Aha!
I was in the middle of replying to this post (to say still no luck) when I began, again, tinkering with things. After some time I realised a rather silly error, as a result of taking your first post a little too literally.
The problem was that, for some reason, I didn't recognise that the clientconnect script is
just a plain shell script, and thus I didn't have the "#!/bin/bash" interpreter line at the top of it. That is the reason it was failing, and ownership/permissions or script-security settings were not at fault. Yeah, I know, pretty dumb :oops:
I did have to make a few other changes though, which I'll record here to possibly save someone else some time. Note, I was testing on CentOS6 so YMMV.
1. The iptables command has some issues with the priv-drop feature. Even though the user/group lines were further down the server.conf file, the order doesn't seem to matter. While it's not a perfect solution from a security perspective, I edited the sudoers file to allow the openvpn user to execute the iptables command without a password. Don't forget to specify the complete path to the command (though this will probably vary depending on OS).
2. The big difference was that, in my setup, the
$ipconfig_pool_remote_ip maps to the client tunnel end (in my case 10.8.0.6) and the
$ifconfig_local maps to the server tunnel end (10.8.0.1). With the clientconnect script, your line
iptables -t nat -D PREROUTING -p tcp -d $ifconfig_local --dport $PORT -j DNAT --to-destination $ifconfig_pool_remote_ip:$PORT
caused it to redirect packets incoming on the
server's tunnel interface to the client's. What it should be doing is redirecting incoming packets on the
public interface to the client's tunnel interface.
To troubleshoot this I put echo commands in the clientconnect script to verify the IPs, which it prints into the openvpn.log file. Note, I am running this on an amazon EC2 machine to test and this NATs the public IP to a local 10.x IP, so that may be messing with the OpenVPN environment variable, making it different to yours.
In my case, to fix it I added a couple of lines to identify the local incoming interface IP and replaced $ifconfig_local with that var.
So my complete clientconnect script is now (I left the echo cmds in to demonstrate):
#!/bin/bash
PORT=55555
LOCALIP=`/sbin/ifconfig eth0|grep 'inet\ addr'|cut -d":" -f2|cut -d" " -f1`
echo ifconfigpool is $ifconfig_pool_remote_ip
sudo /sbin/iptables -A FORWARD -p tcp -i eth0 -d $ifconfig_pool_remote_ip --dport $PORT -j ACCEPT
echo ifconfiglocal is $ifconfig_local
sudo /sbin/iptables -t nat -A PREROUTING -p tcp -d $LOCALIP --dport $PORT -j DNAT --to-destination $ifconfig_pool_remote_ip:$PORT
There are probably a couple of other ways to achieve this also, but this worked for me.
Thanks again for your help and great original post, I certainly wouldn't have worked this out without it.
Colin
