I'm attempting to get Openvpn server setup on a VPS were I do not have the kernel headers so I'm unable to use iptables. I can connect to the server fine, can ping the server ip from the client, but cannot ping out (without fwding, pretty much expected). My first question is that even possible? I've tried adding a static route bridging the two but with the errors I see I think that the system sees a route already [i][color=#BF0040]ip route add 10.8.0.0/24 via 111.222.333.444 dev venet0[/color][/i] after that I'm scratching my head. I've toyed with adding and removing some other things but routing is not my strong point. Could anyone here make any suggestions either on proper routing or any other non-iptables way of doing it? CentOS 7 64bit [color=#BF0040][i] #/sbin/sysctl net.ipv4.ip_forward net.ipv4.ip_forward = 1 1: lo: mtu 65536 qdisc noqueue state UNKNOWN link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: venet0: mtu 1500 qdisc noqueue state UNKNOWN link/void inet 127.0.0.1/32 scope host venet0 inet 111.222.333.444/24 brd 111.222.333.255 scope global venet0:0 inet6 2607:5300:100:200::159b/56 scope global valid_lft forever preferred_lft forever 3: tun0: mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100 link/none inet 10.8.0.1 peer 10.8.0.2/32 scope global tun0 # ip route show 10.8.0.2 dev tun0 proto kernel scope link src 10.8.0.1 10.8.0.0/24 via 10.8.0.2 dev tun0 111.222.333.0/24 dev venet0 proto kernel scope link src 111.222.333.444 169.254.0.0/16 dev venet0 scope link metric 1002 default dev venet0 scope link [/i][/color]

[quote="bubbacore"]I'm attempting to get Openvpn server setup on a VPS were I do not have the kernel headers so I'm unable to use iptables[/quote]So what is the point of the VPN ? [quote="bubbacore"]My first question is that even possible? I've tried adding a static route bridging[/quote]You cannot route an RFC1918 subnet onto the internet .. so basically the answer is NO .. unless there is some other Linux answer to changing the source IP address of your tunnel packets. As for bridging .. the consequences of bridging an outside facing interface are bad ..

Forwarding without iptables.

bubbacore

I'm attempting to get Openvpn server setup on a VPS were I do not have the kernel headers so I'm unable to use iptables. I can connect to the server fine, can ping the server ip from the client, but cannot ping out (without fwding, pretty much expected). My first question is that even possible? I've tried adding a static route bridging the two but with the errors I see I think that the system sees a route already ip route add 10.8.0.0/24 via 111.222.333.444 dev venet0 after that I'm scratching my head. I've toyed with adding and removing some other things but routing is not my strong point. Could anyone here make any suggestions either on proper routing or any other non-iptables way of doing it?

CentOS 7 64bit

#/sbin/sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: venet0: <BROADCAST,POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN
link/void
inet 127.0.0.1/32 scope host venet0
inet 111.222.333.444/24 brd 111.222.333.255 scope global venet0:0
inet6 2607:5300:100:200::159b/56 scope global
valid_lft forever preferred_lft forever
3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100
link/none
inet 10.8.0.1 peer 10.8.0.2/32 scope global tun0

# ip route show
10.8.0.2 dev tun0 proto kernel scope link src 10.8.0.1
10.8.0.0/24 via 10.8.0.2 dev tun0
111.222.333.0/24 dev venet0 proto kernel scope link src 111.222.333.444
169.254.0.0/16 dev venet0 scope link metric 1002
default dev venet0 scope link

TinCanTech

bubbacore wroteI'm attempting to get Openvpn server setup on a VPS were I do not have the kernel headers so I'm unable to use iptables

So what is the point of the VPN ?

bubbacore wroteMy first question is that even possible? I've tried adding a static route bridging

You cannot route an RFC1918 subnet onto the internet .. so basically the answer is NO .. unless there is some other Linux answer to changing the source IP address of your tunnel packets.

As for bridging .. the consequences of bridging an outside facing interface are bad ..

TiTex

why would you need kernel headers for applying iptables rules and/or enable ip forwarding ?

bubbacore

Well, after attempting to get it working on a CentOS 6 shell I started getting a load of module errors for ufw on boot. I started from scratch with a clean CentOS 7 install and it seems to be working fine now. VPN is up and clients are connected.