2

It's couple of days that I'm having hard time figuring out what's wrong with openVPN. Few days ago, I installed and configured openVPN on a Debian server and also on my Ubuntu client. I am facing a weird behavior: OpenVPN server NATs the incoming traffic whenever it wants, but not always!

It looks that the iptables rules on the Debian server get deleted at some specified time every day (I'm not sure though), because the next day if I re-enter the iptable rules (for NAT & DNS queries forwarding) like following,

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
iptables -t nat -A PREROUTING -i tun+ -p udp --dport 53 -j DNAT --to-destination 8.8.8.8

and force-reload openvpn daemon and restart openvpn (at both ends), the traffic gets routed as it should. I've saved iptables rules in the file /etc/iptables.conf and I reload it at boot (/etc/rc.local), but nevertheless the problem still persists. Here is the content of my /etc/iptables.conf:

# Generated by iptables-save v1.4.14 on Tue Apr 15 13:50:46 2014
*security
:INPUT ACCEPT [166249:16762540]
:FORWARD ACCEPT [3659:1318578]
:OUTPUT ACCEPT [165776:17724102]
COMMIT
# Completed on Tue Apr 15 13:50:46 2014
# Generated by iptables-save v1.4.14 on Tue Apr 15 13:50:46 2014
*raw
:PREROUTING ACCEPT [169911:18081298]
:OUTPUT ACCEPT [165776:17724102]
COMMIT
# Completed on Tue Apr 15 13:50:46 2014
# Generated by iptables-save v1.4.14 on Tue Apr 15 13:50:46 2014
*nat
:PREROUTING ACCEPT [42:2524]
:INPUT ACCEPT [1:40]
:OUTPUT ACCEPT [24:1504]
:POSTROUTING ACCEPT [24:1504]
-A PREROUTING -i tun+ -p udp -m udp --dport 53 -j DNAT --to-destination 8.8.8.8
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
COMMIT
# Completed on Tue Apr 15 13:50:46 2014
# Generated by iptables-save v1.4.14 on Tue Apr 15 13:50:46 2014
*mangle
:PREROUTING ACCEPT [169911:18081298]
:INPUT ACCEPT [166249:16762540]
:FORWARD ACCEPT [3659:1318578]
:OUTPUT ACCEPT [165776:17724102]
:POSTROUTING ACCEPT [169435:19042680]
COMMIT
# Completed on Tue Apr 15 13:50:46 2014
# Generated by iptables-save v1.4.14 on Tue Apr 15 13:50:46 2014
*filter
:INPUT ACCEPT [166249:16762540]
:FORWARD ACCEPT [3659:1318578]
:OUTPUT ACCEPT [165776:17724102]
COMMIT
# Completed on Tue Apr 15 13:50:46 2014

Here I've posted my config files. The differences in my working client.conf & server.conf with those in that post are as follows:

# client.conf

user nobody
group nogroup    
redirect-gateway def1 #bypass-dns bypass-dhcp

server:

# server.conf

; duplicate-cn #not needed, commented out    
user nobody
group nogroup    

I'll be deeply grateful if you save me from this chaos!

  • By the way, when I run iptables --list, it shows an empty list. weird, isn't it? – Javad Sadeqzadeh Apr 17 '14 at 20:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.