I followed this tutorial and got VPN up and running on my client netbook. It's connected to my Asus WL-500GP running TomatoUSB VPN. My problem is that I get denied access to the home network when my netbook is connected to a different network. I'm sure it's a firewall issue, but I don't have a clue as to how to fix it.
My VPN connects at 10.8.0.6. I followed this at OpenVPN to configure the firewall, changing the private subnet to 10.8.0.6. Unfortunately, it's not working. Thanks in advance for any and all help…
Setup is as follows:
WAN
MAC Address 90:E6:BA:67:89:66
Connection Type DHCP
IP Address 71.230.46.12
Subnet Mask 255.255.248.0
Gateway 71.230.40.1
DNS 68.87.64.150:53, 68.87.75.198:53
MTU 1500
Status Connected
Connection Uptime 0 days, 01:05:24
Remaining Lease Time 0 days, 00:45:56
LAN
Router MAC Address 90:E6:BA:67:89:65
Router IP Address 192.168.1.1
Subnet Mask 255.255.255.0
DHCP 192.168.1.100 - 192.168.1.149
# A Sample OpenVPN-aware firewall.
# eth0 is connected to the internet.
# eth1 is connected to a private subnet.
# Change this subnet to correspond to your private
# ethernet subnet. Home will use 10.0.1.0/24 and
# Office will use 10.0.0.0/24.
PRIVATE=10.0.0.0/24
# Loopback address
LOOP=127.0.0.1
# Delete old iptables rules
# and temporarily block all traffic.
iptables -P OUTPUT DROP
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -F
# Set default policies
iptables -P OUTPUT ACCEPT
iptables -P INPUT DROP
iptables -P FORWARD DROP
# Prevent external packets from using loopback addr
iptables -A INPUT -i eth0 -s $LOOP -j DROP
iptables -A FORWARD -i eth0 -s $LOOP -j DROP
iptables -A INPUT -i eth0 -d $LOOP -j DROP
iptables -A FORWARD -i eth0 -d $LOOP -j DROP
# Anything coming from the Internet should have a real Internet address
iptables -A FORWARD -i eth0 -s 192.168.0.0/16 -j DROP
iptables -A FORWARD -i eth0 -s 172.16.0.0/12 -j DROP
iptables -A FORWARD -i eth0 -s 10.0.0.0/8 -j DROP
iptables -A INPUT -i eth0 -s 192.168.0.0/16 -j DROP
iptables -A INPUT -i eth0 -s 172.16.0.0/12 -j DROP
iptables -A INPUT -i eth0 -s 10.0.0.0/8 -j DROP
# Block outgoing NetBios (if you have windows machines running
# on the private subnet). This will not affect any NetBios
# traffic that flows over the VPN tunnel, but it will stop
# local windows machines from broadcasting themselves to
# the internet.
iptables -A FORWARD -p tcp --sport 137:139 -o eth0 -j DROP
iptables -A FORWARD -p udp --sport 137:139 -o eth0 -j DROP
iptables -A OUTPUT -p tcp --sport 137:139 -o eth0 -j DROP
iptables -A OUTPUT -p udp --sport 137:139 -o eth0 -j DROP
# Check source address validity on packets going out to internet
iptables -A FORWARD -s ! $PRIVATE -i eth1 -j DROP
# Allow local loopback
iptables -A INPUT -s $LOOP -j ACCEPT
iptables -A INPUT -d $LOOP -j ACCEPT
# Allow incoming pings (can be disabled)
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
# Allow services such as www and ssh (can be disabled)
iptables -A INPUT -p tcp --dport http -j ACCEPT
iptables -A INPUT -p tcp --dport ssh -j ACCEPT
# Allow incoming OpenVPN packets
# Duplicate the line below for each
# OpenVPN tunnel, changing --dport n
# to match the OpenVPN UDP port.
#
# In OpenVPN, the port number is
# controlled by the --port n option.
# If you put this option in the config
# file, you can remove the leading '--'
#
# If you taking the stateful firewall
# approach (see the OpenVPN HOWTO),
# then comment out the line below.
iptables -A INPUT -p udp --dport 1194 -j ACCEPT
# Allow packets from TUN/TAP devices.
# When OpenVPN is run in a secure mode,
# it will authenticate packets prior
# to their arriving on a tun or tap
# interface. Therefore, it is not
# necessary to add any filters here,
# unless you want to restrict the
# type of packets which can flow over
# the tunnel.
iptables -A INPUT -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -j ACCEPT
iptables -A INPUT -i tap+ -j ACCEPT
iptables -A FORWARD -i tap+ -j ACCEPT
# Allow packets from private subnets
iptables -A INPUT -i eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -j ACCEPT
# Keep state of connections from local machine and private subnets
iptables -A OUTPUT -m state --state NEW -o eth0 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state NEW -o eth0 -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
# Masquerade local subnet
iptables -t nat -A POSTROUTING -s $PRIVATE -o eth0 -j MASQUERADE
The relevant nastygram from the Asus router log the last entry...
Jul 11 09:01:09 unknown daemon.notice openvpn[799]: MULTI: multi_create_instance called
Jul 11 09:01:09 unknown daemon.notice openvpn[799]: Re-using SSL/TLS context
Jul 11 09:01:09 unknown daemon.notice openvpn[799]: LZO compression initialized
Jul 11 09:01:09 unknown daemon.notice openvpn[799]: Control Channel MTU parms [ L:1560 D:140 EF:40 EB:0 ET:0 EL:0 ]
Jul 11 09:01:09 unknown daemon.notice openvpn[799]: Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:135 ET:0 EL:0 AF:3/1 ]
Jul 11 09:01:09 unknown daemon.notice openvpn[799]: TCP connection established with 97.244.230.191:1506
Jul 11 09:01:09 unknown daemon.notice openvpn[799]: Socket Buffers: R=[131072->131072] S=[131072->131072]
Jul 11 09:01:09 unknown daemon.notice openvpn[799]: TCPv4_SERVER link local: [undef]
Jul 11 09:01:09 unknown daemon.notice openvpn[799]: TCPv4_SERVER link remote: 97.244.230.191:1506
Jul 11 09:01:10 unknown daemon.notice openvpn[799]: 97.244.230.191:1506 TLS: Initial packet from 97.244.230.191:1506, sid=b757ee11 b5361abd
Jul 11 09:01:14 unknown daemon.notice openvpn[799]: 97.244.230.191:1506 VERIFY OK: depth=1, /C=US/ST=PA/L=Pottstown/O=OpenVPN/CN=Dave/emailAddress=ratamacue2@gmail.com
Jul 11 09:01:14 unknown daemon.notice openvpn[799]: 97.244.230.191:1506 VERIFY OK: depth=0, /C=US/ST=PA/O=OpenVPN/CN=Dave/emailAddress=ratamacue2@gmail.com
Jul 11 09:01:15 unknown daemon.notice openvpn[799]: 97.244.230.191:1506 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Jul 11 09:01:15 unknown daemon.notice openvpn[799]: 97.244.230.191:1506 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Jul 11 09:01:15 unknown daemon.notice openvpn[799]: 97.244.230.191:1506 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Jul 11 09:01:15 unknown daemon.notice openvpn[799]: 97.244.230.191:1506 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Jul 11 09:01:15 unknown daemon.notice openvpn[799]: 97.244.230.191:1506 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Jul 11 09:01:15 unknown daemon.notice openvpn[799]: 97.244.230.191:1506 [Dave] Peer Connection Initiated with 97.244.230.191:1506
Jul 11 09:01:15 unknown daemon.notice openvpn[799]: Dave/97.244.230.191:1506 MULTI: Learn: 10.8.0.6 -> Dave/97.244.230.191:1506
Jul 11 09:01:15 unknown daemon.notice openvpn[799]: Dave/97.244.230.191:1506 MULTI: primary virtual IP for Dave/97.244.230.191:1506: 10.8.0.6
Jul 11 09:01:17 unknown daemon.notice openvpn[799]: Dave/97.244.230.191:1506 PUSH: Received control message: 'PUSH_REQUEST'
Jul 11 09:01:17 unknown daemon.notice openvpn[799]: Dave/97.244.230.191:1506 SENT CONTROL [Dave]: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,dhcp-option DNS 192.168.1.1,route 10.8.0.0 255.255.255.0,topology net30,ping 15,ping-restart 60,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Jul 11 09:03:53 unknown user.warn kernel: DROP IN=vlan1 OUT= MAC=90:e6:ba:67:89:66:00:01:5c:32:0d:81:08:00:45:20:00:28 SRC=208.115.219.10 DST=71.230.46.12 LEN=40 TOS=0x00 PREC=0x20 TTL=112 ID=256 DF PROTO=TCP SPT=12200 DPT=27977 WINDOW=8192 RES=0x00 SYN URGP=0
