Debian 7 + openvpn + iptables

[timmy]

Hoe moet ik de iptables configuren zodat ik
- lokaal (192.168.0.13) mijn webmin en ssh kan blijven benaderen
- maar ook via dit systeem als vpn te gebruiken.

als ik deze iptables config gebruik krijg ik geen verbinding meer met 192.168.0.13



# Generated by iptables-save v1.4.14 on Sat Sep 6 14:57:37 2014
*mangle
:PREROUTING ACCEPT [5070268:1404212064]
:INPUT ACCEPT [4585346:1257601650]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [5240266:436714756]
:POSTROUTING ACCEPT [5240266:436714756]
COMMIT
# Completed on Sat Sep 6 14:57:37 2014
# Generated by iptables-save v1.4.14 on Sat Sep 6 14:57:37 2014
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/8 ! -i lo -j REJECT --reject-with icmp-port-unreachable
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 10000 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 69 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 873 -j ACCEPT
-A INPUT -d 224.0.0.0/24 -j DROP
-A INPUT -s 192.168.0.14/32 -j DROP
-A INPUT -p icmp -m icmp --icmp-type 8 -j DROP
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
-A INPUT -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -j REJECT --reject-with icmp-port-unreachable
-A OUTPUT -j ACCEPT
COMMIT
# Completed on Sat Sep 6 14:57:37 2014
# Generated by iptables-save v1.4.14 on Sat Sep 6 14:57:37 2014
#*nat
#:PREROUTING ACCEPT [1015273:181931178]
#:INPUT ACCEPT [465287:24749181]
#:OUTPUT ACCEPT [1000007:67630032]
#:POSTROUTING ACCEPT [1000007:67630032]
#-A INPUT -i eth0 -p udp -m udp --dport 1194 -j ACCEPT
#-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.0.13
#COMMIT
# Completed on Sat Sep 6 14:57:37 2014


Dus heb ik van *nat tot aan COMMIT alles ge-comment

Maar dan is verbinding met vpn niet moglijk:
/var/log/syslog:

kernel: [ 3248.925504] iptables denied: IN=eth0 OUT= MAC=b8:27:eb:2b:55:87:7c:c3:## SRC=192.168.0.16 DST=192.168.0.13 LEN=42 TOS=0x00 PREC=0x00 TTL=64 ID=4815 PROTO=UDP SPT=62807 DPT=1194 LEN=22

wat is de juiste config?

[visser]

Hoe moet ik de iptables configuren zodat ik
- lokaal (192.168.0.13) mijn webmin en ssh kan blijven benaderen
- maar ook via dit systeem als vpn te gebruiken.

als ik deze iptables config gebruik krijg ik geen verbinding meer met 192.168.0.13



# Generated by iptables-save v1.4.14 on Sat Sep 6 14:57:37 2014
*mangle
:PREROUTING ACCEPT [5070268:1404212064]
:INPUT ACCEPT [4585346:1257601650]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [5240266:436714756]
:POSTROUTING ACCEPT [5240266:436714756]
COMMIT
# Completed on Sat Sep 6 14:57:37 2014
# Generated by iptables-save v1.4.14 on Sat Sep 6 14:57:37 2014
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/8 ! -i lo -j REJECT --reject-with icmp-port-unreachable
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 10000 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 69 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 873 -j ACCEPT
-A INPUT -d 224.0.0.0/24 -j DROP
-A INPUT -s 192.168.0.14/32 -j DROP
-A INPUT -p icmp -m icmp --icmp-type 8 -j DROP
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
-A INPUT -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -j REJECT --reject-with icmp-port-unreachable
-A OUTPUT -j ACCEPT
COMMIT
# Completed on Sat Sep 6 14:57:37 2014
# Generated by iptables-save v1.4.14 on Sat Sep 6 14:57:37 2014
#*nat
#:PREROUTING ACCEPT [1015273:181931178]
#:INPUT ACCEPT [465287:24749181]
#:OUTPUT ACCEPT [1000007:67630032]
#:POSTROUTING ACCEPT [1000007:67630032]
#-A INPUT -i eth0 -p udp -m udp --dport 1194 -j ACCEPT
#-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.0.13
#COMMIT
# Completed on Sat Sep 6 14:57:37 2014


Dus heb ik van *nat tot aan COMMIT alles ge-comment

Maar dan is verbinding met vpn niet moglijk:
/var/log/syslog:

kernel: [ 3248.925504] iptables denied: IN=eth0 OUT= MAC=b8:27:eb:2b:55:87:7c:c3:## SRC=192.168.0.16 DST=192.168.0.13 LEN=42 TOS=0x00 PREC=0x00 TTL=64 ID=4815 PROTO=UDP SPT=62807 DPT=1194 LEN=22

wat is de juiste config?

Nu je zo ver bent met de denied in de log is dat vrij duidelijk :

udp destination port 1194 is openvpn ..

En die moet je in de INPUT filter chain ook accepteren.
-A INPUT -p udp -m udp --dport 1194 -j ACCEPT
ergens tussen zetten.

(eventueel nog met -s 192.168.0.16 , als je alleen vanaf die 192.168.0.16 de openvpn sessie wilt accepteren).

192.168.0.16 is trouwens de bron van de VPN sessie, klopt dat ?

[timmy]

192.168.0.16 is trouwens de bron van de VPN sessie, klopt dat ?

192.168.0.16 is de ip van de pc waar ik achter zit. Maar het lijkt erop dat de firewall probleem is opgelost.

Ik zit alleen nog met de manier van verbinden...
i.g.v. server.conf -> push "redirect-gateway def1"
is er geen internet verbinding meer. Zoals een ping naar 8.8.8.8 Request timeout

i.g.v. server.conf -> push "route ##.##.##.### 255.255.255.128"
Is er wel internet maar het IP adres blijft ongewijzigd.

(##.##.##.### == server ip adres)
(255.255.255.128 is de server Mask)

de /etc/openvpn/server.conf


port 1194
proto udp
dev tun

ca ca.crt
cert server.crt
key server.key
dh dh1024.pem

server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
;push "redirect-gateway def1" # bypass-dhcp"
; ##.##.##.### == server ip adres
; # 255.255.255.128 == server mask
push "route ##.##.##.### 255.255.255.128"

push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

;client-to-client
keepalive 10 120
;cipher DES-EDE3-CBC
comp-lzo

max-clients 5
;user nobody
;group nogroup

persist-key
persist-tun

log /var/log/openvpn.log
;status openvpn-status.log
verb 3
;mute 20