<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-text-html" lang="x-unicode"> Ahoj,<br>
<br>
snazim se nastavit openvpn server tak, abych pres nej mohl
pristupovat dal do inernetu, ale nedari se mi to.<br>
Sel jsem podle tohoto navodu:<br>
<a class="moz-txt-link-freetext"
href="https://blog.sslmarket.cz/ssl/nastaveni-openvpn-na-serveru-s-debian-8-jessie/">https://blog.sslmarket.cz/ssl/nastaveni-openvpn-na-serveru-s-debian-8-jessie/</a><br>
<br>
a podari se mi pres vpn dostat na server, ale dal uz ne (ani
nepingnu). Predpokladam, ze je nejaky problem v nastaveni
iptables, zkousel jsem i <br>
<pre class="code"><code>iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -j MASQUERADE</code></pre>
i podle navodu z <a class="moz-txt-link-freetext"
href="https://kb.vpsfree.cz/navody/server/openvpn">https://kb.vpsfree.cz/navody/server/openvpn</a><br>
<pre class="code">iptables -t nat -A POSTROUTING -o venet0 -j SNAT --to x.x.x.x
<code>
Diky za jakekoliv nakopnuti nebo upravu vpsfree navodu.
Pavel Švojgr
--- vypisy nastaveni ----
</code></pre>
# iptables -t nat -L<br>
Chain PREROUTING (policy ACCEPT)<br>
target prot opt source destination <br>
<br>
Chain POSTROUTING (policy ACCEPT)<br>
target prot opt source destination <br>
MASQUERADE all -- 10.8.0.0/24 anywhere <br>
<br>
Chain OUTPUT (policy ACCEPT)<br>
target prot opt source destination<br>
<br>
# iptables -L<br>
Chain INPUT (policy ACCEPT)<br>
target prot opt source destination <br>
<br>
Chain FORWARD (policy ACCEPT)<br>
target prot opt source destination <br>
<br>
Chain OUTPUT (policy ACCEPT)<br>
target prot opt source destination<br>
<br>
# tail /var/log/syslog<br>
<br>
Jan 6 16:35:09 svojgr ovpn-server[10656]: 188.122.208.66:37508
[swed] Peer Connection Initiated with
[AF_INET]188.122.208.66:37508<br>
Jan 6 16:35:09 svojgr ovpn-server[10656]:
swed/188.122.208.66:37508 MULTI_sva: pool returned IPv4=10.8.0.6,
IPv6=(Not enabled)<br>
Jan 6 16:35:09 svojgr ovpn-server[10656]:
swed/188.122.208.66:37508 MULTI: Learn: 10.8.0.6 ->
swed/188.122.208.66:37508<br>
Jan 6 16:35:09 svojgr ovpn-server[10656]:
swed/188.122.208.66:37508 MULTI: primary virtual IP for
swed/188.122.208.66:37508: 10.8.0.6<br>
Jan 6 16:35:11 svojgr ovpn-server[10656]:
swed/188.122.208.66:37508 PUSH: Received control message:
'PUSH_REQUEST'<br>
Jan 6 16:35:11 svojgr ovpn-server[10656]:
swed/188.122.208.66:37508 send_push_reply(): safe_cap=940<br>
Jan 6 16:35:11 svojgr ovpn-server[10656]:
swed/188.122.208.66:37508 SENT CONTROL [swed]:
'PUSH_REPLY,redirect-gateway def1,route 10.8.0.1,topology
net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
(status=1)<br>
<br>
# cat server.conf <br>
mode server<br>
port 1194<br>
proto udp<br>
dev tun<br>
<br>
ca ca.crt<br>
cert server.crt<br>
key server.key # privátní klíč serveru, nikam nepřenášet!<br>
dh dh2048.pem<br>
<br>
server 10.8.0.0 255.255.255.0<br>
<br>
#push "redirect-gateway autolocal" #přesměrování všeho provozu do
tunelu<br>
push "redirect-gateway def1"<br>
#push "dhcp-option DNS 217.31.204.130" #budete používat otevřené
resolvery CZ.NICu<br>
#push "dhcp-option DNS 193.29.206.206"<br>
<br>
#tls-server<br>
#tls-auth ta.key 0<br>
ifconfig-pool-persist ipp.txt<br>
keepalive 10 120<br>
comp-lzo<br>
persist-key<br>
persist-tun<br>
user nobody<br>
group users<br>
status openvpn-status.log<br>
verb 3<br>
<br>
<br>
# cat /etc/sysctl.conf |grep ip_forward <br>
net.ipv4.ip_forward=1<br>
<br>
# cat openvpn-status.log <br>
OpenVPN CLIENT LIST<br>
Updated,Fri Jan 6 16:42:17 2017<br>
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since<br>
swed,188.122.208.66:58268,75127,4993,Fri Jan 6 16:41:55 2017<br>
ROUTING TABLE<br>
Virtual Address,Common Name,Real Address,Last Ref<br>
10.8.0.6,swed,188.122.208.66:58268,Fri Jan 6 16:42:16 2017<br>
GLOBAL STATS<br>
Max bcast/mcast queue length,0<br>
END<br>
<br>
<br>
# iptables-save <br>
# Generated by iptables-save v1.4.21 on Fri Jan 6 16:57:14 2017<br>
*raw<br>
:PREROUTING ACCEPT [198913:44347927]<br>
:OUTPUT ACCEPT [177047:151548665]<br>
COMMIT<br>
# Completed on Fri Jan 6 16:57:14 2017<br>
# Generated by iptables-save v1.4.21 on Fri Jan 6 16:57:14 2017<br>
*nat<br>
:PREROUTING ACCEPT [2998:172636]<br>
:POSTROUTING ACCEPT [1398:83622]<br>
:OUTPUT ACCEPT [1398:83622]<br>
-A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE<br>
COMMIT<br>
# Completed on Fri Jan 6 16:57:14 2017<br>
# Generated by iptables-save v1.4.21 on Fri Jan 6 16:57:14 2017<br>
*mangle<br>
:PREROUTING ACCEPT [178768:43049496]<br>
:INPUT ACCEPT [178768:43049496]<br>
:FORWARD ACCEPT [0:0]<br>
:OUTPUT ACCEPT [177047:151548665]<br>
:POSTROUTING ACCEPT [177047:151548665]<br>
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG
NONE -j DROP<br>
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP<br>
-A PREROUTING -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP<br>
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP<br>
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,RST FIN,RST -j DROP<br>
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROP<br>
-A PREROUTING -p tcp -m tcp --tcp-flags ACK,URG URG -j DROP<br>
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROP<br>
-A PREROUTING -p tcp -m tcp --tcp-flags PSH,ACK PSH -j DROP<br>
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG
FIN,SYN,RST,PSH,ACK,URG -j DROP<br>
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG
NONE -j DROP<br>
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG
FIN,PSH,URG -j DROP<br>
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG
FIN,SYN,PSH,URG -j DROP<br>
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG
FIN,SYN,RST,ACK,URG -j DROP<br>
-A PREROUTING -s 224.0.0.0/3 -j DROP<br>
-A PREROUTING -s 169.254.0.0/16 -j DROP<br>
-A PREROUTING -s 172.16.0.0/12 -j DROP<br>
-A PREROUTING -s 192.0.2.0/24 -j DROP<br>
-A PREROUTING -s 192.168.0.0/16 -j DROP<br>
-A PREROUTING -s 10.0.0.0/8 -j DROP<br>
-A PREROUTING -s 0.0.0.0/8 -j DROP<br>
-A PREROUTING -s 240.0.0.0/5 -j DROP<br>
-A PREROUTING -s 127.0.0.0/8 ! -i lo -j DROP<br>
-A PREROUTING -p icmp -j DROP<br>
-A PREROUTING -f -j DROP<br>
COMMIT<br>
# Completed on Fri Jan 6 16:57:14 2017<br>
# Generated by iptables-save v1.4.21 on Fri Jan 6 16:57:14 2017<br>
*filter<br>
:INPUT ACCEPT [8741:3756481]<br>
:FORWARD ACCEPT [0:0]<br>
:OUTPUT ACCEPT [7936:4515300]<br>
COMMIT<br>
# Completed on Fri Jan 6 16:57:14 2017<br>
</div>
</body>
</html>