janjust wrote:Check iptables on the server for INPUT traffic
Which brings me to the knowledge base that I still have not mastered. I get the general idea in reading it, but am at a loss as to what to change. I would have guessed the icmp type 0 and type 8 being accepted would indicate that it is open to pinging.
Code: Select all
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 3
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 11
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8
I am confused by the sections both input and forward dealing with tun+ with why a drop comes before each. Below is what listed.
from iptables-save
pjoseph wrote:-A INPUT -j DROP
-A INPUT -i tun+ -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -j DROP
-A FORWARD -i tun+ -j ACCEPT
Thinking that this is not right, I have moved the tun+ input and forward filters each to before DROP. And, success.
Thanks janjust for pointing me in the right direction.
For other newbies:
Code: Select all
iptables-save > rules
nano rules [made changes, CTRL-X, Y, Enter to save]
iptables-restore rules
Final iptables-save > rules
Code: Select all
*mangle
:PREROUTING ACCEPT [1128:267303]
:INPUT ACCEPT [1027:253571]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [432:48104]
:POSTROUTING ACCEPT [432:48104]
COMMIT
# Completed on Mon Apr 29 10:53:09 2013
# Generated by iptables-save v1.4.4 on Mon Apr 29 10:53:09 2013
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [33:5038]
:INT_IN - [0:0]
:INT_OUT - [0:0]
:PAROLE - [0:0]
:PUB_IN - [0:0]
:PUB_OUT - [0:0]
:fail2ban-ssh - [0:0]
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh
-A INPUT -d 127.0.0.0/8 ! -i lo -p tcp -j DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -s 224.0.0.0/4 -j DROP
-A INPUT -i eth+ -j PUB_IN
-A INPUT -i ppp+ -j PUB_IN
-A INPUT -i slip+ -j PUB_IN
-A INPUT -i venet+ -j PUB_IN
-A INPUT -i tun+ -j ACCEPT
-A INPUT -j DROP
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i tun+ -j ACCEPT
-A FORWARD -j DROP
-A OUTPUT -o eth+ -j PUB_OUT
-A OUTPUT -o ppp+ -j PUB_OUT
-A OUTPUT -o slip+ -j PUB_OUT
-A OUTPUT -o venet+ -j PUB_OUT
-A INT_IN -p icmp -j ACCEPT
-A INT_IN -j DROP
-A INT_OUT -p icmp -j ACCEPT
-A INT_OUT -j ACCEPT
-A PAROLE -j ACCEPT
-A PUB_IN -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A PUB_IN -p icmp -m icmp --icmp-type 0 -j ACCEPT
-A PUB_IN -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A PUB_IN -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A PUB_IN -p tcp -m tcp --dport 53 -j PAROLE
-A PUB_IN -p tcp -m tcp --dport 2112 -j PAROLE
-A PUB_IN -p tcp -m tcp --dport 2285 -j PAROLE
-A PUB_IN -p tcp -m tcp --dport 3306 -j PAROLE
-A PUB_IN -p tcp -m tcp --dport 10000 -j PAROLE
-A PUB_IN -p tcp -m tcp --dport 23101:23105 -j PAROLE
-A PUB_IN -p udp -m udp --dport 53 -j ACCEPT
-A PUB_IN -p udp -m udp --dport 2112 -j ACCEPT
-A PUB_IN -p udp -m udp --dport 123 -j ACCEPT
-A PUB_IN -p udp -m udp --dport 1194 -j ACCEPT
-A PUB_IN -p udp -m udp --dport 1195 -j ACCEPT
-A PUB_IN -p udp -m udp --dport 3306 -j ACCEPT
-A PUB_IN -p udp -m udp --dport 10000 -j ACCEPT
-A PUB_IN -p icmp -j DROP
-A PUB_IN -j DROP
-A PUB_OUT -j ACCEPT
-A fail2ban-ssh -j RETURN
-A fail2ban-ssh -j RETURN
COMMIT
# Completed on Mon Apr 29 10:53:09 2013
# Generated by iptables-save v1.4.4 on Mon Apr 29 10:53:09 2013
*nat
:PREROUTING ACCEPT [360:35132]
:POSTROUTING ACCEPT [12:760]
:OUTPUT ACCEPT [12:760]
COMMIT
# Completed on Mon Apr 29 10:53:09 2013
And I have already listed above, but since this topic is solved, I wanted to share the final config. I know I would find such helpful when troubleshooting. In my case the server is running Ubuntu 10.04 x86_64 and OpenVPN 2.1.0, while my clients are running Xubuntu 12.04 x86_64 and OpenVPN 2.2.1.
Server VPN-NAME.conf
Code: Select all
topology subnet
port 1194
proto udp
dev tun
ca ca.crt
cert SERVER-NAME.crt
key SERVER-NAME.key # This file should be kept secret
dh dh1024.pem
server 172.16.32.0 255.255.255.0
# ----- automatically means the following:
# mode server
# tls-server
# push "topology subnet"
# ifconfig 172.16.32.0 255.255.255.0
# ifconfig-pool 172.16.32.2 172.16.32.254 255.255.255.0
# push "route-gateway 172.16.32.1"
ifconfig-pool-persist VPN-NAME.txt
client-config-dir ccd
ccd-exclusive
client-to-client
keepalive 10 120
# ----- automatically means the following:
# ping 10
# ping-restart 240
# push "ping 10"
# push "ping-restart 120"
tls-auth ta.key 0 # This file is secret
cipher AES-256-CBC
tls-cipher AES256-SHA
engine aesni # with Ubuntu 10.04
#engine rsax # with Ubuntu 12.04+
comp-lzo
max-clients 25
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn/VPN-NAME-status.log
log-append /var/log/openvpn/openvpn.log
verb 3
mute 20
Server ccd - I like my clients all on static ips
ccd/CLIENT-NAME
Code: Select all
ifconfig-push 172.16.32.6 255.255.255.0 gw 172.16.32.1
Client VPN-NAME.conf
Code: Select all
client
# ----- automatically means the following:
# pull
# tls-client
dev tun
proto udp
remote vpn.SERVER-NAME.com 1194
ca ca.crt
cert CLIENT-NAME.crt
key CLIENT-NAME.key
resolv-retry infinite
nobind
ns-cert-type server
#remote-cert-type server # future method
tls-auth ta.key 1
cipher AES-256-CBC
tls-cipher AES256-SHA
#engine aesni # with Ubuntu 10.04
engine rsax # with Ubuntu 12.04+
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
log-append /var/log/openvpn/openvpn.log
verb 3
mute 20
