PPTP has No Internet Access after CSF enabled

GreenVine

I am installing PPTP on my CentOS 6.5 OpenVZ, it works fine if I disabled CSF and flush all iptables settings and run:

iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -j SNAT --to-source 12.12.34.56

(12.12.34.56 is my server primary IP)

However if I enable CSF, VPN connection can still be connected, but no Internet Access.

I tried to figure out this issue by adding the code mentioned above into csfpre.sh, but still no success.

How I can solve this problem?

Thanks!

ATHK

This is probably over kill but this is my csfpre.sh

iptables -A INPUT -i venet0 -p tcp --dport 1723 -j ACCEPT 
iptables -A INPUT -i venet0 -p gre -j ACCEPT 
iptables -t nat -A POSTROUTING -o venet0 -j MASQUERADE 
iptables -A FORWARD -i ppp+ -o venet0 -j ACCEPT 
iptables -A FORWARD -i venet0 -o ppp+ -j ACCEPT 

iptables -A INPUT -i eth0 -p tcp --dport 1723 -j ACCEPT 
iptables -A INPUT -i eth0 -p gre -j ACCEPT 
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE 
iptables -A FORWARD -i ppp+ -o eth0 -j ACCEPT 
iptables -A FORWARD -i eth0 -o ppp+ -j ACCEPT 

iptables -t nat -A POSTROUTING -j SNAT --to YOURIP
iptables -A INPUT -p 47 -j ACCEPT

This was the only way I could get it to work for me, make sure those ports are allowed in csf.conf

GreenVine

@ATHK said:
This is probably over kill but this is my csfpre.sh

iptables -A INPUT -i venet0 -p tcp --dport 1723 -j ACCEPT 
iptables -A INPUT -i venet0 -p gre -j ACCEPT 
iptables -t nat -A POSTROUTING -o venet0 -j MASQUERADE 
iptables -A FORWARD -i ppp+ -o venet0 -j ACCEPT 
iptables -A FORWARD -i venet0 -o ppp+ -j ACCEPT 

iptables -A INPUT -i eth0 -p tcp --dport 1723 -j ACCEPT 
iptables -A INPUT -i eth0 -p gre -j ACCEPT 
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE 
iptables -A FORWARD -i ppp+ -o eth0 -j ACCEPT 
iptables -A FORWARD -i eth0 -o ppp+ -j ACCEPT 

iptables -t nat -A POSTROUTING -j SNAT --to YOURIP
iptables -A INPUT -p 47 -j ACCEPT

This was the only way I could get it to work for me, make sure those ports are allowed in csf.conf

Well I tried your script and successed. Thanks for your help:D

ATHK

Brilliant! Just don't ask me why! I gathered information off various sites when googling, that was the only combination that worked for me.

GreenVine

ATHK said: Brilliant! Just don't ask me why! I gathered information off various sites when googling, that was the only combination that worked for me.

Well I think it is possible to remove all lines related to venet0, as I do not have such network device on the server?

imchandave

Probably CSF didn't add in the IPTable rule to allow GRE protocol or it defaults to allow only white-listed protocols.

When you added

iptables -A INPUT -i eth0 -p gre -j ACCEPT

or

iptables -A INPUT -p 47 -j ACCEPT
(most likely this one...a more general version of the previous rule)

you allowed GRE packets to properly pass into your IPTables processing engine.

See ya...

d.c.

GreenVine

Well I am experiencing another issue:(

The VPN keep running for 2 days and no settings edited, but today I got 619 Error when connecting. I can connect to another server's PPTP VPN anyway.

How to address this issue?

Thanks:D