OpenVPN connects to VPN but no internet (Ubuntu 10.10 64-bit)

**MedianN** · January 8th, 2011

Thank you for your reply.

VPN disabled:

Code:

# Generated by iptables-save v1.4.4 on Sat Jan  8 14:48:14 2011
*nat
:PREROUTING ACCEPT [354:67213]
:OUTPUT ACCEPT [1573:97080]
:POSTROUTING ACCEPT [764:43779]
COMMIT
# Completed on Sat Jan  8 14:48:14 2011
# Generated by iptables-save v1.4.4 on Sat Jan  8 14:48:14 2011
*mangle
:PREROUTING ACCEPT [32085:6917274]
:INPUT ACCEPT [31243:6805624]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [7373:945937]
:POSTROUTING ACCEPT [6539:890321]
COMMIT
# Completed on Sat Jan  8 14:48:14 2011
# Generated by iptables-save v1.4.4 on Sat Jan  8 14:48:14 2011
*filter
:INPUT DROP [5:716]
:FORWARD DROP [0:0]
:OUTPUT DROP [815:53382]
:INBOUND - [0:0]
:LOG_FILTER - [0:0]
:LSI - [0:0]
:LSO - [0:0]
:OUTBOUND - [0:0]
[0:0] -A INPUT -s 8.8.8.8/32 -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT 
[435:59091] -A INPUT -s 8.8.8.8/32 -p udp -j ACCEPT 
[0:0] -A INPUT -s 8.8.4.4/32 -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT 
[18:2333] -A INPUT -s 8.8.4.4/32 -p udp -j ACCEPT 
[22:1188] -A INPUT -i lo -j ACCEPT 
[12:2752] -A INPUT -p icmp -m limit --limit 10/sec -j ACCEPT 
[10:3282] -A INPUT -d 255.255.255.255/32 -i wlan0 -j DROP 
[26:2330] -A INPUT -d 192.168.1.255/32 -j DROP 
[0:0] -A INPUT -s 224.0.0.0/8 -j DROP 
[158:25409] -A INPUT -d 224.0.0.0/8 -j DROP 
[0:0] -A INPUT -s 255.255.255.255/32 -j DROP 
[0:0] -A INPUT -d 0.0.0.0/32 -j DROP 
[3:120] -A INPUT -m state --state INVALID -j DROP 
[0:0] -A INPUT -f -m limit --limit 10/min -j LSI 
[30554:6708403] -A INPUT -i wlan0 -j INBOUND 
[5:716] -A INPUT -j LOG_FILTER 
[5:716] -A INPUT -j LOG --log-prefix "Unknown Input" --log-level 6 
[0:0] -A FORWARD -p icmp -m limit --limit 10/sec -j ACCEPT 
[0:0] -A FORWARD -j LOG_FILTER 
[0:0] -A FORWARD -j LOG --log-prefix "Unknown Forward" --log-level 6 
[0:0] -A OUTPUT -s 192.168.1.2/32 -d 8.8.8.8/32 -p tcp -m tcp --dport 53 -j ACCEPT 
[453:29569] -A OUTPUT -s 192.168.1.2/32 -d 8.8.8.8/32 -p udp -m udp --dport 53 -j ACCEPT 
[0:0] -A OUTPUT -s 192.168.1.2/32 -d 8.8.4.4/32 -p tcp -m tcp --dport 53 -j ACCEPT 
[18:1148] -A OUTPUT -s 192.168.1.2/32 -d 8.8.4.4/32 -p udp -m udp --dport 53 -j ACCEPT 
[22:1188] -A OUTPUT -o lo -j ACCEPT 
[0:0] -A OUTPUT -s 224.0.0.0/8 -j DROP 
[15:2074] -A OUTPUT -d 224.0.0.0/8 -j DROP 
[0:0] -A OUTPUT -s 255.255.255.255/32 -j DROP 
[0:0] -A OUTPUT -d 0.0.0.0/32 -j DROP 
[4:160] -A OUTPUT -m state --state INVALID -j DROP 
[6046:858416] -A OUTPUT -o wlan0 -j OUTBOUND 
[815:53382] -A OUTPUT -j LOG_FILTER 
[815:53382] -A OUTPUT -j LOG --log-prefix "Unknown Output" --log-level 6 
[4681:3784249] -A INBOUND -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT 
[25863:2923168] -A INBOUND -p udp -m state --state RELATED,ESTABLISHED -j ACCEPT 
[10:986] -A INBOUND -j LSI 
[10:986] -A LSI -j LOG_FILTER 
[0:0] -A LSI -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 1/sec -j LOG --log-prefix "Inbound " --log-level 6 
[0:0] -A LSI -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j DROP 
[0:0] -A LSI -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -m limit --limit 1/sec -j LOG --log-prefix "Inbound " --log-level 6 
[0:0] -A LSI -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -j DROP 
[0:0] -A LSI -p icmp -m icmp --icmp-type 8 -m limit --limit 1/sec -j LOG --log-prefix "Inbound " --log-level 6 
[0:0] -A LSI -p icmp -m icmp --icmp-type 8 -j DROP 
[10:986] -A LSI -m limit --limit 5/sec -j LOG --log-prefix "Inbound " --log-level 6 
[10:986] -A LSI -j DROP 
[0:0] -A LSO -j LOG_FILTER 
[0:0] -A LSO -m limit --limit 5/sec -j LOG --log-prefix "Outbound " --log-level 6 
[0:0] -A LSO -j REJECT --reject-with icmp-port-unreachable 
[897:124638] -A OUTBOUND -p icmp -j ACCEPT 
[4650:700628] -A OUTBOUND -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT 
[201:19842] -A OUTBOUND -p udp -m state --state RELATED,ESTABLISHED -j ACCEPT 
[298:13308] -A OUTBOUND -j ACCEPT 
COMMIT
# Completed on Sat Jan  8 14:48:14 2011

Code:

# Generated by iptables-save v1.4.4 on Sat Jan  8 14:50:52 2011
*nat
:PREROUTING ACCEPT [379:70696]
:OUTPUT ACCEPT [1686:103809]
:POSTROUTING ACCEPT [815:46580]
COMMIT
# Completed on Sat Jan  8 14:50:52 2011
# Generated by iptables-save v1.4.4 on Sat Jan  8 14:50:52 2011
*mangle
:PREROUTING ACCEPT [33083:7150971]
:INPUT ACCEPT [32227:7032574]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [7867:1001249]
:POSTROUTING ACCEPT [6969:941271]
COMMIT
# Completed on Sat Jan  8 14:50:52 2011
# Generated by iptables-save v1.4.4 on Sat Jan  8 14:50:52 2011
*filter
:INPUT DROP [5:716]
:FORWARD DROP [0:0]
:OUTPUT DROP [879:57744]
:INBOUND - [0:0]
:LOG_FILTER - [0:0]
:LSI - [0:0]
:LSO - [0:0]
:OUTBOUND - [0:0]
[0:0] -A INPUT -s 8.8.8.8/32 -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT 
[450:60766] -A INPUT -s 8.8.8.8/32 -p udp -j ACCEPT 
[0:0] -A INPUT -s 8.8.4.4/32 -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT 
[20:2501] -A INPUT -s 8.8.4.4/32 -p udp -j ACCEPT 
[35:2004] -A INPUT -i lo -j ACCEPT 
[24:4464] -A INPUT -p icmp -m limit --limit 10/sec -j ACCEPT 
[11:3610] -A INPUT -d 255.255.255.255/32 -i wlan0 -j DROP 
[26:2330] -A INPUT -d 192.168.1.255/32 -j DROP 
[0:0] -A INPUT -s 224.0.0.0/8 -j DROP 
[180:28500] -A INPUT -d 224.0.0.0/8 -j DROP 
[0:0] -A INPUT -s 255.255.255.255/32 -j DROP 
[0:0] -A INPUT -d 0.0.0.0/32 -j DROP 
[3:120] -A INPUT -m state --state INVALID -j DROP 
[0:0] -A INPUT -f -m limit --limit 10/min -j LSI 
[31473:6927563] -A INPUT -i wlan0 -j INBOUND 
[5:716] -A INPUT -j LOG_FILTER 
[5:716] -A INPUT -j LOG --log-prefix "Unknown Input" --log-level 6 
[0:0] -A FORWARD -p icmp -m limit --limit 10/sec -j ACCEPT 
[0:0] -A FORWARD -j LOG_FILTER 
[0:0] -A FORWARD -j LOG --log-prefix "Unknown Forward" --log-level 6 
[0:0] -A OUTPUT -s 192.168.1.2/32 -d 8.8.8.8/32 -p tcp -m tcp --dport 53 -j ACCEPT 
[470:30584] -A OUTPUT -s 192.168.1.2/32 -d 8.8.8.8/32 -p udp -m udp --dport 53 -j ACCEPT 
[0:0] -A OUTPUT -s 192.168.1.2/32 -d 8.8.4.4/32 -p tcp -m tcp --dport 53 -j ACCEPT 
[20:1268] -A OUTPUT -s 192.168.1.2/32 -d 8.8.4.4/32 -p udp -m udp --dport 53 -j ACCEPT 
[35:2004] -A OUTPUT -o lo -j ACCEPT 
[0:0] -A OUTPUT -s 224.0.0.0/8 -j DROP 
[15:2074] -A OUTPUT -d 224.0.0.0/8 -j DROP 
[0:0] -A OUTPUT -s 255.255.255.255/32 -j DROP 
[0:0] -A OUTPUT -d 0.0.0.0/32 -j DROP 
[4:160] -A OUTPUT -m state --state INVALID -j DROP 
[6444:907415] -A OUTPUT -o wlan0 -j OUTBOUND 
[879:57744] -A OUTPUT -j LOG_FILTER 
[879:57744] -A OUTPUT -j LOG --log-prefix "Unknown Output" --log-level 6 
[4995:3935835] -A INBOUND -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT 
[26468:2990742] -A INBOUND -p udp -m state --state RELATED,ESTABLISHED -j ACCEPT 
[10:986] -A INBOUND -j LSI 
[10:986] -A LSI -j LOG_FILTER 
[0:0] -A LSI -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 1/sec -j LOG --log-prefix "Inbound " --log-level 6 
[0:0] -A LSI -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j DROP 
[0:0] -A LSI -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -m limit --limit 1/sec -j LOG --log-prefix "Inbound " --log-level 6 
[0:0] -A LSI -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -j DROP 
[0:0] -A LSI -p icmp -m icmp --icmp-type 8 -m limit --limit 1/sec -j LOG --log-prefix "Inbound " --log-level 6 
[0:0] -A LSI -p icmp -m icmp --icmp-type 8 -j DROP 
[10:986] -A LSI -m limit --limit 5/sec -j LOG --log-prefix "Inbound " --log-level 6 
[10:986] -A LSI -j DROP 
[0:0] -A LSO -j LOG_FILTER 
[0:0] -A LSO -m limit --limit 5/sec -j LOG --log-prefix "Outbound " --log-level 6 
[0:0] -A LSO -j REJECT --reject-with icmp-port-unreachable 
[897:124638] -A OUTBOUND -p icmp -j ACCEPT 
[4961:741244] -A OUTBOUND -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT 
[257:26603] -A OUTBOUND -p udp -m state --state RELATED,ESTABLISHED -j ACCEPT 
[329:14930] -A OUTBOUND -j ACCEPT 
COMMIT
# Completed on Sat Jan  8 14:50:52 2011

**The Cog** · January 8th, 2011

There's your problem (probably). You are running a firewall. I have no idea which one though. The rules do not allow using the VPN interface, and are not being changed (I wouldn't expect them to) when the VPN is started.

The two most common firewalls I read about are UFW and firestarter. Perhaps you should look in synaptic and see which one is installed, then do a complete removal.

A quick test would be to use very simple firewall rules with this series of commands (this will replace your existing firewall rules until next reboot):

Code:

sudo iptables -F
sudo iptables -X
sudo iptables -P INPUT DROP
sudo iptables -P OUTPUT ACCEPT
sudo iptables -P FORWARD DROP
sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

**MedianN** · January 8th, 2011

I removed Firestarter.

I also used your code and the following happened:

Still no websites, but it connected longer, almost as if there was a time out eventually. The chrome error is still RESOLV though. I then input a manual DNS into the IPv4 still no cigar. Sigh

Code:

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
178.73.212.230  192.168.1.1     255.255.255.255 UGH       0 0          0 wlan0
178.73.209.0    0.0.0.0         255.255.255.0   U         0 0          0 tap0
192.168.1.0     0.0.0.0         255.255.255.0   U         0 0          0 wlan0
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 wlan0
0.0.0.0         178.73.209.1    0.0.0.0         UG        0 0          0 tap0

**MedianN** · January 8th, 2011

OMG! It works now! After trying the terminal version of OpenVPN.

Thank you so much!

How do I make this a permanent fix though, will my firewall revert or stay the same? Also -- am I safe with this firewall setup!

THANK YOU!

**The Cog** · January 8th, 2011

The little firewall script I gave you should be safe - it blocks all incoming connections but allows all outbound connections.

But you really should sort out your existing firewall setup. I generally argue that Ubuntu doesn't need a firewall because it doesn't have any unwanted and unstoppable listening services running. So I suggest that you identify and remove the firewall that's there now.

If you really feel you want firewall rules, try these

Code:

# Firewall configuration
# Clear out the old crap
/sbin/iptables -F
/sbin/iptables -X
/sbin/ip6tables -F
/sbin/ip6tables -X

# Default policy
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT ACCEPT
/sbin/iptables -P FORWARD DROP
/sbin/ip6tables -P INPUT DROP
/sbin/ip6tables -P OUTPUT DROP
/sbin/ip6tables -P FORWARD DROP

# Allow existing connections to continue
/sbin/iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
/sbin/ip6tables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 

# Allow packets from loopback interface
/sbin/iptables -A INPUT -i lo -j ACCEPT
/sbin/ip6tables -A INPUT -i lo -j ACCEPT

Put them in a script (perhaps /etc/firewall.sh)
make it executable: sudo chmod +x /etc/firewall.sh
make it owned by root: sudo chown root:root /etc/firewall.sh

Then you can run it any time with sudo /etc/firewall.sh or add the it to /etc/rc.local to have it run when the PC boots.

But you must find out what is configuring your current firewall rules first, and stop that. Having two different programs fighting over what is in iptables is going to bring trouble.

**pi3ch** · April 8th, 2011

The other piece of cake solution is to

Import your VPN config file in NetworkManager
Edit the VPN connection
Go to IP Settings tab (IP4Settings)
Click on Routes
Check "Use this connection only for resources on its network"
Restart the connection.

This will no allow the VPN connection to mess up your routing table.

**dsegarra** · May 29th, 2011

Hi there. I hope I can get some help here. I am having the same problem. My clients cant connect to the internet. I know it is a firewall issue because I can disable it and it works. However, my server was hacked and I am very paranoid and so far my iptables have been working. Can you help me out here?

iptables-save -c posts this:

# Generated by iptables-save v1.4.10 on Sat May 28 21:58:04 2011
*mangle

REROUTING ACCEPT [24462:6638243]
:INPUT ACCEPT [6685:833190]
:FORWARD ACCEPT [31031:10152425]
:OUTPUT ACCEPT [6053:1821729]

OSTROUTING ACCEPT [37275:11997938]
[0:0] -A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
[0:0] -A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
[0:0] -A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
[0:0] -A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
[0:0] -A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
[0:0] -A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
[0:0] -A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
[0:0] -A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
[0:0] -A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
[0:0] -A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
[0:0] -A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
[0:0] -A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
[0:0] -A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
COMMIT
# Completed on Sat May 28 21:58:04 2011
# Generated by iptables-save v1.4.10 on Sat May 28 21:58:04 2011
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [30945:10146890]
:OUTPUT ACCEPT [6053:1821729]
:TCP - [0:0]
:UDP - [0:0]
[0:0] -A INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT
[0:0] -A INPUT -s 127.0.0.0/8 -i eth0 -j DROP
[0:0] -A INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT
[0:0] -A INPUT -p tcp -m tcp --dport 10000 -j ACCEPT
[213:18424] -A INPUT -i lo -j ACCEPT
[0:0] -A INPUT -m state --state INVALID -j DROP
[5889:745165] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
[3:180] -A INPUT -p icmp -m icmp --icmp-type 8 -m state --state NEW -j ACCEPT
[487:66357] -A INPUT -p udp -m state --state NEW -j UDP
[44:2268] -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j TCP
[13:4296] -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
[28:1408] -A INPUT -p tcp -j REJECT --reject-with tcp-reset
[60:1764] -A INPUT -j REJECT --reject-with icmp-proto-unreachable
[0:0] -A INPUT -p tcp -m tcp --dport 10000 -j ACCEPT
[0:0] -A INPUT -i eth0 -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name SSH --rsource
[0:0] -A INPUT -i eth0 -p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 8 --rttl --name SSH --rsource -j DROP
[0:0] -A INPUT -i tun+ -j ACCEPT
[0:0] -A FORWARD -d 192.168.122.0/24 -o virbr0 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT
[0:0] -A FORWARD -i virbr0 -o virbr0 -j ACCEPT
[0:0] -A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
[0:0] -A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
[0:0] -A FORWARD -d 192.168.122.0/24 -o virbr0 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT
[0:0] -A FORWARD -i virbr0 -o virbr0 -j ACCEPT
[0:0] -A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
[0:0] -A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
[0:0] -A FORWARD -d 192.168.122.0/24 -o virbr0 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT
[0:0] -A FORWARD -i virbr0 -o virbr0 -j ACCEPT
[0:0] -A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
[0:0] -A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
[0:0] -A FORWARD -d 192.168.122.0/24 -o virbr0 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT
[0:0] -A FORWARD -i virbr0 -o virbr0 -j ACCEPT
[0:0] -A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
[0:0] -A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
[0:0] -A FORWARD -d 192.168.122.0/24 -o virbr0 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT
[0:0] -A FORWARD -i virbr0 -o virbr0 -j ACCEPT
[0:0] -A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
[0:0] -A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
[0:0] -A FORWARD -d 192.168.122.0/24 -o virbr0 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT
[0:0] -A FORWARD -i virbr0 -o virbr0 -j ACCEPT
[0:0] -A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
[0:0] -A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
[0:0] -A FORWARD -d 192.168.122.0/24 -o virbr0 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT
[0:0] -A FORWARD -i virbr0 -o virbr0 -j ACCEPT
[0:0] -A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
[0:0] -A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
[0:0] -A FORWARD -d 192.168.122.0/24 -o virbr0 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT
[0:0] -A FORWARD -i virbr0 -o virbr0 -j ACCEPT
[0:0] -A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
[0:0] -A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
[0:0] -A FORWARD -d 192.168.122.0/24 -o virbr0 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT
[0:0] -A FORWARD -i virbr0 -o virbr0 -j ACCEPT
[0:0] -A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
[0:0] -A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
[0:0] -A FORWARD -d 192.168.122.0/24 -o virbr0 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT
[0:0] -A FORWARD -i virbr0 -o virbr0 -j ACCEPT
[0:0] -A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
[0:0] -A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
[0:0] -A FORWARD -d 192.168.122.0/24 -o virbr0 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT
[0:0] -A FORWARD -i virbr0 -o virbr0 -j ACCEPT
[0:0] -A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
[0:0] -A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
[0:0] -A FORWARD -d 192.168.122.0/24 -o virbr0 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT
[0:0] -A FORWARD -i virbr0 -o virbr0 -j ACCEPT
[0:0] -A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
[0:0] -A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
[0:0] -A FORWARD -d 192.168.122.0/24 -o virbr0 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT
[0:0] -A FORWARD -i virbr0 -o virbr0 -j ACCEPT
[0:0] -A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
[0:0] -A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
[0:0] -A FORWARD -d 192.168.122.0/24 -o virbr0 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT
[0:0] -A FORWARD -i virbr0 -o virbr0 -j ACCEPT
[0:0] -A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
[0:0] -A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
[86:5535] -A FORWARD -i tun+ -j ACCEPT
[3:144] -A TCP -p tcp -m tcp --dport 80 -j ACCEPT
[0:0] -A TCP -p tcp -m tcp --dport 53 -j ACCEPT
[2:120] -A TCP -p tcp -m tcp --dport 22 -j ACCEPT
[0:0] -A TCP -p tcp -m tcp --dport 135 -j ACCEPT
[2:96] -A TCP -p tcp -m tcp --dport 139 -j ACCEPT
[3:152] -A TCP -p tcp -m tcp --dport 445 -j ACCEPT
[0:0] -A TCP -p tcp -m tcp --dport 8000 -j ACCEPT
[0:0] -A TCP -p tcp -m tcp --dport 443 -j ACCEPT
[0:0] -A TCP -p tcp -m tcp --dport 49531 -j ACCEPT
[6:348] -A TCP -p tcp -m tcp --dport 1720 -j ACCEPT
[337:28176] -A UDP -p udp -m udp --dport 137 -j ACCEPT
[137:33885] -A UDP -p udp -m udp --dport 138 -j ACCEPT
[0:0] -A UDP -p udp -m udp --dport 443 -j ACCEPT
COMMIT
# Completed on Sat May 28 21:58:04 2011
# Generated by iptables-save v1.4.10 on Sat May 28 21:58:04 2011
*nat

REROUTING ACCEPT [1549:257979]
:INPUT ACCEPT [27:3003]
:OUTPUT ACCEPT [158:16355]

OSTROUTING ACCEPT [1143:127708]
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
[2:192] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
[0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
[0:0] -A POSTROUTING -s 192.168.10.0/24 -o eth0 -j MASQUERADE
[0:0] -A POSTROUTING -s 192.168.10.0/24 -o eth0 -j MASQUERADE
COMMIT

this are my TCP iptables rules:

1 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
2 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:53
3 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
4 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:135
5 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:139
6 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:445
7 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8000
8 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:443
9 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:49531
10 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:1720

my UDP ones:

1 ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:137
2 ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:138
3 ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:443

I am running a virtual win7 host on my server as well...and this is my ifconfig:

br0 Link encap:Ethernet HWaddr 00:25:90:0B:1C:26
inet addr:192.168.1.103 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::225:90ff:fe0b:1c26/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:8940 errors:0 dropped:0 overruns:0 frame:0
TX packets:5988 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1248508 (1.1 Mb) TX bytes:1904878 (1.8 Mb)

eth0 Link encap:Ethernet HWaddr 00:25:90:0B:1C:26
inet6 addr: fe80::225:90ff:fe0b:1c26/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:24350 errors:0 dropped:0 overruns:0 frame:0
TX packets:7628 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:6759152 (6.4 Mb) TX bytes:2673370 (2.5 Mb)
Interrupt:16 Memory:fb5e0000-fb600000

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:265 errors:0 dropped:0 overruns:0 frame:0
TX packets:265 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:22968 (22.4 Kb) TX bytes:22968 (22.4 Kb)

tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:192.168.10.1 P-t-P:192.168.10.2 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:7 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:423 (423.0 b) TX bytes:0 (0.0 b)

virbr0 Link encap:Ethernet HWaddr DA:17

3:F1:C9:17
inet addr:192.168.122.1 Bcast:192.168.122.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:97 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 b) TX bytes:13202 (12.8 Kb)

vnet0 Link encap:Ethernet HWaddr FE:54:00:FE:8F:91
inet6 addr: fe80::fc54:ff:fefe:8f91/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:585 errors:0 dropped:0 overruns:0 frame:0
TX packets:15616 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:500
RX bytes:101446 (99.0 Kb) TX bytes:5285829 (5.0 Mb)

vnet1 Link encap:Ethernet HWaddr FE:54:00:06:67:7A
inet6 addr: fe80::fc54:ff:fe06:677a/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:2349 errors:0 dropped:0 overruns:0 frame:0
TX packets:16119 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:500
RX bytes:872158 (851.7 Kb) TX bytes:5173377 (4.9 Mb)

I appreciate if you could help. This is killing me.

Kind Regards,

Dan

**ryukent** · October 29th, 2011

Has anyone successfully managed to get VPNTunnel.se set up with Ubuntu. I can connect but a lot of pages like gmail and paypal don't work.

**lightwarrior** · October 29th, 2011

Excellent iptables and vpn thread!

**pvocong** · February 22nd, 2012

Hello,

Thank you very much for the indications. I have spent 3 days to figure out what's happening with openvpn not being able to browse the web.
Desktop Ubuntu 10.4 LTS; ISP Box (France).
Just following the rules for iptables and launching openvpn by command line, and here I am with VPN. I am using it right now.

Cheers

Thread: OpenVPN connects to VPN but no internet (Ubuntu 10.10 64-bit)

Thread Tools

Display

Re: OpenVPN connects to VPN but no internet (Ubuntu 10.10 64-bit)

Re: OpenVPN connects to VPN but no internet (Ubuntu 10.10 64-bit)

Re: OpenVPN connects to VPN but no internet (Ubuntu 10.10 64-bit)

Re: OpenVPN connects to VPN but no internet (Ubuntu 10.10 64-bit)

Re: OpenVPN connects to VPN but no internet (Ubuntu 10.10 64-bit)

Re: OpenVPN connects to VPN but no internet (Ubuntu 10.10 64-bit)

Re: OpenVPN connects to VPN but no internet (Ubuntu 10.10 64-bit)

Re: OpenVPN connects to VPN but no internet (Ubuntu 10.10 64-bit)

Re: OpenVPN connects to VPN but no internet (Ubuntu 10.10 64-bit)

Re: OpenVPN connects to VPN but no internet (Ubuntu 10.10 64-bit)

Bookmarks

Bookmarks

Posting Permissions