Re: Port-based routing with OpenVPN

[Pascal Hambourg <pascal.mail@plouf.fr.eu.org>]

Mario Hülsegge a écrit :
> 
>  i am sorry, i confused the tcpdump output with another test on a normal
> eth device, this is the capture on tun0:
> 
> 23:47:54.378123 IP 192.168.0.125.3794 > ha-42.web.de.www: S 471744113:471744113(0) win 5840 <mss 1460,sackOK,timestamp 7974928 0,nop,wscale 3>
[etc.]
> the answer seems to be blocked in some way.. suggestions?

First, can you check on the VPN gateway that the request is received and 
forwarded to the destination server ?

Then, check the return path routing. One step would be to set the 
default route through the VPN and check that everything works well.

I see that your workstation source address, 192.168.0.125, is the same 
as in the capture on the ethernet device, and probably different from 
the tun0 address. This is normal, because the source address selection 
occurs before the port based routing is taken into account. However if 
the VPN gateway has no route to your source address, replies cannot come 
back. You may need to add an iptables SNAT or MASQUERADE rule for 
packets leaving the tun0 interface. Beware that with older kernels 
MASQUERADE may not work well with advanced routing.

Also, if the source address is a private address, the VPN gateway must 
perform SNAT or MASQUERADE on packets forwarded from the VPN to the 
public network.

Finally, check that /proc/sys/net/ipv4/conf/tun0/rp_filter = 0, else 
your workstation routing may drop the replies arriving at tun0 (although 
tcpdump would see them).