OpenVZ Forum


Home » General » Support » Vps with VPN
icon4.gif  Vps with VPN [message #50840] Thu, 14 November 2013 15:40 Go to next message
silence is currently offline  silence
Messages: 12
Registered: November 2013
Location: Portugal - Lisbon
Junior Member
Hi,

i've installed a VPS and i'm using it with tun/tap and ppp. So i connect to it (like a VPN), but after that i don't have Internet at all. Só i've my connection limited.

What can be?

Thanks.
Re: Vps with VPN [message #50846 is a reply to message #50840] Fri, 15 November 2013 22:12 Go to previous messageGo to next message
grep is currently offline  grep
Messages: 34
Registered: November 2013
Member
You need to setup iptables rule to forward pakets.

try
iptables -t nat -A POSTROUTING -j MASQUERADE 
Re: Vps with VPN [message #50872 is a reply to message #50846] Mon, 18 November 2013 12:57 Go to previous messageGo to next message
silence is currently offline  silence
Messages: 12
Registered: November 2013
Location: Portugal - Lisbon
Junior Member
i've tried that, without success:

[root@vpn /]# iptables -t nat -A POSTROUTING -j MASQUERADE
iptables: No chain/target/match by that name.

:\
Re: Vps with VPN [message #50874 is a reply to message #50840] Mon, 18 November 2013 18:58 Go to previous messageGo to next message
grep is currently offline  grep
Messages: 34
Registered: November 2013
Member
You must load the ipt_MASQUERADE + iptable_nat module on node. and if it still not work then include iptable_nat in your vz.conf (/etc/vz/vz.conf) + ve (/etc/vz/num.conf) config.

To load module execute on node:
modprobe ipt_MASQUERADE
modprobe iptable_nat


Then check on vps:
iptables -t nat -L
Please report back if nat chain now exist or not.
Re: Vps with VPN [message #50877 is a reply to message #50874] Tue, 19 November 2013 12:31 Go to previous messageGo to next message
silence is currently offline  silence
Messages: 12
Registered: November 2013
Location: Portugal - Lisbon
Junior Member
still no internet :\


[root@vpn /]# iptables -t nat -A POSTROUTING -j MASQUERADE
[root@vpn /]# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
DNAT all -- anywhere anywhere to:IP

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
SNAT all -- anywhere anywhere to:IP.40
SNAT all -- IP/24 anywhere to:IP.40
SNAT all -- 10.8.0.0/24 anywhere to:127.0.0.1
SNAT all -- IP.0/24 anywhere to:127.0.0.1
SNAT all -- anywhere anywhere to:IP of VPN
SNAT all -- anywhere anywhere to:123.123.123.123
SNAT all -- anywhere anywhere to:IP.40
SNAT all -- 10.8.0.0/24 anywhere to:123.123.123.12
SNAT all -- 10.8.0.0/24 anywhere to:IP.40
SNAT all -- 10.8.0.0/24 anywhere to:IP.40
SNAT all -- anywhere anywhere to:IP.40
MASQUERADE all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination


i've restarted container
Re: Vps with VPN [message #50878 is a reply to message #50840] Tue, 19 November 2013 13:13 Go to previous messageGo to next message
grep is currently offline  grep
Messages: 34
Registered: November 2013
Member
I didnt tryed the rules, but there are many examples on the internet how you could do it.

First you need to flush the rules, iptables -t nat --flush.

Then try:
iptables -t nat -A POSTROUTING -o venet0 -s OPENVPNIP/24 (example: 10.1.1.0/24) -j MASQUERADE

Also you can try without masquerade. masquerade isnt full supported at openvz:
iptables -t nat -A POSTROUTING -o venet0 -j SNAT -to $YOUR_SERVER_IP

www.google.com/search?q=openvpn+masquerade
Re: Vps with VPN [message #50879 is a reply to message #50878] Tue, 19 November 2013 13:24 Go to previous messageGo to next message
silence is currently offline  silence
Messages: 12
Registered: November 2013
Location: Portugal - Lisbon
Junior Member
still not going....this is really weird!
Re: Vps with VPN [message #50880 is a reply to message #50874] Tue, 19 November 2013 13:45 Go to previous messageGo to next message
silence is currently offline  silence
Messages: 12
Registered: November 2013
Location: Portugal - Lisbon
Junior Member
Chain PREROUTING (policy ACCEPT)
target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- IP.0/24 anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Re: Vps with VPN [message #50881 is a reply to message #50879] Tue, 19 November 2013 22:05 Go to previous messageGo to next message
grep is currently offline  grep
Messages: 34
Registered: November 2013
Member
Hello,

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- [b]IP.0/24[/b] anywhere

Is not correct.

You need to input your openvpn IP-Pool. As sayed, example: 10.1.1.0/24

And you have so much different iptables-rules:
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
SNAT all -- anywhere anywhere to:IP.40
SNAT all -- IP/24 anywhere to:IP.40
SNAT all -- 10.8.0.0/24 anywhere to:127.0.0.1
SNAT all -- IP.0/24 anywhere to:127.0.0.1
SNAT all -- anywhere anywhere to:IP of VPN
SNAT all -- anywhere anywhere to:123.123.123.123
SNAT all -- anywhere anywhere to:IP.40
SNAT all -- 10.8.0.0/24 anywhere to:123.123.123.12
SNAT all -- 10.8.0.0/24 anywhere to:IP.40
SNAT all -- 10.8.0.0/24 anywhere to:IP.40
SNAT all -- anywhere anywhere to:IP.40
MASQUERADE all -- anywhere anywhere
flush it first.
iptables -t nat --flush; iptables --flush


Please connect to your openvpn server, check which IP address you get from the server (10.x.x.x) and then add the correct rule.

If you get 10.8.0.1 then your rule would be:
iptables -t nat -A POSTROUTING -o venet0 -s 10.8.0.0/24 -j MASQUERADE
With /24 you add 10.8.0.0-255 to iptables. So dont add only the private ip which you get, add the whole subnet.

I found different rules over google. Its long time ago when i setted up openvpn so i dont remember the correct rule which worked for me. But one of this 3 *must* work for you:
iptables -t nat -A POSTROUTING -o venet0 -s 10.8.0.0/24 (REPLACE WITH YOUR OPENVPN SUBNET) -j MASQUERADE
iptables -t nat -A POSTROUTING -o venet0 -j SNAT -to $YOUR_SERVER_IP (YOUR_SERVER_IP is as example 212.1.1.43. dont use your openvpn private ip here. its the server public ip)
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 (REPLACE WITH YOUR OPENVPN SUBNET) -j SNAT --to-source $YOUR_SERVER_IP (YOUR_SERVER_IP is as example 212.1.1.43. dont use your openvpn private ip here. its the server public ip)

If none of these works, then i only can recommend you to google "openvpn openvz iptables". There are many threads about this on the web and there are a lot of different iptables rules out there. But the 3 rules which i have listed should work for you.

If this too not work on your server then i could offer you to send me your openvpn connect files, your openvz ssh login and i fix it. But please try first these rules.

And when you add a new rule and it dont work, then flush the iptables before you try the next rule (again: iptables -t nat --flush; iptables --flush!!

[Updated on: Tue, 19 November 2013 22:07]

Report message to a moderator

Re: Vps with VPN [message #50883 is a reply to message #50881] Wed, 20 November 2013 10:11 Go to previous messageGo to next message
silence is currently offline  silence
Messages: 12
Registered: November 2013
Location: Portugal - Lisbon
Junior Member
Hi grep,

Thanks for all your answers.

I'm not using openvpn, i'm using another computer with a vpn connection, so i add the IP to the VPS where i've the vpn:

[root@vpn network-scripts]# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- IP.rev.vodafone.pt/24 anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

It's not this?

Thanks.
Re: Vps with VPN [message #50884 is a reply to message #50840] Wed, 20 November 2013 12:43 Go to previous messageGo to next message
grep is currently offline  grep
Messages: 34
Registered: November 2013
Member
Hello,

dont add your internet IP to the rules. I was thinking you use openvpn.

Please make:
iptables -t nat -A POSTROUTING -j SNAT --to-source SERVERIP


Serverip is the IP of your server, not of your internet. Insert the IP of your openvz container.
Re: Vps with VPN [message #50885 is a reply to message #50884] Wed, 20 November 2013 12:48 Go to previous messageGo to next message
silence is currently offline  silence
Messages: 12
Registered: November 2013
Location: Portugal - Lisbon
Junior Member
grep wrote on Wed, 20 November 2013 12:43
Hello,

dont add your internet IP to the rules. I was thinking you use openvpn.

Please make:
iptables -t nat -A POSTROUTING -j SNAT --to-source SERVERIP


Serverip is the IP of your server, not of your internet. Insert the IP of your openvz container.


Chain PREROUTING (policy ACCEPT)
target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
SNAT all -- anywhere anywhere to:IP_of_VPN

Chain OUTPUT (policy ACCEPT)
target prot opt source destination


still not going

[Updated on: Wed, 20 November 2013 12:51]

Report message to a moderator

Re: Vps with VPN [message #50886 is a reply to message #50840] Wed, 20 November 2013 13:16 Go to previous messageGo to next message
grep is currently offline  grep
Messages: 34
Registered: November 2013
Member
What is the value of vpn_ip?
Mask the last numbers if you dont want to make pub.

Also check your firewall rules (iptables --list)
Re: Vps with VPN [message #50887 is a reply to message #50886] Wed, 20 November 2013 13:19 Go to previous messageGo to next message
silence is currently offline  silence
Messages: 12
Registered: November 2013
Location: Portugal - Lisbon
Junior Member
hi,

IP is 94.46.*.* (IP of container)

iptables --list
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Re: Vps with VPN [message #50888 is a reply to message #50840] Wed, 20 November 2013 13:27 Go to previous messageGo to next message
grep is currently offline  grep
Messages: 34
Registered: November 2013
Member
Maybe just domain resolving dont work?
Can you ping 8.8.8.8 with vpn connection?
Re: Vps with VPN [message #50889 is a reply to message #50888] Wed, 20 November 2013 13:30 Go to previous message
silence is currently offline  silence
Messages: 12
Registered: November 2013
Location: Portugal - Lisbon
Junior Member
In container:

ping 8.8.8.8
PING 8.8.8.8 (8.8.8.Cool 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=49 time=35.6 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=49 time=35.5 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=49 time=35.6 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=49 time=36.0 ms
64 bytes from 8.8.8.8: icmp_seq=5 ttl=49 time=35.6 ms


In computer with VPN connection:

request timed out
request timed out
Previous Topic: Cant block DDoS to a VPS? How to do it?
Next Topic: tc RTNETLINK answers: Invalid argument / We have an error talking to the kernel
Goto Forum:
  


Current Time: Tue Nov 05 20:28:29 GMT 2024

Total time taken to generate the page: 0.04097 seconds