Hi guys,
Been struggling with this one and need some guidance. I have consistently been able to connect to my VPN, get an address in the 172.31.255.0/24 block and been able to go online (i.e. whatismyip or google ... or anything).
I am unable to, however, get to any of my servers, machines, etc... or resolve any DNS names. The second part is not that important.
My network looks like this:
WAN interface: vlan2
VPN INTERFACE: tun0 (172.31.255.1)
LAN interface: br0
Internal network: 192.168.0.0/16
Internal gateway / router: 192.168.13.1
Switch (just to complicate things): 192.168.100.1
Servers subnet: 192.168.200.0/24
I have been attempting to get this to work for OpenVPN and this is my config:
Server.conf (just the networking portion)
server 172.31.255.0 255.255.255.0
push "route 192.168.0.0 255.255.0.0"
push "dhcp-option DNS 192.168.13.1"
dev tun0
proto udp
And my client.conf is quite simple:
client
dev tun0
proto udp
remote <CNAME> 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca ca.crt
cert my.crt
key my.key
ns-cert-type server
comp-lzo
verb 11
log-append /var/log/openvpn/openvpn.log
status /var/log/openvpn/openvpn-status.log
persist-key
persist-tun
float
And I have tried iptables as such (for a while) as directed by almost all docs:
iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT
iptables -I FORWARD 1 --source 172.31.255.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT
Which was not working correctly for me, and at last attempt, my iptables look as such:
iptables -I FORWARD -i tun0 -o br0 -s 172.31.255.0/24 -d 192.168.0.0/16 -m conntrack --ctstate NEW -
j ACCEPT
iptables -I FORWARD -i tun0 -o vlan2 -s 172.31.255.0/24 -m conntrack --ctstate NEW -j ACCEPT
iptables -I FORWARD -i br0 -o vlan2 -s 192.168.0.0/16 -m conntrack --ctstate NEW -j ACCEPT
iptables -t nat -I POSTROUTING -o vlan2 -s 172.31.255.0/24 -j MASQUERADE
iptables -t nat -I POSTROUTING -o vlan2 -s 192.168.0.0/16 -j MASQUERADE
iptables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
