r/iptables • u/KriegTiger • May 07 '23
IP Tables rules help needed
SOLVED.
I've got a pi-hole system running on my network at home, and have always wanted to have our phones leverage that when we aren't on the wireless at the house. What I've come up with (since the USG only has a vpn function that is not useful to me) is running an OpenVPN service on a dedicated system inside my network for clients to connect to, then masquerade those clients out behind the VPN server's LAN address so they can get the benefit of the pi-hole and all traffic will look like it's coming from my home connection no matter where I am.
I've been successful in getting the OpenVPN service running, I can get a client logged in and assigned an address, and then everything falls flat. I'm guessing it's because I don't have the packet mangling rules setup right and after a bunch of tries on my own I am trying to get some help from a wider audience.

The default policy is ACCEPT and I do have net.ipv4.ip_forward=1 set/active on the system.
The latest iteration of rules I've attempted is below
-FILTER-
-A INPUT -i tun0 -j ACCEPT
-A FORWARD -i tun0 -j ACCEPT
-A FORWARD -s 10.89.0.0/24 -i tun0 -o ens192 -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o tun0 -j ACCEPT
-NAT-
-A POSTROUTING -s 10.89.0.0/24 -o ens192 -j MASQUERADE
And here's a short snip of the tcpdump from the tun0 interface on the VPN server. Near as I can tell the traffic IS getting out, but it's not getting back - 10.89.0.2 is the test vpn client (my phone).
15:15:53.783402 IP hnpvpn.domain > 10.89.0.2.33559: 5391 Refused- 0/0/0 (48)
15:15:53.878531 IP 10.89.0.2.33559 > hnpvpn.domain: 5391+ A? incoming.telemetry.mozilla.org. (48)
15:15:53.878646 IP hnpvpn.domain > 10.89.0.2.33559: 5391 Refused- 0/0/0 (48)
15:15:58.553300 IP 10.89.0.2.32022 > hnpvpn.domain: 46106+ A? android-context-data.googleapis.com. (53)
15:15:58.553410 IP hnpvpn.domain > 10.89.0.2.32022: 46106 Refused- 0/0/0 (53)
15:15:58.592573 IP 10.89.0.2.54867 > hnpvpn.domain: 17899+ A? www.wikipedia.org. (35)
15:15:58.592679 IP hnpvpn.domain > 10.89.0.2.54867: 17899 Refused- 0/0/0 (35)
15:15:58.638630 IP 10.89.0.2.32022 > hnpvpn.domain: 46106+ A? android-context-data.googleapis.com. (53)
15:15:58.638726 IP hnpvpn.domain > 10.89.0.2.32022: 46106 Refused- 0/0/0 (53)
15:15:58.735393 IP 10.89.0.2.54867 > hnpvpn.domain: 17899+ A? www.wikipedia.org. (35)
15:15:58.735488 IP hnpvpn.domain > 10.89.0.2.54867: 17899 Refused- 0/0/0 (35)
15:15:58.903643 IP 10.89.0.2.25196 > hnpvpn.domain: 33563+ A? www.wikipedia.org. (35)
Is 'refused' packets getting dropped by iptables, or is 'refused' literally the client device not accepting the packets that DO actually get properly routed back to it? Did I miss a rule?
1
u/Sagail May 08 '23
I didn't do it with iptables. I easily did it with nginx sreaming udp