Newbie OpenVPN iptables question

[Leftie]

The company I am with enlisted me to move their OpenVPN server. This is my first time working with OpenVPN and iptables.

In configuring the iptables for OpenVPN I had planed on copying the /etc/sysconf/iptables file from the old server to the new server. Of course that did not work and I am getting an error when iptables-restore runs with the old file. I started adding the rules in one by one from the command line. All the nat filters went in with out a problem. The one thing I can not figure out is how to add the line in the /etc/sysconf/iptables that contain RH-Firewall-1-INPUT from the command line.

How do I get the lines that include RH-Firewall-1-INPUT into the /etc/sysconf/iptables file?

Thanks

[cr4ck3r]

I did not see any related issue between OpenVPN and Iptables. What is your problem?
I've successfully installed OpenVPN in my company, usually, you have to modify the firewall rule to make it work.
I assume you are using bridging VPN (ie. tun interface).
On the server, enter those command

iptables -I INPUT -i tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -j ACCEPT
iptables -I INPUT -o tun0 -j ACCEPT
iptables -I OUTPUT -i tun0 -j ACCEPT

Do the same on the client.
Those rules just make OpenVPN to work, but they are INSECURE. You should modify these rules into stricter ones.
Hope this may help.

[Leftie]

The problem is I can not get to the internal network once I connect to OpenVPN. From what I have read the firewall has to set up correctly before the routing works.

I have entered the commands below with no success.

iptables -I INPUT -i tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -j ACCEPT
iptables -I INPUT -o tun0 -j ACCEPT
iptables -I OUTPUT -i tun0 -j ACCEPT

My company is asking for a redundant VPN connection so this new server has to be a match to the current server.

Thanks for the input, Leftie

[David Becker]

Originally Posted by Leftie

The problem is I can not get to the internal network once I connect to OpenVPN. From what I have read the firewall has to set up correctly before the routing works.

Are you pushing your internal network's IP network to the clients? 'push-route internal_network' in your server's config file.

David

[Leftie]

Originally Posted by David Becker

Are you pushing your internal network's IP network to the clients? 'push-route internal_network' in your server's config file.

David

Yes, I am getting the proper IP address on the client.

[David Becker]

Originally Posted by Leftie

Yes, I am getting the proper IP address on the client.

I wasn't referring to the host ip address (if that's what you're referring to). In other words, is your client receiving the network address of the remote network and updating it's routing tables?

Does

netstat -nr

on the client show the remote network?

David