OpenVPN is a popular open-source software that allows secure remote access to a private network. If you are running OpenVPN on a server that uses OpenVZ virtualization, you may encounter some issues when it comes to configuring iptables to allow OpenVPN clients to access the internet via the server. In this article, we will guide you through the process of configuring iptables to enable internet access for OpenVPN clients on an OpenVZ server.
Step 1: Check OpenVPN Server Configuration
Before we begin, make sure that your OpenVPN server is properly configured. Open the OpenVPN server configuration file (usually located at /etc/openvpn/server.conf) and ensure that the following options are set:
dev tun
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
The dev tun option specifies that OpenVPN should create a virtual network device. The server option defines the IP address range for the VPN clients. The push "redirect-gateway def1 bypass-dhcp" option ensures that all client internet traffic is routed through the VPN server. Finally, the push "dhcp-option DNS 8.8.8.8" option sets the DNS server for the VPN clients.
Step 2: Enable IP Forwarding
Next, we need to enable IP forwarding on the OpenVZ server. IP forwarding allows the server to forward packets between different networks. Open the /etc/sysctl.conf file and uncomment the following line:
net.ipv4.ip_forward=1
Save the file and apply the changes by running the following command:
sysctl -p
Step 3: Configure iptables
Now, we can configure iptables to allow OpenVPN clients to access the internet via the server. Run the following commands to create the necessary rules:
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o venet0 -j MASQUERADE
The first command allows packets that are part of an established connection or related to an established connection. The second command allows packets originating from the VPN clients. The third command performs Network Address Translation (NAT) on the VPN client packets before they are sent out to the internet.
Step 4: Save iptables Rules
To ensure that the iptables rules persist after a reboot, we need to save them. Run the following command:
iptables-save > /etc/iptables.rules
Next, open the /etc/network/interfaces file and add the following line at the end:
pre-up iptables-restore < /etc/iptables.rules
Save the file and restart the network service:
service networking restart
Step 5: Test Internet Access
At this point, your OpenVPN server should be configured to allow clients to access the internet via the server. Start the OpenVPN service if it is not already running:
service openvpn start
Connect a client to the VPN server and verify that internet access is working. You can do this by opening a web browser on the client and visiting a website.
Configuring iptables to allow OpenVPN clients to access the internet via an OpenVZ server is a straightforward process. By following the steps outlined in this article, you should be able to enable internet access for your OpenVPN clients without any issues.
References
| Source | Link |
|---|---|
| OpenVPN | https://openvpn.net/ |
| OpenVZ | https://openvz.org/ |