Необходимо создать VPN при котором Windows XP будет видеть сеть за Debian.
Подключение есть, windows пингует внутренний адрес debiana (х.х.х.244) и dns сервер (х.х.х.242) остальные адреса не пингует, в чем косяк?
Вот конфиги:
сервер openvpn
Код: Выделить всё
port 1194
proto udp
dev tun0
ca keys/mimvpn/ca.crt
cert keys/mimvpn/mim-server.crt
key keys/mimvpn/mim-server.key
dh keys/mimvpn/dh2048.pem
server 192.168.254.0 255.255.255.0
crl-verify keys/mimvpn/crl.pem
cipher AES-128-CBC
user nobody
group nogroup
status servers/changeme/logs/openvpn-status.log
log-append servers/changeme/logs/openvpn.log
verb 2
mute 20
max-clients 100
management 127.0.0.1 12345
keepalive 10 120
client-config-dir /etc/openvpn/servers/changeme/ccd
comp-lzo
persist-key
persist-tun
ccd-exclusive
push "redirect-gateway"Код: Выделить всё
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.254.2 * 255.255.255.255 UH 0 0 0 tun0
195.122.254.0 * 255.255.255.192 U 0 0 0 eth1
localnet * 255.255.255.0 U 0 0 0 eth0
192.168.254.0 192.168.254.2 255.255.255.0 UG 0 0 0 tun0
192.168.254.0 * 255.255.255.0 U 0 0 0 eth1
default 195.122.254.1 0.0.0.0 UG 0 0 0 eth1
Код: Выделить всё
*nat
:PREROUTING ACCEPT [6:599]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
# rdp
#-A PREROUTING -i eth1 -p tcp -m tcp --dport 3389 -j DNAT --to-destination 192.168.0.252:3389
-A PREROUTING -p tcp -i eth1 --dport 3389 -j DNAT --to-destination 192.168.0.242:3389
#-A PREROUTING -i eth1 -p tcp -m tcp --dport 1723 -j DNAT --to-destination 192.168.0.250:1723
###########VPN######################
-A PREROUTING -i eth1 -p tcp -m tcp --dport 1194 -j DNAT --to-destination 192.168.0.252:1194
#-A PREROUTING -i eth1 -p tcp -m tcp --dport 1195 -j DNAT --to-destination 192.168.0.253:1195
#-A PREROUTING -i eth1 -p tcp -m tcp --dport 1723 -j DNAT --to-destination 192.168.0.250:1723
#-A PREROUTING -p tcp -i eth1 --dport 3389 -j DNAT --to-destination 192.168.0.242:3389
#masq
-A POSTROUTING -s 192.168.0.0/24 -j MASQUERADE
COMMIT
*filter
:FORWARD DROP [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
# Keep state.
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# http/https, smtp/smtps, pop3/pop3s, imap/imaps, ssh
-A INPUT -p tcp -m multiport --dport 80,443,25,465,110,995,143,993,587,465,22,87,1024 -j ACCEPT
# Loop device.
-A INPUT -i lo -j ACCEPT
# Allow PING from remote hosts.
-A INPUT -p icmp -s 192.168.0.0/24 --icmp-type echo-request -j ACCEPT
# proxy
-A INPUT -p tcp -m tcp -s 192.168.0.0/24 --dport 8080 -j ACCEPT
# http/https
-A INPUT -p tcp -m multiport --dport 80,443 -j ACCEPT
# VPN and Aster
-A INPUT -p tcp -m multiport --dport 1194,1195,4445,5060,5061,5062 -j ACCEPT
# smtp/smtps
-A INPUT -p tcp -m multiport --dport 25,465 -j ACCEPT
# pop3/pop3s
-A INPUT -p tcp -m multiport --dport 110,995 -j ACCEPT
# imap/imaps
-A INPUT -p tcp -m multiport --dport 143,993 -j ACCEPT
# ldap/ldaps
-A INPUT -p tcp -m multiport -s 192.168.0.0/24 --dport 389,636 -j ACCEPT
# ftp.
-A INPUT -p tcp -m multiport --dport 21,20 -j ACCEPT
# rdp
-A INPUT -p tcp --dport 3389 -j ACCEPT
-A INPUT -p gre -i eth0 -j ACCEPT
-A INPUT -p gre -i eth1 -j ACCEPT
-A INPUT -p gre -i eth2 -j ACCEPT
-A INPUT -p tcp --dport 9999 -j ACCEPT
# AT
-A FORWARD -p udp --dport 87 -j ACCEPT
-A FORWARD -p udp --sport 87 -j ACCEPT
-A FORWARD -p tcp --dport 87 -j ACCEPT
-A FORWARD -p tcp --sport 87 -j ACCEPT
-A FORWARD -p tcp --dport 1723 -j ACCEPT
-A FORWARD -p tcp --dport 443 -j ACCEPT
-A FORWARD -p tcp --sport 443 -j ACCEPT
-A FORWARD -p tcp --sport 1723 -j ACCEPT
-A FORWARD -p udp --dport 1701 -j ACCEPT
-A FORWARD -p udp --sport 1701 -j ACCEPT
-A FORWARD -p udp --dport 500 -j ACCEPT
-A FORWARD -p udp --sport 500 -j ACCEPT
# ########################################### ##########################################
-A FORWARD -p tcp -m multiport --sport 25,53,443,4000,4901,4899,1723 -j ACCEPT
-A FORWARD -s 192.168.0.242 -j ACCEPT
-A FORWARD -d 192.168.0.242 -j ACCEPT
-A FORWARD -s 192.168.0.251 -j ACCEPT
-A FORWARD -s 192.168.0.249 -j ACCEPT
-A FORWARD -d 192.168.0.249 -j ACCEPT
-A FORWARD -s 192.168.0.241 -j ACCEPT
-A FORWARD -d 192.168.0.241 -j ACCEPT
-A FORWARD -s 192.168.0.252 -j ACCEPT
-A FORWARD -d 192.168.0.252 -j ACCEPT
-A FORWARD -i eth0 -j ACCEPT
-A FORWARD -o eth0 -j ACCEPT
#-A INPUT -p udp -m udp -i eth1 --sport 7777 -j ACCEPT
COMMIT
# Generated by webmin
*mangle
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
# Completed
