1

I'm trying to set up an Ubuntu Server 16.04 in a VM to act as a gateway for traffic to be tunnelled through a connection via OpenVPN.

The concept is that this VM has a static IP and clients on my network can set that IP as their gateway and the VM should route traffic through the OpenVPN connection. All other clients default via DHCP to the primary gateway.

I followed this as a guide and adapted it to my purposes. (https://killtacknine.com/building-an-ubuntu-16-04-router-part-3-firewalls/) However, when I set a client to use this tunnel gateway VM as the default gateway it cannot connect to anything outbound. Here is my configuration:

Tunnel Gateway (Running Ubuntu Server 16.04) IP: 192.168.2.3 Gateway: 192.168.2.1 (this is the primary gateway that DHCP clients get)

Contents of /etc/rc.local:

# /etc/rc.local

# Default policy to drop all incoming packets
iptables -P INPUT DROP
iptables -P FORWARD DROP

# Accept incoming packets from localhost and the LAN interface
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i ens160 -j ACCEPT

# Accept incoming packets from the WAN if the router initiated
# the connection
iptables -A INPUT -i tun0 -m conntrack \
    --ctstate ESTABLISHED,RELATED -j ACCEPT

# Forward LAN packets to the WAN
iptables -A FORWARD -i ens160 -o tun0 -j ACCEPT

# Forward WAN packets to the LAN if the LAN initiated the
# connection
iptables -A FORWARD -i tun0 -o ens160 -m conntrack \
    --ctstate ESTABLISHED,RELATED -j ACCEPT

# NAT traffic going out the WAN interface
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

# rc.local needs to exit with 0
exit 0

tun0 is established via systemctl on system start with a config file. Once established the tunnel gateway VM has no problem sending traffic through it by default.

The client is configured as such: IP: 192.168.2.42 Default Gateway: 192.168.2.3

Please let me know what I need to fix or if there is any additional information I can provide!

  • From my client, (192.168.2.42) I can ping the IP address I receive from the OpenVPN server (which I won't provide here because it is a public address). I cannot ping 8.8.8.8 or 1.1.1.1. Traceroute fails to show even a first hop to any external ip address. On the tunnel gateway VM, running tcpdump -i tun0 -v icmp shows nothing. tcpdump -n host 192.168.2.42 -i ens160 shows the packets coming in while running a ping on the client to 1.1.1.1. – Cas Apr 16 '18 at 21:51
0

Adding the following to /etc/rc.local above all of my iptables declarations (above) fixed the issue:

echo 1 > /proc/sys/net/ipv4/ip_forward

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.