Configuring iptables for Openvpn 2.0.7 on fc3 for remote subnets

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



hey friends,

I have installed OpenVPN 2.0.7 on FC3 through rpm (dag repository).
The network scenario of my office is below:

Remote Client <---->   Internet   <------->  Cisco Pix
Firewall(Gateway) <---->  VPN Server &

                  LAN Clients  (192.168.5.0/24)

Cisco Pix Firewall:  Having a static public ip address and a LAN
Address of 192.168.5.5 and it is also acting as a gateway for the LAN

VPN Server: 192.168.5.20 and this is also a server on LAN
                  running few more services for the clients on LAN.

LAN Clients:  192.168.5.0/24

VPN Server port that is 1194 is open on Firewall. I was able to
connect to the VPN Server from my home machine but I was not able to
browse the clients or servers in the
network range of 192.168.5.0/24. I was able to access the nfs
directories on the VPN Server but not of lan clients. The network is
hetrogenous (windows & linux).

In the OpenVPN FAQ I found this

question: I've successfully set up OpenVPN and can ping between both
OpenVPN peers, however I cannot reach any of the other machines on the
remote subnet. What's the problem?

         Make sure that the firewall is not filtering the TUN/TAP interface.
                    Already allowed through the below iptables entries

     Make sure you have IP forwarding enabled on the server.
                    It is enable on my server

   * If you are using routing (not ethernet bridging), make sure the
clients (or LAN gateway) have a route back to the server for the
packets coming in over the tunnel. This can be done by:
         a)  adding a route in your default gateway for the VPN
network IP subnet pointing to
            the OpenVPN machine,
         b)  adding a route to every client, or
         c)  NATing all VPN traffic to the local address of the
OpenVPN machine for network traffic which leaves the OpenVPN machine
for the local net.

  As I am using routing not ethernet bridging I think last option
that is "c" will be good but I don't know how to configure iptables
for the same.

iptables -L on VPN Server
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  10.1.1.0/24           192.168.5.0/24

I had added route "192.168.5.0 255.255.255.0" in the client.conf file
and push "route 192.168.5.0 255.255.255.0" in the server.conf file.

These entries are also added to iptables on VPN Server
# Allow TUN interface connections to OpenVPN server
iptables -A INPUT -i tun+ -j ACCEPT

# Allow TUN interface connections to be forwarded through other interfaces
iptables -A FORWARD -i tun+ -j ACCEPT

# Allow TAP interface connections to OpenVPN server
iptables -A INPUT -i tap+ -j ACCEPT

# Allow TAP interface connections to be forwarded through other interfaces
iptables -A FORWARD -i tap+ -j ACCEPT

I am attaching the Openvpn server.conf file along with this email. I
will be very grateful If somebody can guide me how to configure
iptables for the above scenario.

Thanks & Regards

Ankush Grover

Attachment: openvpnserver.conf
Description: Binary data

-- 
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
[Index of Archives]     [Older Fedora Users]     [Fedora Announce]     [Fedora Package Announce]     [EPEL Announce]     [Fedora Magazine]     [Fedora News]     [Fedora Summer Coding]     [Fedora Laptop]     [Fedora Cloud]     [Fedora Advisory Board]     [Fedora Education]     [Fedora Security]     [Fedora Scitech]     [Fedora Robotics]     [Fedora Maintainers]     [Fedora Infrastructure]     [Fedora Websites]     [Anaconda Devel]     [Fedora Devel Java]     [Fedora Legacy]     [Fedora Desktop]     [Fedora Fonts]     [ATA RAID]     [Fedora Marketing]     [Fedora Management Tools]     [Fedora Mentors]     [SSH]     [Fedora Package Review]     [Fedora R Devel]     [Fedora PHP Devel]     [Kickstart]     [Fedora Music]     [Fedora Packaging]     [Centos]     [Fedora SELinux]     [Fedora Legal]     [Fedora Kernel]     [Fedora OCaml]     [Coolkey]     [Virtualization Tools]     [ET Management Tools]     [Yum Users]     [Tux]     [Yosemite News]     [Gnome Users]     [KDE Users]     [Fedora Art]     [Fedora Docs]     [Asterisk PBX]     [Fedora Sparc]     [Fedora Universal Network Connector]     [Libvirt Users]     [Fedora ARM]

  Powered by Linux