Iptables – Using iptables to NAT VPN clients to Internet

iptablesopenvpn

I have set up a working OpenVPN server and client, and can apparently connect to each other just fine.

I'm trying to route all of the clients traffic (web+DNS) through the VPN server, however it isn't working. Per the OpenVPN tutorial, I'm doing:

sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

And this apparently does nothing. Once connected to the VPN, the client can ping the server just fine, but has absolutely no Internet access.

Doing

sudo iptables -S or sudo iptables -L

doesn't look like anything has changed.. I've changed the server and client config files per the tutorial's instructions.

Any help would be great, thanks.

Update

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  10.8.0.0/24          0.0.0.0/0           
MASQUERADE  all  --  10.8.0.0/24          0.0.0.0/0           
MASQUERADE  all  --  10.8.0.0/24          0.0.0.0/0           
MASQUERADE  all  --  10.8.0.0/24          0.0.0.0/0

Best Answer

After a Chat with the OP, we concluded that this was an issue with the DNS configuration, where OpenVPN was pushing "10.8.0.1" as the DNS server through DHCP. Since there was no name server running on the VPN server, this caused the client to fail to resolve remote hosts.

Pushing "8.8.8.8" as the DNS server through OpenVPN's DHCP resolved the issue.

We also needed to turn on ip_forward.

The OP needs to add the following to /etc/sysctl.conf:

net.ipv4.ip_forward = 1

(or uncomment it, if there's already a line)

Related Topic