[OpenVPN home] [Date Prev] [Date Index] [Date Next]
[OpenVPN mailing lists] [Thread Prev] [Thread Index] [Thread Next]
Google
 
Web openvpn.net

[Openvpn-users] VPN routing


  • Subject: [Openvpn-users] VPN routing
  • From: Arthur Kerpician <arthur@xxxxxxxxxxx>
  • Date: Thu, 17 Feb 2005 21:20:04 +0200

Hi all,
Please consider the following config:

VPN CLIENT
----------------------
External IP: 123.123.123.123
Internal VPN IP: 10.0.0.2
Default gw: 10.0.0.1

VPN SERVER
-----------------------
External IP: 231.231.231.231
Internal VPN IP: 10.0.0.1

All traffic on the VPN client is routed through the VPN server using:
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
ipatbles -A FORWARD -s 10.0.0.0/24 -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -j REJECT //block the rest

eth0: external NIC on the server

Ok, the gw works on the client so I have internet connection on it. The problem occurs when an external host tries to access for example the http server on the client (http://123.123.123.123) or pinging the client. Since the default gw on the client is the vpn server, I did a tcpdump -i tap0 (vpn interface) on the server to display some echo replies on the pings. And I received (on tap0 interface) these echo replies which weren't routed back to the pinging host. The output was:
21:11:14.983343 123.123.123.123 > 111.111.111.111: icmp: echo reply (DF)
where 111.111.111.111 is the host from where I started to ping.
Somewere on the vpn server the packets are filtered and not sent to the pinging host. Same for all the connections which have as destination client's external IP. How can I use client's services for external hosts (with no link to the vpn)? Some tweaks on client's routing table? Or the server's packet mangling is faulty?
Any help is greatly appreciated since I used all my ideas on the issue.
Arthur



____________________________________________ Openvpn-users mailing list Openvpn-users@xxxxxxxxxxxxxxxxxxxxx https://lists.sourceforge.net/lists/listinfo/openvpn-users