1

Context: a Wifi VPN gateway (Linux Ubuntu computer)

  • Simply One distant Server (www.example.com) and One Client (Paul, Ubuntu Linux, gateway) linked with openVpn. Server allows Paul to browse the Internet
  • Paul Client wants to share its connexion (via Wifi AP) to Jack & Sophie.

Problem: Jack & Sophie can only browser the Server homepage (www.example.com). Any other request (IP, ping, nslookup...) fails (NO_INTERNET) if it doesn't concern Server domainname.com or IP. However Paul can browse anything he wants.

NB: Ip forwarding is 1/enabled. Accessing the Internet without VPN works 100%.

How can I fix it ?


Server IPTABLES IF USEFUL

*filter
:INPUT ACCEPT [1623:213921]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [911:146048]
:acctboth - [0:0]
:cphulk - [0:0]
-A INPUT -j cphulk 
-A INPUT -j acctboth 
-A INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 1194 -j ACCEPT 
-A INPUT -i tun+ -j ACCEPT 
-A FORWARD -i tun+ -j ACCEPT 
-A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A OUTPUT -j acctboth 
-A OUTPUT -o tun+ -j ACCEPT 
-A acctboth -s 3.1.170.110/32 ! -i lo -p tcp -m tcp --dport 80 
-A acctboth -d 3.1.170.110/32 ! -i lo -p tcp -m tcp --sport 80 
-A acctboth -s 3.1.170.110/32 ! -i lo -p tcp -m tcp --dport 25 
-A acctboth -d 3.1.170.110/32 ! -i lo -p tcp -m tcp --sport 25 
-A acctboth -s 3.1.170.110/32 ! -i lo -p tcp -m tcp --dport 110 
-A acctboth -d 3.1.170.110/32 ! -i lo -p tcp -m tcp --sport 110 
-A acctboth -s 3.1.170.110/32 ! -i lo -p icmp 
-A acctboth -d 3.1.170.110/32 ! -i lo -p icmp 
-A acctboth -s 3.1.170.110/32 ! -i lo -p tcp 
-A acctboth -d 3.1.170.110/32 ! -i lo -p tcp 
-A acctboth -s 3.1.170.110/32 ! -i lo -p udp 
-A acctboth -d 3.1.170.110/32 ! -i lo -p udp 
-A acctboth -s 3.1.170.110/32 ! -i lo 
-A acctboth -d 3.1.170.110/32 ! -i lo 
-A acctboth -s 10.8.0.1/32 ! -i lo -p tcp -m tcp --dport 80 
-A acctboth -d 10.8.0.1/32 ! -i lo -p tcp -m tcp --sport 80 
-A acctboth -s 10.8.0.1/32 ! -i lo -p tcp -m tcp --dport 25 
-A acctboth -d 10.8.0.1/32 ! -i lo -p tcp -m tcp --sport 25 
-A acctboth -s 10.8.0.1/32 ! -i lo -p tcp -m tcp --dport 110 
-A acctboth -d 10.8.0.1/32 ! -i lo -p tcp -m tcp --sport 110 
-A acctboth -s 10.8.0.1/32 ! -i lo -p icmp 
-A acctboth -d 10.8.0.1/32 ! -i lo -p icmp 
-A acctboth -s 10.8.0.1/32 ! -i lo -p tcp 
-A acctboth -d 10.8.0.1/32 ! -i lo -p tcp 
-A acctboth -s 10.8.0.1/32 ! -i lo -p udp 
-A acctboth -d 10.8.0.1/32 ! -i lo -p udp 
-A acctboth -s 10.8.0.1/32 ! -i lo 
-A acctboth -d 10.8.0.1/32 ! -i lo 
-A acctboth ! -i lo 
-A cphulk -s 22.16.21.100/32 -m state --state NEW -m time --datestop 2015-09-16T18:53:55 --utc -j DROP 
-A cphulk -s 0.0.0.0/32 -m state --state NEW -m time --datestop 2015-09-17T00:34:27 --utc -j DROP 
-A cphulk -s 4.68.02.109/32 -m state --state NEW -m time --datestop 2015-09-17T01:44:56 --utc -j DROP 
-A cphulk -s 9.1.218.145/32 -m state --state NEW -m time --datestop 2015-09-17T04:03:24 --utc -j DROP 
-A cphulk -s 3.1.4.79/32 -m state --state NEW -m time --datestop 2015-09-17T11:21:00 --utc -j DROP 
COMMIT

____ ROUTE when VPN is on :

Destination     Passerelle      Genmask         Indic Metric Ref    Use Iface
default         10.8.0.77       128.0.0.0       UG    0      0        0 tun0
default         192.168.0.1     0.0.0.0         UG    0      0        0 eth0
10.8.0.1        10.8.0.77       255.255.255.255 UGH   0      0        0 tun0
10.8.0.77       *               255.255.255.255 UH    0      0        0 tun0
13.37.42.0      *               255.255.255.0   U     0      0        0 wlan0
ns350510.ip-37- 192.168.0.1     255.255.255.255 UGH   0      0        0 eth0
128.0.0.0       10.8.0.77       128.0.0.0       UG    0      0        0 tun0
link-local      *               255.255.0.0     U     1000   0        0 eth0
192.168.0.0     *               255.255.254.0   U     0      0        0 eth0

___ ROUTE when VPN is off

Destination     Passerelle      Genmask         Indic Metric Ref    Use Iface
default         192.168.0.1     0.0.0.0         UG    0      0        0 eth0
13.37.42.0      *               255.255.255.0   U     0      0        0 wlan0
link-local      *               255.255.0.0     U     1000   0        0 eth0
192.168.0.0     *               255.255.254.0   U     0      0        0 eth0
1

You may want to enable forwarding:

echo 1 >/proc/sys/net/ipv4/conf/all/forwarding

Also, your tunneled IPs (here 10.0.0.0/8) are likely to be private, so do NAT/MASQUERADING:

iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -o eth0 -j MASQUERADE
  • thank you but forwarding is 1 for a while. – ArchiT3K Sep 16 '15 at 12:49
  • What about the routing table on the client side. It should show a route to your vpn host and a default route via the the VPN server's private IP. DNS should point to a server on the VPN server side as well. – Ben Sep 16 '15 at 12:56
  • Yes, I edit for routes. =========== it seems the right way. I started by putting "route-nopull" in thee vpn client config'. Then I ll make route (maybe executed at the end of connection, thanks to "up" option in client config'). ... Yes too for DNS, but I use 8888/8884 Google DNS, there is no need to point anywhere, just having wlan & tun0 connected. That's the whole thing: without VPN, the forwarding is wlan<=>eth . Once vpn is ON, wlan<=>tun . This is a route example ? – ArchiT3K Sep 16 '15 at 14:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.