Estou tentando fazer isso com OpenVPN TUN em uma instância Azure Linux :
-=Android Client=- --> -=VPS=- --> -=Internet=-
O cliente se conecta, mas não tem acesso à Internet.
Comandos do Iptables
iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o eth0 -j SNAT --to 191.236.xxx.xxx
(ip de internet virtual público do azure)
iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o eth0 -j SNAT --to 100.75.xxx.xxx
(o ip de eth0 de ifconfig - ip azure interno)
Saída do Iptables
# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
SNAT all -- 10.0.0.0/24 anywhere to:191.236.xxx.xxx
SNAT all -- 10.0.0.0/24 anywhere to:191.236.xxx.xxx
SNAT all -- 10.0.0.0/24 anywhere to:191.236.xxx.xxx
SNAT all -- 10.0.0.0/24 anywhere to:191.236.xxx.xxx
SNAT all -- 10.0.0.0/24 anywhere to:100.75.xxx.xxx
Encaminhamento
# cat /etc/sysctl.conf | grep forw
net.ipv4.ip_forward=1
server.conf
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.8.0.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
tls-auth ta.key 0
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
Syslog
Nov 2 17:19:58 azu-1 ovpn-server[1711]: 109.242.144.133:11810 [azu1-mx4] Peer Connection Initiated with [AF_INET]109.242.144.133:11810
Nov 2 17:19:58 azu-1 ovpn-server[1711]: azu1-mx4/109.242.144.133:11810 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Nov 2 17:19:58 azu-1 ovpn-server[1711]: azu1-mx4/109.242.144.133:11810 MULTI: Learn: 10.8.0.6 -> azu1-mx4/109.242.144.133:11810
Nov 2 17:19:58 azu-1 ovpn-server[1711]: azu1-mx4/109.242.144.133:11810 MULTI: primary virtual IP for azu1-mx4/109.242.144.133:11810: 10.8.0.6
Nov 2 17:19:59 azu-1 ovpn-server[1711]: azu1-mx4/109.242.144.133:11810 PUSH: Received control message: 'PUSH_REQUEST'
Nov 2 17:19:59 azu-1 ovpn-server[1711]: azu1-mx4/109.242.144.133:11810 send_push_reply(): safe_cap=940
Nov 2 17:19:59 azu-1 ovpn-server[1711]: azu1-mx4/109.242.144.133:11810 SENT CONTROL [azu1-mx4]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
O que estou fazendo de errado?
Bem, isso foi sorte - encontrei uma solução rápida:)
Postar no caso de alguém se beneficiar - isso é o que funcionou para mim:
iptables -A INPUT -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
Tags networking vpn openvpn iptables linux