26 Sep
2015
26 Sep
'15
9:14 p.m.
Hi Martijn,
On Sat, Sep 26, 2015 at 08:45:13PM +0000, Martijn Grooten wrote:
Following the recent upgrade and reboot of my Bitfolk
server, OpenVPN
had stopped working. (I don't use it very often on that server; hence I
hadn't noticed.)
Incidentally, and not meant as a criticism for you as clearly you
knew how to debug this: the notifications about enforced reboots
suggest that you reboot your VPS yourself to check it boots cleanly.
This is an example of why that can be useful, as it might be good to
discover that (for example) your VPN doesn't work at a time when
you're ready to debug it as opposed to at some random other time. :)
echo 1 > /proc/sys/net/ipv4/ip_forward
modprobe tun
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
/etc/init.d/openvpn restart
Not sure if all of these were needed - the iptables one definitely was
as that was the one that fixed it.
I'm not a recent user of openvpn but I suspect the restart of it was
not necessary: the other things cause packets to be dropped by
either the kernel's routing table or by the kernel's IP filtering,
so probably just they alone caused things to not work.
Is there an easy way to make these changes permanent
so that they will
survive a future reboot?
Is this on Debian?
If so then I'd be inclined to put the /proc/sys/net/ipv4/ip_forward
part into the relevant interface stanza in /etc/network/interfaces,
e.g:
auto eth0
iface eth0 inet static
address 85.119.82.xyz
netmask 255.255.248.0
gateway 85.119.80.1
pre-up echo 1 > /proc/sys/net/ipv4/ip_forward
pre-up modprobe tun
However, things under /proc/sys have their own tool in "sysctl", so
a neater way to do this might be:
auto eth0
iface eth0 inet static
address 85.119.82.xyz
netmask 255.255.248.0
gateway 85.119.80.1
pre-up sysctl -w net.ipv4.ip_forward=1
pre-up modprobe tun
I personally would use either of those two ways as it links the act
of enabling IP forwarding with the bringing up of eth0.
As this is sysctl though, some people would choose to use Debian's
other way of persisting sysctl changes, which is to either put the
setting in /etc/sysctl.conf, or else as a file under /etc/sysctl.d,
for example:
/etc/sysctl.d/local-enable-ip-forwarding.conf:
net.ipv4.ip_forward=1
See man sysctl and man sysctl.conf.
That's down to taste, I think.
As for the iptables rule, if you already have a way of persisting
iptables rules (something that uses iptables-save and
iptables-restore) then use that. Otherwise it can also go in the
/etc/network/interfaces file:
auto eth0
iface eth0 inet static
address 85.119.82.xyz
netmask 255.255.248.0
gateway 85.119.80.1
pre-up sysctl -w net.ipv4.ip_forward=1
pre-up modprobe tun
pre-up iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
By the way, those three pre-up commands could be put inside a single
shell script placed in /etc/network/if-pre-up.d/ and then nothing
would need to be explicitly added to /etc/network/interfaces. If you
do this, bear in mind that such a script would be called every time
*any* interface was about to be brought up, so inside the script you
might wish to test the contents of the $IFACE variable to check it
is "eth0" or whatever. Dee man interfaces for details.
If not Debian/Ubuntu, well, I dunno. This is distribution-specific.
:)
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting