6 Jan
2017
6 Jan
'17
5:17 p.m.
Ahoj,
snazim se nastavit openvpn server tak, abych pres nej mohl pristupovat
dal do inernetu, ale nedari se mi to.
Sel jsem podle tohoto navodu:
https://blog.sslmarket.cz/ssl/nastaveni-openvpn-na-serveru-s-debian-8-jessi…
a podari se mi pres vpn dostat na server, ale dal uz ne (ani nepingnu).
Predpokladam, ze je nejaky problem v nastaveni iptables, zkousel jsem i
|iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -j MASQUERADE|
i podle navodu z https://kb.vpsfree.cz/navody/server/openvpn
iptables -t nat -A POSTROUTING -o venet0 -j SNAT --to x.x.x.x
|Diky za jakekoliv nakopnuti nebo upravu vpsfree navodu. Pavel Švojgr ---
vypisy nastaveni ---- |
# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 10.8.0.0/24 anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
# tail /var/log/syslog
Jan 6 16:35:09 svojgr ovpn-server[10656]: 188.122.208.66:37508 [swed]
Peer Connection Initiated with [AF_INET]188.122.208.66:37508
Jan 6 16:35:09 svojgr ovpn-server[10656]: swed/188.122.208.66:37508
MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Jan 6 16:35:09 svojgr ovpn-server[10656]: swed/188.122.208.66:37508
MULTI: Learn: 10.8.0.6 -> swed/188.122.208.66:37508
Jan 6 16:35:09 svojgr ovpn-server[10656]: swed/188.122.208.66:37508
MULTI: primary virtual IP for swed/188.122.208.66:37508: 10.8.0.6
Jan 6 16:35:11 svojgr ovpn-server[10656]: swed/188.122.208.66:37508
PUSH: Received control message: 'PUSH_REQUEST'
Jan 6 16:35:11 svojgr ovpn-server[10656]: swed/188.122.208.66:37508
send_push_reply(): safe_cap=940
Jan 6 16:35:11 svojgr ovpn-server[10656]: swed/188.122.208.66:37508
SENT CONTROL [swed]: 'PUSH_REPLY,redirect-gateway def1,route
10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6
10.8.0.5' (status=1)
# cat server.conf
mode server
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # privátní klíč serveru, nikam nepřenášet!
dh dh2048.pem
server 10.8.0.0 255.255.255.0
#push "redirect-gateway autolocal" #přesměrování všeho provozu do tunelu
push "redirect-gateway def1"
#push "dhcp-option DNS 217.31.204.130" #budete používat otevřené
resolvery CZ.NICu
#push "dhcp-option DNS 193.29.206.206"
#tls-server
#tls-auth ta.key 0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
persist-key
persist-tun
user nobody
group users
status openvpn-status.log
verb 3
# cat /etc/sysctl.conf |grep ip_forward
net.ipv4.ip_forward=1
# cat openvpn-status.log
OpenVPN CLIENT LIST
Updated,Fri Jan 6 16:42:17 2017
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
swed,188.122.208.66:58268,75127,4993,Fri Jan 6 16:41:55 2017
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
10.8.0.6,swed,188.122.208.66:58268,Fri Jan 6 16:42:16 2017
GLOBAL STATS
Max bcast/mcast queue length,0
END
# iptables-save
# Generated by iptables-save v1.4.21 on Fri Jan 6 16:57:14 2017
*raw
:PREROUTING ACCEPT [198913:44347927]
:OUTPUT ACCEPT [177047:151548665]
COMMIT
# Completed on Fri Jan 6 16:57:14 2017
# Generated by iptables-save v1.4.21 on Fri Jan 6 16:57:14 2017
*nat
:PREROUTING ACCEPT [2998:172636]
:POSTROUTING ACCEPT [1398:83622]
:OUTPUT ACCEPT [1398:83622]
-A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE
COMMIT
# Completed on Fri Jan 6 16:57:14 2017
# Generated by iptables-save v1.4.21 on Fri Jan 6 16:57:14 2017
*mangle
:PREROUTING ACCEPT [178768:43049496]
:INPUT ACCEPT [178768:43049496]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [177047:151548665]
:POSTROUTING ACCEPT [177047:151548665]
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,RST FIN,RST -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags ACK,URG URG -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags PSH,ACK PSH -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG
FIN,SYN,RST,PSH,ACK,URG -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG
FIN,PSH,URG -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG
FIN,SYN,PSH,URG -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG
FIN,SYN,RST,ACK,URG -j DROP
-A PREROUTING -s 224.0.0.0/3 -j DROP
-A PREROUTING -s 169.254.0.0/16 -j DROP
-A PREROUTING -s 172.16.0.0/12 -j DROP
-A PREROUTING -s 192.0.2.0/24 -j DROP
-A PREROUTING -s 192.168.0.0/16 -j DROP
-A PREROUTING -s 10.0.0.0/8 -j DROP
-A PREROUTING -s 0.0.0.0/8 -j DROP
-A PREROUTING -s 240.0.0.0/5 -j DROP
-A PREROUTING -s 127.0.0.0/8 ! -i lo -j DROP
-A PREROUTING -p icmp -j DROP
-A PREROUTING -f -j DROP
COMMIT
# Completed on Fri Jan 6 16:57:14 2017
# Generated by iptables-save v1.4.21 on Fri Jan 6 16:57:14 2017
*filter
:INPUT ACCEPT [8741:3756481]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [7936:4515300]
COMMIT
# Completed on Fri Jan 6 16:57:14 2017