Open VPN routing hiba HELP! [MEGOLDVA]

Sajna, ez nem segít.

Kösz az ötletet, itt látok valami furcsát:
tun1:
12:20:11.699735 IP 10.9.9.6 > gray: ICMP echo request, id 1024, seq 4608, length 40
12:20:11.699803 IP gray > 10.9.9.6: ICMP echo reply, id 1024, seq 4608, length 40
12:20:12.699483 IP 10.9.9.6 > gray: ICMP echo request, id 1024, seq 4864, length 40
12:20:12.699531 IP gray > 10.9.9.6: ICMP echo reply, id 1024, seq 4864, length 40
12:20:13.699413 IP 10.9.9.6 > gray: ICMP echo request, id 1024, seq 5120, length 40
12:20:13.699448 IP gray > 10.9.9.6: ICMP echo reply, id 1024, seq 5120, length 40
12:20:14.699412 IP 10.9.9.6 > gray: ICMP echo request, id 1024, seq 5376, length 40
12:20:14.699445 IP gray > 10.9.9.6: ICMP echo reply, id 1024, seq 5376, length 40
12:20:18.860470 IP 10.9.9.6 > dev: ICMP echo request, id 1024, seq 5632, length 40
12:20:24.016105 IP 10.9.9.6 > dev: ICMP echo request, id 1024, seq 5888, length 40
12:20:29.001277 IP 10.9.9.6 > dev: ICMP echo request, id 1024, seq 6144, length 40
12:20:34.511042 IP 10.9.9.6 > dev: ICMP echo request, id 1024, seq 6400, length 40
eth1:
12:25:50.803311 IP 10.9.9.6 > dev: ICMP echo request, id 1024, seq 8704, length 40
12:25:50.803702 IP dev > 10.9.9.6: ICMP echo reply, id 1024, seq 8704, length 40
12:25:55.923621 IP 10.9.9.6 > dev: ICMP echo request, id 1024, seq 8960, length 40
12:25:55.923877 IP dev > 10.9.9.6: ICMP echo reply, id 1024, seq 8960, length 40
12:26:00.944129 IP 10.9.9.6 > dev: ICMP echo request, id 1024, seq 9216, length 40
12:26:00.944451 IP dev > 10.9.9.6: ICMP echo reply, id 1024, seq 9216, length 40
12:26:05.954600 IP 10.9.9.6 > dev: ICMP echo request, id 1024, seq 9472, length 40
12:26:05.954927 IP dev > 10.9.9.6: ICMP echo reply, id 1024, seq 9472, length 40

Az első esetben a VPN szervert pingeltem (gray) 4x, utána egy másik gépet (dev) a belső hálón. eth1-ről nem jött vissza tun1-re.

Hogy miért, nem tudom.

Ide teszem még a tűzfal szkriptet:
#!/bin/sh

# $Id: firewall.ini 120 2006-09-21 22:17:36Z root $

# If you want the box to just act as a router, uncomment the 2 lines below
#echo 1 > /proc/sys/net/ipv4/ip_forward
#exit 0

#
# Firewall setup.
#
OUTSIDE_DEVICE=eth0
INSIDE_DEVICE=eth1
INSIDE_NETWORK=10.9.10.0
INSIDE_NETMASK=255.255.255.0
SVN_SERVER_IP=10.9.10.50
#VPN_SERVER_IP=10.9.10.30

#
# Do you want to do port forwaring to an internal server?
# Set the server IP here and sort out the port stuff later in this file.
#
##SERVER_IP=10.42.42.42

#
# Stopping forwarding (this script may be run during normal uptime because
# for re-lease of HDCP or demand dialing / PPPoE.
#
echo "0" > /proc/sys/net/ipv4/ip_forward

#
# Brad suggested this:
# And he suggested to check and maybe change the formatting.
# We'll do that later.
#
#echo "Starting firewall with the following config:"
#printf "\t\t Inside\t\tOutside
# Physical device: %-15s\t%-15s
# Logical device: %-15s\t%-15s
#\t Network: %-15s\t%-15s
# IP Address: %-15s\t%-15s
#\t Netmask: %-15s\t%-15s
# Broadcast: %-15s\t%-15s
#\t Gateway: %-15s\t%-15s\n" $INSIDE_DEV $OUTSIDE_DEV \
# $INSIDE_DEVICE $OUTSIDE_DEVICE \
# $INSIDE_NETWORK $OUTSIDE_NETWORK \
# $INSIDE_IP $OUTSIDE_IP \
# $INSIDE_NETMASK $OUTSIDE_NETMASK \
# $INSIDE_BROADCAST $OUTSIDE_BROADCAST \
# "[None Set]" $OUTSIDE_GATEWAY
#
#
# Flushing the chains.
#

iptables -F
iptables -X
iptables -Z
for i in `cat /proc/net/ip_tables_names`
do
iptables -F -t $i
iptables -X -t $i
iptables -Z -t $i
done

#
# Policy for chains DROP everything
#

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

#
# SYN-Flooding protection
# Looks good and nicked from a firewall script mentioned on floppyfw.something.
# Didn't work that well..
#
iptables -N syn-flood
iptables -A INPUT -i ${OUTSIDE_DEVICE} -p tcp --syn -j syn-flood
iptables -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN
iptables -A syn-flood -j DROP
# Make sure NEW tcp connections are SYN packets
iptables -A INPUT -i ${OUTSIDE_DEVICE} -p tcp ! --syn -m state --state NEW -j DROP

#
# Good old masquerading.
#
iptables -t nat -A POSTROUTING -s ${INSIDE_NETWORK}/${INSIDE_NETMASK} -o ${OUTSIDE_DEVICE} -j MASQUERADE

#
# Forwarding outside ports to an internal server.
# This used to be the ipchains / ipmasqadm portfw commad.
#
# SVN:

iptables -A PREROUTING -t nat -p tcp -i ${OUTSIDE_DEVICE} --dport 3690 -j DNAT --to ${SVN_SERVER_IP}:3690
iptables -A FORWARD -p tcp -d ${SVN_SERVER_IP} --dport 3690 -o ${INSIDE_DEVICE} -j ACCEPT

## VPN:
#
#iptables -A PREROUTING -t nat -p udp -i ${OUTSIDE_DEVICE} --dport 1194 -j DNAT --to ${VPN_SERVER_IP}:1194
#iptables -A FORWARD -p udp -d ${VPN_SERVER_IP} --dport 1194 -o ${INSIDE_DEVICE} -j ACCEPT
#

# SSH:

#iptables -A PREROUTING -t nat -p tcp -d ${OUTSIDE_IP} --dport 22 -j DNAT --to ${SERVER_IP}:22
#iptables -A FORWARD -p tcp -d ${SERVER_IP} --dport 22 -o ${INSIDE_DEVICE} -j ACCEPT

# Web:
#iptables -A PREROUTING -t nat -p tcp -d ${OUTSIDE_IP} --dport 80 -j DNAT --to ${SERVER_IP}:80
#iptables -A FORWARD -p tcp -d ${SERVER_IP} --dport 80 -o ${INSIDE_DEVICE} -j ACCEPT
# This rule helps the "I can't reach my web server from the inside" problem.
#iptables -A POSTROUTING -t nat -p tcp -d ${SERVER_IP} --dport 80 -s ${INSIDE_NETWORK}/${INSIDE_NETMASK} -j SNAT --to ${OUTSIDE_IP}

# FTP:

#iptables -A PREROUTING -t nat -p tcp -d ${OUTSIDE_IP} --dport 21 -j DNAT --to ${SERVER_IP}:21
#iptables -A FORWARD -p tcp -d ${SERVER_IP} --dport 21 -o ${INSIDE_DEVICE} -j ACCEPT

# SMTP (Internal mail server):
#iptables -A PREROUTING -t nat -p tcp -d ${OUTSIDE_IP} --dport 25 -j DNAT --to ${SERVER_IP}:25
#iptables -A FORWARD -p tcp -d ${SERVER_IP} --dport 25 -o ${INSIDE_DEVICE} -j ACCEPT
# This rule helps the "I can't reach my server from the inside" problem.
#iptables -A POSTROUTING -t nat -p tcp -d ${SERVER_IP} --dport 25 -s ${INSIDE_NETWORK}/${INSIDE_NETMASK} -j SNAT --to ${OUTSIDE_IP}

##############################################################################################################################################
# Allow incoming OpenVPN packets
# Duplicate the line below for each
# OpenVPN tunnel, changing --dport n
# to match the OpenVPN UDP port.
#
# In OpenVPN, the port number is
# controlled by the --port n option.
# If you put this option in the config
# file, you can remove the leading '--'
#
# If you taking the stateful firewall
# approach (see the OpenVPN HOWTO),
# then comment out the line below.

iptables -A INPUT -p tcp --dport 1194 -j ACCEPT
iptables -A INPUT -p udp --dport 1194 -j ACCEPT

# Allow packets from TUN/TAP devices.
# When OpenVPN is run in a secure mode,
# it will authenticate packets prior
# to their arriving on a tun or tap
# interface. Therefore, it is not
# necessary to add any filters here,
# unless you want to restrict the
# type of packets which can flow over
# the tunnel.

iptables -A INPUT -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -j ACCEPT
iptables -A INPUT -i tap+ -j ACCEPT
iptables -A FORWARD -i tap+ -j ACCEPT
###################################################################################################################################################

#
# Keep state and open up for outgoing connections.
#
iptables -A FORWARD -m state --state NEW -i ${INSIDE_DEVICE} -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state NEW,INVALID -i ${OUTSIDE_DEVICE} -j DROP

#
# This is mainly for PPPoE usage but it won't hurt anyway so we'll just
# keep it here.
#
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

#
# We don't like the NetBIOS and Samba leaking..
#
#iptables -t nat -A PREROUTING -p TCP --dport 135:139 -j DROP
#iptables -t nat -A PREROUTING -p UDP --dport 137:139 -j DROP
#iptables -t nat -A PREROUTING -p TCP --dport 445 -j DROP
#iptables -t nat -A PREROUTING -p UDP --dport 445 -j DROP
#

#
# We would like to ask for names from our floppyfw box
#
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

# Ping and friends.
iptables -A OUTPUT -p icmp -j ACCEPT # to both sides.
iptables -A INPUT -p icmp -j ACCEPT

# And also, DHCP, but we can basically accept anything from the inside.
iptables -A INPUT -i ${INSIDE_DEVICE} -j ACCEPT
iptables -A OUTPUT -o ${INSIDE_DEVICE} -j ACCEPT
# And also accept talking to ourself.
iptables -A INPUT -i lo -j ACCEPT

#
# If the user wants to have the fake identd running, the identd has to
# be able to answer.
#
#if [ ${FAKEIDENT} ]
#then
# iptables -A INPUT -p TCP --dport 113 -i ${OUTSIDE_DEVICE} -j ACCEPT
#else
# iptables -A INPUT -p TCP --dport 113 -i ${OUTSIDE_DEVICE} -j REJECT --reject-with tcp-reset
#fi

#
# Forwarding SIP and VoIP rtp ports for PHONE_IP in config
#
#if [ -n "$PHONE_IP" ] && [ "$WONDER_SHAPER" = "y" ] && [ -n "$RT10" ]
#then
# if [ -n "$INTPORTS" ] && [ "$FORWARD_SIP" = "y" ]
# then
# echo "Enabling port forwarding for SIP INTPORTS setup in config"
# for a in $INTPORTS
# do
# iptables -A PREROUTING -t nat -p UDP -d ${OUTSIDE_IP} --dport $a -j DNAT --to ${PHONE_IP}:$a
# iptables -A FORWARD -p UDP -d ${PHONE_IP} --dport $a -o ${INSIDE_DEVICE} -j ACCEPT
# done
# fi
# if [ -n "$LO_RTPPORT" ] && [ -n "$HI_RTPPORT" ] && [ "$FORWARD_RTP" = "y" ]
# then
# echo "Enabling port forwarding for RTP port range setup in config"
# iptables -A PREROUTING -t nat -p UDP -d ${OUTSIDE_IP} --dport "$LO_RTPPORT":"$HI_RTPPORT" -j DNAT --to ${PHONE_IP}:"$LO_RTPPORT"-"$HI_RTPPORT"
# iptables -A FORWARD -p UDP -d ${PHONE_IP} --dport "$LO_RTPPORT":"$HI_RTPPORT" -o ${INSIDE_DEVICE} -j ACCEPT
# fi
#else
# echo "VOIP support disabled, PHONE_IP or RT10 not set or WONDER_SHAPER=n in config."
#fi

#
# Running extra scripts.
#
#for i in /etc/firewall/*
# do
# if [ -f $i ]
# then
# sh $i $1
# fi
#done

#
# This will also help:
# It does look weird but it is explained here:
# http://lartc.org/howto/lartc.qdisc.classless.html
#
# The "240Kbit" rate should be set at "a tad less than the speedn you have"
# 240Kbit is for my 256Kbit "upload"-link.
#
# tc qdisc add dev $OUTSIDE_DEVICE root tbf rate 240kbit latency 50ms burst 1540

# Or maybe you chose to use Wondershaper?
#if [ $WONDER_SHAPER = "y" ]
#then
# /sbin/wshaper.htb
#else
# #
# # And, some attempt to get interactive sesions a bit more interactive
# # under load:
# #
# iptables -A PREROUTING -t mangle -p tcp --sport ssh -j TOS --set-tos Minimize-Delay
# iptables -A PREROUTING -t mangle -p tcp --sport ftp -j TOS --set-tos Minimize-Delay
# # iptables -A PREROUTING -t mangle -p tcp --sport ftp-data -j TOS --set-tos Maximize-Throughput
#
#fi

#
# Finally, list what we have
#
#
iptables -L

# If broken DNS:
#iptables -L -n

#
# The insert stuff into the kernel (ipsysctl) - section:
#
# Some of there goes under the "Better safe than sorry" - banner.
#

#
# This enables dynamic IP address following
#
echo 7 > /proc/sys/net/ipv4/ip_dynaddr

#
# trying to stop some smurf attacks.
#
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

#
# Don't accept source routed packets.
#
/bin/echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route

#
# Syncookies (if they are really needed any more?)
#
echo "1" > /proc/sys/net/ipv4/tcp_syncookies

#
# We don't like IP spoofing,
#
if [ -f /proc/sys/net/ipv4/conf/all/rp_filter ]
then
# These two are redundant but I'll kepp'em here for now.
# Will remind me that I can add the first one somewhere smart later.
echo "1" > /proc/sys/net/ipv4/conf/default/rp_filter
echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter

# while read filter
# do
# echo "1" > $filter
# done < `find /proc/sys/net/ipv4/conf -name rp_filter -print`
else
echo "Anti spoofing is not available, the author of this floppy spoofed, mail him."
fi

#
# nor ICMP redirect,
#

if [ -f /proc/sys/net/ipv4/conf/all/accept_redirects ]
then
echo "0" > /proc/sys/net/ipv4/conf/default/accept_redirects
echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects

# while read accr
# do
# echo -n "fil"
# echo $accr
# echo "fil2"
# echo "0" > $accr
# done < `find /proc/sys/net/ipv4/conf -name accept_redirects -print`

else
echo "Anti spoofing is not available, the author of this floppy spoofed, mail him."
fi

#stop arp request from other interfaces
for i in /proc/sys/net/ipv4/conf/*
do
echo 1 > $i/arp_filter
done

#
# Enable bad error message protection.
#
/bin/echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses

# Maximum limit of ip_conntrack
# This is RAM dependant so be careful with this.
# The max, which is the valuehere, needs around 32M RAM to work properly.
# echo "65535" > /proc/sys/net/ipv4/ip_conntrack_max

# This is commented out and will be an option when we have a "LOG_STUFF"
# config option.
# /bin/echo "1" > /proc/sys/net/ipv4/conf/all/log_martians

# Ming-Ching Tiew
# Made this one for me.

# The amount to reserve is an option in config.
#reserve=`expr $RESERVE_MB \* 1048576`
##bytes per conntrack, should be kernel specific
#per_con=328
#curmax=` cat /proc/sys/net/ipv4/netfilter/ip_conntrack_max `
#set -- ` cat /proc/meminfo`
#incre=` expr \( $10 - $reserve \) / $per_con`
#new_max=` expr $curmax + $incre`
#[ $new_max -ge 65535 ] && new_max=65535
#echo "Setting ip_conntrack_max to $new_max"
#echo $new_max > /proc/sys/net/ipv4/netfilter/ip_conntrack_max

#
# Rules set, we can enable forwarding in the kernel.
#
echo "Enabling IP forwarding."

echo "1" > /proc/sys/net/ipv4/ip_forward

Belső gépről (pl backup 10.9.10.30) meg tudom pingelni a 10.9.9.6 címen bekonnektált VPN klienst. (A vpn szerver 10.9.10.41)

!!!!!!!
A VPN kliensről is meg tudom pingelni a 10.9.10.30-at, és még egy másikat is (10.9.30.174)!!!
Néhányat pedig nem (pl. 10.9.10.1, 10.9.10.50, 10.9.10.165)

Nem értem!
!!!!!

Kösz, de nem ez a baj. A kliensek nem látják a belső háló összes elemét.

Nincs újabb ötlet?