Need help to access ip addresses on server network

neiloc

My OpenVPN setup works great point to point - client to server. My problem is that clients cannot access other IP adresses on the OpenVPN server's network. I know this seems to be a common problem, but I have tried all the suggested solutions I can find and still cannot get it to work.

My configuration is:
- Server network................: 10.90.0.0/24
- Server network default gateway: 10.90.0.1 (a TPLink router)
- Server network DHCP sever.....: 10.90.0.1 (a TPLink router)
- Server network DNS server.....: 10.90.0.1 (a TPLink router)
- OpenVPN server................: 10.90.0.14 (OpenSUSE LEAP 42.2 - IBM X3650)
- OpenVPN internal network......: 10.8.0.0/24

Note that on the OpenVPN server (10.90.0.14) br0 is a bridge device enslaving eth0 and tap0 (I need this for an application I run on that server).

ifconfig on the OpenVPN server (10.90.0.14) looks like:

  br0       Link encap:Ethernet  HWaddr 7E:82:78:41:FF:10  
            inet addr:10.90.0.14  Bcast:10.90.0.255  Mask:255.255.255.0
            inet6 addr: fe80::e61f:13ff:fe45:7a0/64 Scope:Link
            UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
            RX packets:728501 errors:0 dropped:0 overruns:0 frame:0
            TX packets:223068 errors:0 dropped:0 overruns:0 carrier:0
            collisions:0 txqueuelen:1000 
            RX bytes:229330372 (218.7 Mb)  TX bytes:51165332 (48.7 Mb)

  eth0      Link encap:Ethernet  HWaddr E4:1F:13:45:07:A0 
            UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
            RX packets:1122790 errors:0 dropped:0 overruns:0 frame:0
            TX packets:235585 errors:0 dropped:0 overruns:0 carrier:0
            collisions:0 txqueuelen:1000 
            RX bytes:385144463 (367.3 Mb)  TX bytes:53351662 (50.8 Mb)

  tap0      Link encap:Ethernet  HWaddr 7E:82:78:41:FF:10  
            inet6 addr: fe80::7c82:78ff:fe41:ff10/64 Scope:Link
            UP BROADCAST RUNNING  MTU:1500  Metric:1
            RX packets:12272 errors:0 dropped:0 overruns:0 frame:0
            TX packets:503096 errors:0 dropped:0 overruns:0 carrier:0
            collisions:0 txqueuelen:1000 
            RX bytes:906127 (884.8 Kb)  TX bytes:75656486 (72.1 Mb)

  tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
            inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
            UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
            RX packets:83806 errors:0 dropped:0 overruns:0 frame:0
            TX packets:91516 errors:0 dropped:0 overruns:0 carrier:0
            collisions:0 txqueuelen:100 
            RX bytes:3490296 (3.3 Mb)  TX bytes:31953893 (30.4 Mb)

Routing on the OpenVPN server (10.90.0.14) looks like:

  Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
  default         10.90.0.1       0.0.0.0         UG        0 0          0 br0
  10.8.0.0        10.8.0.2        255.255.255.0   UG        0 0          0 tun0
  10.8.0.2        *               255.255.255.255 UH        0 0          0 tun0
  10.90.0.0       *               255.255.255.0   U         0 0          0 br0

The OpenVPN server.conf file (on 10.90.0.14) looks like:

  port 1194
  proto udp
  dev tun
  ca ca.crt
  cert server.crt
  key server.key 
  dh dh2048.pem
  server 10.8.0.0 255.255.255.0
  ifconfig-pool-persist ipp.txt
  push "route 10.90.0.0 255.255.255.0"
  client-to-client
  keepalive 10 120
  comp-lzo
  persist-key
  persist-tun
  status openvpn-status.log
  log /var/log/openvpn.log
  verb 5

The TPLink router at 10.90.0.1 includes a static route definition for 10.8.0.0/24 directed to 10.90.0.14. It also forwards port 1194 (OpenVPN port) to 10.90.0.14.

10.90.0.24 is another machine on the server network that I would like OpenVPN clients to access.

Here are some ping responses from 10.90.0.14 (the OpenVPN server):

  PING 10.90.0.1 (10.90.0.1) 56(84) bytes of data.
  64 bytes from 10.90.0.1: icmp_seq=1 ttl=64 time=0.239 ms
  64 bytes from 10.90.0.1: icmp_seq=2 ttl=64 time=0.213 ms
  64 bytes from 10.90.0.1: icmp_seq=3 ttl=64 time=0.234 ms
  64 bytes from 10.90.0.1: icmp_seq=4 ttl=64 time=0.234 ms
  64 bytes from 10.90.0.1: icmp_seq=5 ttl=64 time=0.207 ms
  --- 10.90.0.1 ping statistics ---
  5 packets transmitted, 5 received, 0% packet loss, time 4000ms
  rtt min/avg/max/mdev = 0.207/0.225/0.239/0.018 ms

  PING 10.90.0.14 (10.90.0.14) 56(84) bytes of data.
  64 bytes from 10.90.0.14: icmp_seq=1 ttl=64 time=0.032 ms
  64 bytes from 10.90.0.14: icmp_seq=2 ttl=64 time=0.037 ms
  64 bytes from 10.90.0.14: icmp_seq=3 ttl=64 time=0.039 ms
  64 bytes from 10.90.0.14: icmp_seq=4 ttl=64 time=0.045 ms
  64 bytes from 10.90.0.14: icmp_seq=5 ttl=64 time=0.041 ms
  --- 10.90.0.14 ping statistics ---
  5 packets transmitted, 5 received, 0% packet loss, time 3997ms
  rtt min/avg/max/mdev = 0.032/0.038/0.045/0.009 ms

  PING 10.90.0.24 (10.90.0.24) 56(84) bytes of data.
  64 bytes from 10.90.0.24: icmp_seq=1 ttl=64 time=0.294 ms
  64 bytes from 10.90.0.24: icmp_seq=2 ttl=64 time=0.258 ms
  64 bytes from 10.90.0.24: icmp_seq=3 ttl=64 time=0.277 ms
  64 bytes from 10.90.0.24: icmp_seq=4 ttl=64 time=0.229 ms
  64 bytes from 10.90.0.24: icmp_seq=5 ttl=64 time=0.177 ms
  --- 10.90.0.24 ping statistics ---
  5 packets transmitted, 5 received, 0% packet loss, time 3998ms
  rtt min/avg/max/mdev = 0.177/0.247/0.294/0.041 ms

  PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.
  64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=0.022 ms
  64 bytes from 10.8.0.1: icmp_seq=2 ttl=64 time=0.037 ms
  64 bytes from 10.8.0.1: icmp_seq=3 ttl=64 time=0.037 ms
  64 bytes from 10.8.0.1: icmp_seq=4 ttl=64 time=0.040 ms
  64 bytes from 10.8.0.1: icmp_seq=5 ttl=64 time=0.042 ms
  --- 10.8.0.1 ping statistics ---
  5 packets transmitted, 5 received, 0% packet loss, time 3997ms
  rtt min/avg/max/mdev = 0.022/0.035/0.042/0.009 ms

Here are some ping responses from 10.90.0.24 (not the OpenVPN server):

  PING 10.90.0.1 (10.90.0.1) 56(84) bytes of data.
  64 bytes from 10.90.0.1: icmp_seq=1 ttl=64 time=0.292 ms
  64 bytes from 10.90.0.1: icmp_seq=2 ttl=64 time=0.276 ms
  64 bytes from 10.90.0.1: icmp_seq=3 ttl=64 time=0.234 ms
  64 bytes from 10.90.0.1: icmp_seq=4 ttl=64 time=0.194 ms
  64 bytes from 10.90.0.1: icmp_seq=5 ttl=64 time=0.235 ms
  --- 10.90.0.1 ping statistics ---
  5 packets transmitted, 5 received, 0% packet loss, time 3996ms
  rtt min/avg/max/mdev = 0.194/0.246/0.292/0.036 ms

  PING 10.90.0.14 (10.90.0.14) 56(84) bytes of data.
  64 bytes from 10.90.0.14: icmp_seq=1 ttl=64 time=0.241 ms
  64 bytes from 10.90.0.14: icmp_seq=2 ttl=64 time=0.169 ms
  64 bytes from 10.90.0.14: icmp_seq=3 ttl=64 time=0.173 ms
  64 bytes from 10.90.0.14: icmp_seq=4 ttl=64 time=0.195 ms
  64 bytes from 10.90.0.14: icmp_seq=5 ttl=64 time=0.217 ms
  --- 10.90.0.14 ping statistics ---
  5 packets transmitted, 5 received, 0% packet loss, time 3998ms
  rtt min/avg/max/mdev = 0.169/0.199/0.241/0.027 ms

  PING 10.90.0.24 (10.90.0.24) 56(84) bytes of data.
  64 bytes from 10.90.0.24: icmp_seq=1 ttl=64 time=0.020 ms
  64 bytes from 10.90.0.24: icmp_seq=2 ttl=64 time=0.031 ms
  64 bytes from 10.90.0.24: icmp_seq=3 ttl=64 time=0.036 ms
  64 bytes from 10.90.0.24: icmp_seq=4 ttl=64 time=0.061 ms
  64 bytes from 10.90.0.24: icmp_seq=5 ttl=64 time=0.052 ms
  --- 10.90.0.24 ping statistics ---
  5 packets transmitted, 5 received, 0% packet loss, time 4002ms
  rtt min/avg/max/mdev = 0.020/0.040/0.061/0.014 ms

  PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.
  64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=0.479 ms
  From 10.90.0.1: icmp_seq=2 Redirect Host(New nexthop: 10.90.0.14)
  64 bytes from 10.8.0.1: icmp_seq=2 ttl=64 time=0.373 ms
  From 10.90.0.1: icmp_seq=3 Redirect Host(New nexthop: 10.90.0.14)
  64 bytes from 10.8.0.1: icmp_seq=3 ttl=64 time=0.382 ms
  From 10.90.0.1: icmp_seq=4 Redirect Host(New nexthop: 10.90.0.14)
  64 bytes from 10.8.0.1: icmp_seq=4 ttl=64 time=0.390 ms
  From 10.90.0.1: icmp_seq=5 Redirect Host(New nexthop: 10.90.0.14)
  64 bytes from 10.8.0.1: icmp_seq=5 ttl=64 time=0.377 ms
  --- 10.8.0.1 ping statistics ---
  5 packets transmitted, 5 received, 0% packet loss, time 3998ms
  rtt min/avg/max/mdev = 0.373/0.400/0.479/0.041 ms

192.168.1.7 is a Windows 7 OpenVPN client machine on a remote network.

The routing table for 192.168.1.7 (with an OpenVPN connection established) looks like:

  IPv4 Route Table
  ===========================================================================
  Active Routes:
  Network Destination        Netmask          Gateway       Interface  Metric
            0.0.0.0          0.0.0.0      192.168.1.1      192.168.1.7     10
           10.8.0.0    255.255.255.0         10.8.0.5         10.8.0.6    276
           10.8.0.4  255.255.255.252         On-link          10.8.0.6    276
           10.8.0.6  255.255.255.255         On-link          10.8.0.6    276
           10.8.0.7  255.255.255.255         On-link          10.8.0.6    276
          10.90.0.0    255.255.255.0         10.8.0.5         10.8.0.6    276
          127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
          127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
    127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        192.168.1.0    255.255.255.0         On-link       192.168.1.7    266
        192.168.1.7  255.255.255.255         On-link       192.168.1.7    266
      192.168.1.255  255.255.255.255         On-link       192.168.1.7    266
          224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
          224.0.0.0        240.0.0.0         On-link       192.168.1.7    266
          224.0.0.0        240.0.0.0         On-link          10.8.0.6    276
    255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
    255.255.255.255  255.255.255.255         On-link       192.168.1.7    266
    255.255.255.255  255.255.255.255         On-link          10.8.0.6    276
  ===========================================================================

Here are some ping responses from 192.168.1.7 (an OpenVPN client):

  H:\>ping 10.90.0.1
  Pinging 10.90.0.1 with 32 bytes of data:
  Request timed out.
  Request timed out.
  Request timed out.
  Request timed out.
  Ping statistics for 10.90.0.1:
      Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

  H:\>ping 10.90.0.14
  Pinging 10.90.0.14 with 32 bytes of data:
  Reply from 10.90.0.14: bytes=32 time=1ms TTL=64
  Reply from 10.90.0.14: bytes=32 time=1ms TTL=64
  Reply from 10.90.0.14: bytes=32 time=1ms TTL=64
  Reply from 10.90.0.14: bytes=32 time=1ms TTL=64
  Ping statistics for 10.90.0.14:
      Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
  Approximate round trip times in milli-seconds:
      Minimum = 1ms, Maximum = 1ms, Average = 1ms

  H:\>ping 10.90.0.24
  Pinging 10.90.0.24 with 32 bytes of data:
  Request timed out.
  Request timed out.
  Request timed out.
  Request timed out.
  Ping statistics for 10.90.0.24:
      Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

  H:\>ping 10.8.0.1
  Pinging 10.8.0.1 with 32 bytes of data:
  Reply from 10.8.0.1: bytes=32 time=1ms TTL=64
  Reply from 10.8.0.1: bytes=32 time=1ms TTL=64
  Reply from 10.8.0.1: bytes=32 time=1ms TTL=64
  Reply from 10.8.0.1: bytes=32 time=1ms TTL=64
  Ping statistics for 10.8.0.1:
      Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
  Approximate round trip times in milli-seconds:
      Minimum = 1ms, Maximum = 1ms, Average = 1ms

Any help in getting my OpenVPN clients to access 10.90.0.1 and 10.90.0.24 would be greatly appreciated.

TinCanTech

IP forwarding

neiloc

Sorry I should have specifically included in the original post that ip-forwarding is enabled. So, no, that is not it.

neiloc

Any suggestions on how to diagnose this problem?

TinCanTech

Please see:
HOWTO: Expanding the scope of the VPN to include additional machines

neiloc

Thanks TinCanTech. Re that link:

>Expanding the scope of the VPN to include additional machines on either the client or server subnet.
>
>Including multiple machines on the server side when using a routed VPN (dev tun)
>
>Once the VPN is operational in a point-to-point capacity between client and server,
>it may be desirable to expand the scope of the VPN so that clients can reach multiple machines
>on the server network, rather than only the server machine itself.
>
>For the purpose of this example, we will assume that the server-side LAN uses a subnet of 10.66.0.0/24
>and the VPN IP address pool uses 10.8.0.0/24 as cited in the server directive in the OpenVPN server
>configuration file.
>
>First, you must advertise the 10.66.0.0/24 subnet to VPN clients as being accessible through the VPN.
>This can easily be done with the following server-side config file directive:
>
>push "route 10.66.0.0 255.255.255.0"
>

My server side LAN is 10.90.0.0/24 and my VPN IP address pool is 10.8.0.0/24.

My server.conf file contains:
push "route 10.90.0.0 255.255.255.0"

>
>Next, you must set up a route on the server-side LAN gateway to route the VPN client subnet (10.8.0.0/24)
>to the OpenVPN server (this is only necessary if the OpenVPN server and the LAN gateway are different machines).
>

My VPN server machine is 10.90.0.14.

My server-side LAN gateway is at 10.90.0.1 and is a TPLink router. It contains the following static route:
Destination: 10.8.0.0
Subnet: 255.255.255.0
Gateway: 10.90.0.14

If I ping 10.8.0.1 from another machine on my server network (10.90.0.24) I get:
PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.
64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=0.479 ms
From 10.90.0.1: icmp_seq=2 Redirect Host(New nexthop: 10.90.0.14)
64 bytes from 10.8.0.1: icmp_seq=2 ttl=64 time=0.373 ms
From 10.90.0.1: icmp_seq=3 Redirect Host(New nexthop: 10.90.0.14)
64 bytes from 10.8.0.1: icmp_seq=3 ttl=64 time=0.382 ms
From 10.90.0.1: icmp_seq=4 Redirect Host(New nexthop: 10.90.0.14)
64 bytes from 10.8.0.1: icmp_seq=4 ttl=64 time=0.390 ms
From 10.90.0.1: icmp_seq=5 Redirect Host(New nexthop: 10.90.0.14)
64 bytes from 10.8.0.1: icmp_seq=5 ttl=64 time=0.377 ms
--- 10.8.0.1 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 3998ms
rtt min/avg/max/mdev = 0.373/0.400/0.479/0.041 ms

>
>Make sure that you've enabled IP and TUN/TAP forwarding on the OpenVPN server machine.
>

In "/proc/sys/net/ipv4/ip_forward" it contains "1".

If I do this:
sysctl net.ipv4.ip_forward
the response is:
net.ipv4.ip_forward = 1

How do I test that this is doing what it is supposed to be doing?

I struggle with understanding iptables, but this is how it currently looks:

iptables -L -n -v
Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
1138K   35G ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
83815   12M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate ESTABLISHED
   57  4344 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED
13627 2665K input_ext  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 5 LOG flags 6 level 4 prefix "SFW2-IN-ILL-TARGET "
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   22  1320 TCPMSS     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp flags:0x06/0x02 TCPMSS clamp to PMTU
21801   12M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            PHYSDEV match --physdev-is-bridged
    0     0 forward_ext  all  --  br0    *       0.0.0.0/0            0.0.0.0/0           
    0     0 forward_ext  all  --  eth0   *       0.0.0.0/0            0.0.0.0/0           
    0     0 forward_ext  all  --  eth1   *       0.0.0.0/0            0.0.0.0/0           
    0     0 forward_ext  all  --  eth2   *       0.0.0.0/0            0.0.0.0/0           
    0     0 forward_ext  all  --  eth3   *       0.0.0.0/0            0.0.0.0/0           
    0     0 forward_ext  all  --  tap0   *       0.0.0.0/0            0.0.0.0/0           
    0     0 forward_ext  all  --  tun0   *       0.0.0.0/0            0.0.0.0/0           
    0     0 forward_ext  all  --  tun1   *       0.0.0.0/0            0.0.0.0/0           
    0     0 forward_ext  all  --  usb0   *       0.0.0.0/0            0.0.0.0/0           
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 5 LOG flags 6 level 4 prefix "SFW2-FWD-ILL-ROUTING "
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT 86903 packets, 78M bytes)
 pkts bytes target     prot opt in     out     source               destination         
1138K   35G ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0           

Chain forward_ext (9 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED icmptype 0
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED icmptype 3
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED icmptype 11
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED icmptype 12
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED icmptype 14
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED icmptype 18
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED icmptype 3 code 2
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED icmptype 5
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            PKTTYPE != unicast
    0     0 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 5 tcp flags:0x17/0x02 LOG flags 6 level 4 prefix "SFW2-FWDext-DROP-DEFLT "
    0     0 LOG        icmp --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 5 LOG flags 6 level 4 prefix "SFW2-FWDext-DROP-DEFLT "
    0     0 LOG        udp  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 5 ctstate NEW LOG flags 6 level 4 prefix "SFW2-FWDext-DROP-DEFLT "
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain input_ext (1 references)
 pkts bytes target     prot opt in     out     source               destination         
  127  9906 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            PKTTYPE = broadcast udp dpt:137
  160 41399 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            PKTTYPE = broadcast udp dpt:138
12766 2581K DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            PKTTYPE = broadcast
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 4
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
  254 22860 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp spt:137 ctstate RELATED
    0     0 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 5 tcp dpt:1194 flags:0x17/0x02 LOG flags 6 level 4 prefix "SFW2-INext-ACC-TCP "
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:1194
    0     0 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 5 tcp dpt:21 flags:0x17/0x02 LOG flags 6 level 4 prefix "SFW2-INext-ACC-TCP "
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:21
    2   104 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 5 tcp dpt:3270 flags:0x17/0x02 LOG flags 6 level 4 prefix "SFW2-INext-ACC-TCP "
    3   149 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:3270
    0     0 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 5 tcp dpt:443 flags:0x17/0x02 LOG flags 6 level 4 prefix "SFW2-INext-ACC-TCP "
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443
    3   156 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 5 tcp dpt:5901 flags:0x17/0x02 LOG flags 6 level 4 prefix "SFW2-INext-ACC-TCP "
    4   196 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:5901
    0     0 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 5 tcp dpt:623 flags:0x17/0x02 LOG flags 6 level 4 prefix "SFW2-INext-ACC-TCP "
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:623
    0     0 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 5 tcp dpt:6443 flags:0x17/0x02 LOG flags 6 level 4 prefix "SFW2-INext-ACC-TCP "
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:6443
    0     0 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 5 tcp dpt:80 flags:0x17/0x02 LOG flags 6 level 4 prefix "SFW2-INext-ACC-TCP "
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80
    0     0 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 5 tcp dpt:139 flags:0x17/0x02 LOG flags 6 level 4 prefix "SFW2-INext-ACC-TCP "
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:139
    0     0 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 5 tcp dpt:445 flags:0x17/0x02 LOG flags 6 level 4 prefix "SFW2-INext-ACC-TCP "
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:445
    0     0 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 5 tcp dpts:5800:5899 flags:0x17/0x02 LOG flags 6 level 4 prefix "SFW2-INext-ACC-TCP "
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpts:5800:5899
    0     0 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 5 tcp dpts:5900:5999 flags:0x17/0x02 LOG flags 6 level 4 prefix "SFW2-INext-ACC-TCP "
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpts:5900:5999
    1    42 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:1194
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:21
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:3270
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:443
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:5901
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:623
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:6443
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:80
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:137
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:138
  308  9856 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            PKTTYPE != unicast
    0     0 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 5 tcp flags:0x17/0x02 LOG flags 6 level 4 prefix "SFW2-INext-DROP-DEFLT "
    0     0 LOG        icmp --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 5 LOG flags 6 level 4 prefix "SFW2-INext-DROP-DEFLT "
    0     0 LOG        udp  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 5 ctstate NEW LOG flags 6 level 4 prefix "SFW2-INext-DROP-DEFLT "
    4   160 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain reject_func (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with tcp-reset
    0     0 REJECT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-proto-unreachable

Does all this look OK?

TinCanTech

If you need help with iptables .. tincanteksup <at> gmail

neiloc

Thanks for the offer TinCanTech.... is there something wrong with the iptables settings I posted that could account for my lack of access to other systems on my server lan?