Subject: Re: [vserver] openvpn in vserver prob since kernel upgrade
From: Philippe Teuwen <phil@teuwen.org>
Date: Tue, 21 Aug 2007 12:00:12 +0200

Hello,

Some more details:
I also tried with the following rules instead of MASQUERADE:
iptables -t nat -A POSTROUTING -s 192.168.6.0/24 -o ETH_R -j SNAT 
--to=A.A.A.155
and
iptables -t nat -A POSTROUTING -s 192.168.6.0/24 -o ETH_R -j SNAT 
--to=A.A.A.148
but same result, snat is ok, ping sent, replied, no fwd to vpn client.

iptables -L -n -v|egrep "(tap2|192.168.6|^ *[a-zA-Z])"
Chain INPUT (policy DROP 7 packets, 912 bytes)
 pkts bytes target     prot opt in     out     source               
destination        
##266 16417 ACCEPT     all  --  *      *       192.168.6.0/24       
0.0.0.0/0           state RELATED,ESTABLISHED
    3   245 ACCEPT     all  --  tap2   *       0.0.0.0/0            
0.0.0.0/0          
Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               
destination        
    0     0 ACCEPT     all  --  *      tap2    0.0.0.0/0            
0.0.0.0/0           state RELATED,ESTABLISHED
## 19  1596 ACCEPT     all  --  tap2   *       0.0.0.0/0            
0.0.0.0/0          
Chain OUTPUT (policy DROP 1 packets, 132 bytes)
 pkts bytes target     prot opt in     out     source               
destination        
##195 29577 ACCEPT     all  --  *      *       0.0.0.0/0            
192.168.6.0/24      state RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  *      tap2    0.0.0.0/0            
0.0.0.0/0       

Even without DROP target but ACCEPT, same result.
During ping the counters marked with ## are increasing.
So clearly there was even no temptative to forward the echo reply 
through tap2 (cf chain fwd).

I've another vserver with only a tap interface and the same MASQUERADE rule
and ping to google works so NAT works, only FORWARD seems to be broken.

MAIN#route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use 
Iface
A.A.A.128       0.0.0.0         255.255.255.224 U     0      0        0 
ETH_R
192.168.6.0     0.0.0.0         255.255.255.0   U     0      0        0 tap2
192.168.4.0     0.0.0.0         255.255.255.0   U     0      0        0 tap1
192.168.2.0     0.0.0.0         255.255.255.0   U     0      0        0 tap0
0.0.0.0         A.A.A.158       0.0.0.0         UG    0      0        0 
ETH_R

#lsmod|egrep "(ip|nf)"
ipt_MASQUERADE          6107  3
ipt_REJECT              6986  4
ipt_owner               4375  21
ipt_LOG                 8884  44
iptable_nat            10258  1
nf_nat                 22988  2 ipt_MASQUERADE,iptable_nat
nf_conntrack_ipv4      22514  21 iptable_nat
nf_conntrack           71346  5 
ipt_MASQUERADE,xt_state,iptable_nat,nf_nat,nf_conntrack_ipv4
nfnetlink               9631  3 nf_nat,nf_conntrack_ipv4,nf_conntrack
iptable_filter          5472  1
ip_tables              22247  2 iptable_nat,iptable_filter
x_tables               22939  9 
ipt_MASQUERADE,ipt_REJECT,ipt_owner,xt_state,xt_tcpudp,ipt_LOG,xt_limit,iptable_nat,ip_tables
ipv6                  286029  10


Any idea is still warmly welcomed :-)
Phil