IP forwarding over OpenVPN (tun0) with external forwarded ports

Question

I am trying to configure a very basic routing setup with Ubuntu Server 15.04.

I have an internal interface p4p1 (IP 192.168.0.23) and a working OpenVPN connection using tun0.

I want to forward all traffic from p4p1 through to tun0 and the internet so that my entire network gets the benefits of the OpenVPN connection - nothing new I know.

Obviously this is a common thing and there are guides around the net, I followed this guide: https://help.ubuntu.com/community/Router. Specifically "4.5. Enable IP forwarding and Masquerading" and it all works as expected - except my externally forwarded ports do not work any more. From that article this is the script I am using:

echo -e "\n\nLoading simple rc.firewall-iptables version $FWVER..\n"
DEPMOD=/sbin/depmod
MODPROBE=/sbin/modprobe

EXTIF="tun0"
INTIF="p4p1"

echo "   External Interface:  $EXTIF"
echo "   Internal Interface:  $INTIF"

#======================================================================
#== No editing beyond this line is required for initial MASQ testing == 
echo -en "   loading modules: "
echo "  - Verifying that all kernel modules are ok"
$DEPMOD -a
echo "----------------------------------------------------------------------"
echo -en "ip_tables, "
$MODPROBE ip_tables
echo -en "nf_conntrack, " 
$MODPROBE nf_conntrack
echo -en "nf_conntrack_ftp, " 
$MODPROBE nf_conntrack_ftp
echo -en "nf_conntrack_irc, " 
$MODPROBE nf_conntrack_irc
echo -en "iptable_nat, "
$MODPROBE iptable_nat
echo -en "nf_nat_ftp, "
$MODPROBE nf_nat_ftp
echo "----------------------------------------------------------------------"
echo -e "   Done loading modules.\n"
echo "   Enabling forwarding.."
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "   Enabling DynamicAddr.."
echo "1" > /proc/sys/net/ipv4/ip_dynaddr 
echo "   Clearing any existing rules and setting default policy.."

iptables-restore <<-EOF
*nat
-A POSTROUTING -o "$EXTIF" -j MASQUERADE
COMMIT
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A FORWARD -i "$EXTIF" -o "$INTIF" -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT 
-A FORWARD -i "$INTIF" -o "$EXTIF" -j ACCEPT
-A FORWARD -j LOG
COMMIT
EOF

echo -e "\nrc.firewall-iptables v$FWVER done.\n"

Via my VPN provider I have two ports forwarded so I can access various services on my Ubuntu Server via the VPN connection. When I don't have IP forwarding and Masquerading enabled (via the script in that article) it all works as expected but as soon as I use that script the forwarded ports do not work.

I've obviously missed something and do not know enough about iptables to figure out how I can still forward traffic from p4p1 to tun0 and still allow external access via the forwarded ports.

Any help would be greatly appreciated - if you'd be willing to provide an explanation of the solution you provide I would love to understand whats going on further.

Thank you!

Answer 1

Your problem is likely occurring due to the following rule:

-A FORWARD -i "$EXTIF" -o "$INTIF" -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT 

This is only accepting RELATED or ESTABLISHED connections passing into the tun0 (external) interface and out of the p4p1 (internal) interface, so when outside connections attempt to connect to your port-forwarded service, the connection is dropped because it is NEW. You must modify that rule to either exclude the conntrack module altogether, or include the NEW parameter.

Either of the two below rules should solve your issue:

-A FORWARD -i "$EXTIF" -o "$INTIF" -j ACCEPT

---

-A FORWARD -i $EXTIF -o $INTIF -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j ACCEPT

Hope this helps