0

I have setup a Tomato USB, on my second (internal) router. The outside router simply forwards VPN traffic to it, and it acts as a VPN server. I can connect to the VPN server and my local area networks, but I lose internet connectivity.

I know why: I am not routing VPN traffic through the gateway. I searched around and found that what I need to do is:

iptables -I FORWARD -i tun0 -o eth0 \
         -s 10.8.0.0/24 -m conntrack --ctstate NEW -j ACCEPT

iptables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED \
         -j ACCEPT

iptables -t nat -I POSTROUTING -o eth0 \
          -s 10.8.0.0/24 -j MASQUERADE

Although in my case, I have to change tun0 to tun21, and eth0 to br0. However, the TomatoUSB version I have, produces this error:

iptables v1.3.8: Couldn't load match `conntrack':File not found

AFAIK, this is an old iptables version. So, how can I route and masquerade my VPN traffic through the TomatoUSB router?

route -n

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.0.1     0.0.0.0         255.255.255.255 UH    0      0        0 vlan2
10.8.0.2        0.0.0.0         255.255.255.255 UH    0      0        0 tun21
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 br0
192.168.0.0     0.0.0.0         255.255.255.0   U     0      0        0 vlan2
10.8.0.0        10.8.0.2        255.255.0.0     UG    0      0        0 tun21
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo
0.0.0.0         192.168.0.1     0.0.0.0         UG    0      0        0 vlan2

iptables --list

Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     udp  --  anywhere             anywhere            udp dpt:1194 
DROP       all  --  anywhere             anywhere            state INVALID 
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
shlimit    tcp  --  anywhere             anywhere            tcp dpt:ssh state NEW 
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     udp  --  anywhere             anywhere            udp spt:bootps dpt:bootpc 
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:1194 
ACCEPT     all  --  anywhere             anywhere            

Chain FORWARD (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
           all  --  anywhere             anywhere            account: network/netmask: 192.168.1.0/255.255.255.0 name: lan 
ACCEPT     all  --  anywhere             anywhere            
DROP       all  --  anywhere             anywhere            state INVALID 
TCPMSS     tcp  --  anywhere             anywhere            tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU 
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
wanin      all  --  anywhere             anywhere            
wanout     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain shlimit (1 references)
target     prot opt source               destination         
           all  --  anywhere             anywhere            recent: SET name: shlimit side: source 
DROP       all  --  anywhere             anywhere            recent: UPDATE seconds: 60 hit_count: 4 name: shlimit side: source 

Chain wanin (1 references)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             athena.utopia       tcp dpts:5999:x11-1 
ACCEPT     udp  --  anywhere             athena.utopia       udp dpts:5999:x11-1 
ACCEPT     tcp  --  anywhere             athena.utopia       tcp dpt:3022 
ACCEPT     udp  --  anywhere             athena.utopia       udp dpt:3022 

Chain wanout (1 references)
target     prot opt source               destination         

iptables -t nat -L -n -v

Chain PREROUTING (policy ACCEPT 24 packets, 1296 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   14   588 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:1194 
   40 13755 WANPREROUTING  all  --  *      *       0.0.0.0/0            192.168.0.4         
    0     0 DROP       all  --  vlan2  *       0.0.0.0/0            192.168.1.0/24      

Chain POSTROUTING (policy ACCEPT 8 packets, 576 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   12   912 MASQUERADE  all  --  *      vlan2   10.8.0.0/24          0.0.0.0/0           
    2   152 MASQUERADE  all  --  *      vlan2   10.8.0.0/24          0.0.0.0/0           
 6781  490K MASQUERADE  all  --  *      vlan2   0.0.0.0/0            0.0.0.0/0           
    0     0 SNAT       all  --  *      br0     192.168.1.0/24       192.168.1.0/24      to:192.168.1.1 
    0     0 MASQUERADE  all  --  *      vlan2   0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT 8 packets, 576 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain WANPREROUTING (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DNAT       icmp --  *      *       0.0.0.0/0            0.0.0.0/0           to:192.168.1.1 
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpts:5999:6001 to:192.168.1.130 
    0     0 DNAT       udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpts:5999:6001 to:192.168.1.130 
    2   128 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:22 to:192.168.1.130:3022 
    0     0 DNAT       udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:22 to:192.168.1.130:3022 
10
  • I really don't know to be honest, for example: I can ping google from the router, but not from the connected (VPN) client. What else could it be? I've added the iptables rules you posted, but still the same error. Should I add a static route from 10.8.0.0 to 192.168.0.1 or 192.168.1.1, or from 10.8.0.2 to 192.168.0.1/192.168.1.1? – Alex Oct 27 '15 at 13:12
  • No thats it, and those are the default ones from TomatoUSB, I haven't changed them – Alex Oct 27 '15 at 13:16
  • TomatoUSB doesn't have tcpdump :-( I found this: nikinuryadin.wordpress.com/2010/04/16/… It seems to suggest different rules for forwarding connections from VPN clients – Alex Oct 27 '15 at 13:23
  • I am probably doing something wrong. Should the new rules be listed when using iptables --list? If yes, they aren't. I've edited the question adding all my iptables rules – Alex Oct 27 '15 at 13:49
  • The SNAT rule in POSTROUTING is wrong. Please delete it iptables -t nat -D POSTROUTING -o br0 -j SNAT --to-source 192.168.1.0/24. What it does is to make it look like all packets come from the router, even those that are replies to LAN queries! – MariusMatutiae Oct 27 '15 at 14:08
1

I am not sure I understood your problem, so I do not know whether the three iptables rule are a solution to it. However, in so far as the three rules per se are concerned, you do not really need the first two, you can replace them with the single rule:

    iptables -I FORWARD -j ACCEPT

The third rule is truly important, but luckily you do not need the conntrack module for it. I am a bit surprised Tomato does not have commonplace module, though.

Edit:

looking at your routing table, it seems to me your WAn interface (i.e., the one talking to the internet, not to your LAN), is vlan2. In this case, your third iptables rule should be:

   iptables -t nat -I POSTROUTING -o vlan2 -s 10.8.0.0/24 -j MASQUERADE

If I am mistaken, pls substitute the WAN interface name to vlan2.

4
  • The problem is that the traffic arriving from OpenVPN (device tun21, from 10.8.0.0) is not being routed to the internet. I lose all internet connectivity from any client that connects to the OpenVPN. AFAIK, this is because I am not routing that traffic/interface to the default gateway. – Alex Oct 27 '15 at 11:45
  • just added an edit. – Alex Oct 27 '15 at 11:55
  • This is used by TomatoUSB, I flashed it about 4 months ago, I was surprised too! – Alex Oct 27 '15 at 12:07
  • Yes, you are correct, its vlan2 my external interface, br0 is the internal one. Still though, no routing of vpn traffic to internet. I am guessing its something else in addition to the above. – Alex Oct 27 '15 at 12:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.