2

I have a virtual network setup with a Linux router/firewall connected to two private networks. An OpenVPN server in routing mode and a web server are in one of the networks. On the other are linux client machines which access the webserver and the Internet through the OpenVPN server. Also, external clients can access the OpenVPN from the Internet. The OpenVPN's server.conf is setup to use routing mode in udp, push DNS and routes to the network it is in so clients can access the webserver.

Here are my very strict firewall rules.

After connecting to the OpenVPN server, my clients can not access the Internet or the web server. When I allow FORWARD traffic to go through, it works just fine. The OpenVPN server has full internet connectivity. What firewall rule do I need to add to allow internet traffic to reach my clients?

1 Answer 1

0

You should do a forward between two interfaces, because if You dont make the forwarding You never will go out to Internet, because You can go to Internet only by the eth interface.

You should add some similar to:

iptables -A INPUT -i eth0 -p udp --dport 1194 -j ACCEPT
iptables -A INPUT -i tun+ -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --sport 1194 -j ACCEPT
iptables -A FORWARD -i tun+ -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
iptables -A FORWARD -i eth0 -o tun+ -j ACCEPT
iptables -A FORWARD -i eth0 -o tun+ -m state --state ESTABLISHED,RELATED -j ACCEPT

I hope It helps with your question.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .