On Fri, Jul 31, 2015 at 5:31 AM, P Cause <pcause at hotmail.com> wrote: > Thanks for ocserv. I was able to build easily and start and connect but > network routing wasn't working. After a lot of time and searching I found > these steps and thought perhaps the README could be updated to add the > steps. I found at > https://www.vultr.com/docs/setup-openconnect-vpn-server-for-cisco-anyconnect-on-ubuntu-14-04-x64 > What I suggest be added: > > Steps to enable NAT > > Enable NAT in iptables > > iptables -t nat -A POSTROUTING -j MASQUERADE IIRC this rule might cause weird side effects on the loopback interface. Also, you'll probably need to enable MSS clamping to get things working reliably. Here is the script that I run from rc.local on boot (this setup is for IPv4 only): #!/bin/bash ipt=/sbin/iptables sysctl --quiet -w net.ipv4.ip_forward=1 $ipt -F FORWARD $ipt -P FORWARD DROP $ipt -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu $ipt -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT $ipt -A FORWARD -i vpns+ -o eth0 -j ACCEPT $ipt -A FORWARD -i vpns+ -o vpns+ -j ACCEPT $ipt -t nat -F POSTROUTING $ipt -t nat -A POSTROUTING -o eth0 -j MASQUERADE exit 0
