linux - OpenVPN and iptables -

linux - OpenVPN and iptables -

openvpn , iptables

my internal aws network not straight accessible internet, may accessed through secure openvpn gateway.

network configuration

the openvpn server ubuntu server 14.04.1 aws ec2 instance exposes udp 1194 on external (internet) interface 'eth0', allows ports/protocols on internal interface 'eth1'. when openvpn tunnel created between openvpn client , openvpn server, creates new interface on each side of tunnel called 'tun0', allows ports/protocols.

the openvpn server binds ip address 10.8.0.1 tun0 interface, , openvpn clients dynamically assigned ip addresses starting 10.8.0.2, in ascending order. interfaces of internal resources have statically-assigned ip addresses within 10.0.100.0/24.

packet forwarding enabled on openvpn server in /etc/sysctl.conf: net.ipv4.ip_forward=1

'source / destination checking' has been appropriately disabled.

packet forwarding requirements

the openvpn server must enforce these requirements via iptables, linux kernel's built-in firewall:

all traffic originating net on eth0 should dropped, except openvpn tunnels on udp 1194, , responses requests originating internal resources (see 3rd bullet).

all traffic originating net via openvpn tunnel on tun0 should accepted, , forwarded appropriate internal resources. responses internal resources openvpn clients should accepted on eth1, forwarded tun0, , on originating openvpn client.

all traffic originating internal resources (e.g. server software updates) should accepted on eth1, , forwarded eth0 using nat masquerading. responses external resources (e.g. apt-get repositories) should accepted on eth0 using nat masquerading, , forwarded originating internal resource via eth1.

current (flawed) iptables configuration sudo iptables -a input -i tun0 -s 10.8.0.0/24 -d 10.0.100.0/24 -j take sudo iptables -a input -i eth1 -s 10.0.100.0/24 -d 10.8.0.0/24 -j take sudo iptables -a output -o tun0 -s 10.0.100.0/24 -d 10.8.0.0/24 -j take sudo iptables -a output -o eth1 -s 10.8.0.0/24 -d 10.0.100.0/24 -j take sudo iptables -a forwards -i tun0 -o eth1 -s 10.8.0.0/24 -d 10.0.100.0/24 -j take sudo iptables -a forwards -i eth1 -o tun0 -s 10.0.100.0/24 -d 10.8.0.0/24 -j take sudo iptables -t nat -a postrouting -o eth0 -j masquerade the problem

i can create encrypted connection between openvpn client , openvpn server.

i can not reach internal network resource beyond openvpn server connected openvpn client. appears packets not forwarding across openvpn server's firewall (iptables).

if position myself on openvpn server via ssh, no packet forwarding required reach endpoint, can ping internal resources , openvpn client (that i'm originating from).

thus, network connectivity there, appears iptables misconfigured, according iptables requirements listed above.

i need ordered list of iptables commands correctly , exactly implement packet forwarding requirements listed above.

flush iptables. assuming necessary forwarding enabled , using default openvpn subnet 10.8.0.0, utilize server's lan ip @ end.

iptables -t nat -a postrouting -s 10.8.0.0/24 -j snat --to 1.2.3.4

this should give access vpn servers local lan using openvpn.

linux ubuntu networking iptables openvpn