcp from any to any 25 out
#$PF 175 allow tcp from any to any 53 in
#$PF 180 allow udp from any to any 53 out
#$PF 185 allow tcp from any to any 53 out
#$PF 210 allow tcp from any to any 80 out
#$PF 220 allow tcp from any to any 443 out
#$PF 140 allow tcp from any to any 5522 out
# TeamSpeak-Server
#$PF 230 allow udp from any to any 9987 in
#$PF 235 allow udp from any to any 9999 in
#$PF 240 allow tcp from any to any 10011 in
#$PF 245 allow tcp from any to any 30033 in
# rtorrent
$PF 300 allow all from any to any 60125-64125
$PF 305 allow all from any to any 63425
# allow ntp updates
$PF 307 allow udp from any 123 to $EXTIP in via $EXTINT
$PF 308 allow udp from $EXTIP to any 123 out via $EXTINT
rc.conf:
firewall_enable="YES"
firewall_type="open"
firewall_logging="YES"
firewall_logdeny="YES"
firewall_script="/home/serverweb/etc/ipfw.rules"
#firewall_type="open"
openvpn_enable="YES"
gateway_enable="YES"
firewall_nat_enable="YES"
firewall_nat_interface="vtnet0"
natd_enable="YES"
natd_interface="vtnet0"
natd_flags="-dynamic -m"
To be sure that ip forwarding is active i does:
# sysctl net.inet.ip.forwarding=1
net.inet.ip.forwarding: 1 -> 1
But... After that I can only reach my server, I can't ping 8.8.8.8 or browse web from my client...
Any suggest?
