Just a few days ago, I finally managed to create a VPN server and connect to servers in the VPN LAN, thanks to help from online resources and a good Samaritan in this site. After I get authenticated by the VPN server, I can use ssh to login or use http(s) to see websites running on the servers connected to the VPN LAN.
My Configuration:
OpenVPN server (172.16.1.2) on top of CentOS 7 and a few other CentOS servers (172.16.1.3, 172.16.1.4, etc.) are in a local LAN, behind a router, whose WAN has a global IP. I have set up port forwarding (udp, 1194) and I also set up a static routing (dest network 10.8.0.0/24 via g/w 172.16.1.2, which is VPN server's IP) in that router for a return path.
There are some servers with http(s) services that are not inside this VPN LAN, but they are available (http(s) accessible) from my WAN side IP.
I want to access their http(s) pages using browser from my client terminal (say, my notebook), after I am authenticated by the VPN server.
Using wget inside one of the servers in my VPN LAN, I get a page returned in plain text format from that non-local server. Telnet also connects.
So VPN server (and iptables also?) may not be blocking, something else is.
As mentioned above, I have two set ups in the router: (1) Port forwarding (udp/1194) and (2) static routing.
Static routing looks like this:
Destination Gateway
----------- -----------------
default path XXX.XXX.XXX.XXX (my WAN side IP)
10.8.0.0/24 172.16.1.2 (VPN server's LAN IP)
In my understanding, the router does not have any filter in place for outgoing www.
route command give this:
[root@vpn user1]# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default gateway 0.0.0.0 UG 0 0 0 em1
10.8.0.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0
link-local 0.0.0.0 255.255.0.0 U 1002 0 0 em1
172.16.1.0 0.0.0.0 255.255.255.0 U 0 0 0 em1
192.168.122.0 0.0.0.0 255.255.255.0 U 0 0 0 virbr0
Something... is still not right..
I suspect this one in my iptables:
# Allow outbound access to all networks on the Internet from the VPN
-A FORWARD -i tun0 -s 172.16.1.0/24 -d 0.0.0.0/0 -j ACCEPT
Please help, some keywords or some hints.
Thank you.
My conf files are here:
https://forums.openvpn.net/viewtopic.php?f=6&t=30028
My iptable is likethis:
*nat
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 10.8.0.0/24 -o em1 -j MASQUERADE
COMMIT
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
# Allow HTTP outbound
-A OUTPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT
# Allow HTTPS outbound
-A OUTPUT -p tcp --dport 443 -m state --state NEW -j ACCEPT
#Incoming VPN
-A INPUT -i em1 -p udp -m state --state NEW,ESTABLISHED -m udp --dport 1194 -j ACCEPT
-A OUTPUT -p udp --sport 1194 -m state --state ESTABLISHED -j ACCEPT
#Outgoing VPN
-A INPUT -p udp --sport 1194 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -p udp --dport 1194 -m state --state NEW,ESTABLISHED -j ACCEPT
# Allow TUN interface connections to OpenVPN server
-A INPUT -i tun0 -j ACCEPT
-A OUTPUT -o tun0 -j ACCEPT
#Seems I must have these four lines...
# Allow TUN interface connections to be forwarded through other interfaces
#thanks! https://arashmilani.com/post?id=53
-A FORWARD -i tun+ -j ACCEPT
-A FORWARD -i tun+ -o em1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i em1 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
# Allow outbound access to all networks on the Internet from the VPN
-A FORWARD -i tun0 -s 172.16.1.0/24 -d 0.0.0.0/0 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
