I’ve a small server which acts as an OpenVPN server and a ZNC server, amongst different issues. The ZNC server runs in a docker container and is accessible domestically by way of the server host IP.
Server IP: 172.12.0.118
Server Area Title: vswitch0.lan
OpenVPN community: 10.8.0.0/32
ZNC container IP: 192.192.24.24
ZNC Port: 6501 / UDP
So, domestically I’d mainly connect with the ZNC server by way of vswitch0.lan:6501. Sadly it doesn’t matter what I’ve tried thus far, 6501 seems to be to be closed from behind the VPN.
Some context from the server facet:
[vswitch0:~$ sudo iproute show default via 172.12.0.1 dev eth0 metric 202
10.8.0.0/24 via 10.8.0.2 dev tun0
10.8.0.2 dev tun0 scope link src 10.8.0.1
172.12.0.0/24 dev eth0 scope link src 172.12.0.118
172.12.1.0/24 dev eth1 scope link src 172.12.1.1
172.17.0.0/16 dev docker0 scope link src 172.17.0.1
192.192.24.0/24 dev br-c36ba2fb1e97 scope link src 192.192.24.1 vswitch0:~$
vswitch0:~$ ifconfig br-c36ba2fb1e97 Link encap:Ethernet HWaddr 02:42:3A:17:A0:E7
inet addr:192.192.24.1 Bcast:192.192.24.255 Mask:255.255.255.0
inet6 addr: fe80::42:3aff:fe17:a0e7/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:322161 errors:0 dropped:0 overruns:0 frame:0
TX packets:421089 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:31076090 (29.6 MiB) TX bytes:58399390 (55.6 MiB)
docker0 Link encap:Ethernet HWaddr 02:42:4F:64:2E:A2
inet addr:172.17.0.1 Bcast:172.17.255.255 Mask:255.255.0.0
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
eth0 Link encap:Ethernet HWaddr 00:0C:29:DA:E9:5A
inet addr:172.12.0.118 Bcast:172.12.0.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:feda:e95a/64 Scope:Link
inet6 addr: fd51:1367:3bc8:59a0:20c:29ff:feda:e95a/64 Scope:Global
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:2860148 errors:0 dropped:465598 overruns:0 frame:463
TX packets:1922097 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1489537504 (1.3 GiB) TX bytes:1374257854 (1.2 GiB)
eth1 Link encap:Ethernet HWaddr FE:AD:82:55:02:0E
inet addr:172.12.1.1 Bcast:0.0.0.0 Mask:255.255.255.0
inet6 addr: fe80::fcad:82ff:fe55:20e/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:282 errors:0 dropped:0 overruns:0 frame:0
TX packets:421 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:19740 (19.2 KiB) TX bytes:25994 (25.3 KiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:8 errors:0 dropped:0 overruns:0 frame:0
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:468 (468.0 B) TX bytes:468 (468.0 B)
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255
inet6 addr: fe80::2aeb:2647:2f9a:57b6/64 Scope:Link
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1470 Metric:1
RX packets:42219 errors:0 dropped:0 overruns:0 frame:0
TX packets:49207 errors:0 dropped:589 overruns:0 carrier:0
collisions:0 txqueuelen:2000
RX bytes:25138666 (23.9 MiB) TX bytes:49238186 (46.9 MiB)
vethb25d25a Link encap:Ethernet HWaddr B6:43:96:F6:F4:FD
inet6 addr: fe80::b443:96ff:fef6:f4fd/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:322161 errors:0 dropped:0 overruns:0 frame:0
TX packets:421379 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:35586344 (33.9 MiB) TX bytes:58419786 (55.7 MiB)
vswitch0:~$
iptables rules
/home/admin # iptables -t nat -L -n -v
Chain PREROUTING (policy ACCEPT 2393K packets, 394M bytes)
pkts bytes target prot opt in out source destination
441 28422 DNAT 6 -- * * 172.12.0.0/24 172.12.0.118 tcp dpt:6501 to:192.192.24.24:6501
7 420 DNAT 6 -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:6501 to:172.12.0.21:6501
202 83466 DOCKER 0 -- * * 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type LOCAL
Chain INPUT (policy ACCEPT 711K packets, 114M bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 27850 packets, 1842K bytes)
pkts bytes target prot opt in out source destination
0 0 DOCKER 0 -- * * 0.0.0.0/0 !127.0.0.0/8 ADDRTYPE match dst-type LOCAL
Chain POSTROUTING (policy ACCEPT 1123 packets, 67032 bytes)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE 0 -- * !docker0 172.17.0.0/16 0.0.0.0/0
100 6012 MASQUERADE 0 -- * !br-c36ba2fb1e97 192.192.24.0/24 0.0.0.0/0
0 0 MASQUERADE 0 -- * eth1 10.8.1.0/24 0.0.0.0/0
0 0 MASQUERADE 0 -- * eth0 10.8.1.0/24 0.0.0.0/0
2 120 MASQUERADE 0 -- * eth1 10.8.0.0/24 0.0.0.0/0
6499 1829K MASQUERADE 0 -- * eth0 10.8.0.0/24 0.0.0.0/0
2119K 195M MASQUERADE 0 -- * eth0 0.0.0.0/0 0.0.0.0/0
14719 741K MASQUERADE 0 -- * eth1 0.0.0.0/0 0.0.0.0/0
77 5532 MASQUERADE 0 -- * eth0 172.12.0.0/24 0.0.0.0/0
77 5532 MASQUERADE 0 -- * eth1 172.12.1.0/24 0.0.0.0/0
689 43270 MASQUERADE 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain DOCKER (2 references)
pkts bytes target prot opt in out source destination
0 0 RETURN 0 -- docker0 * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN 0 -- br-c36ba2fb1e97 * 0.0.0.0/0 0.0.0.0/0
/home/admin # iptables -L -n -v
Chain INPUT (policy ACCEPT 2732K packets, 1566M bytes)
pkts bytes target prot opt in out source destination
10881 935K ACCEPT 0 -- tun+ * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy ACCEPT 835 packets, 45836 bytes)
pkts bytes target prot opt in out source destination
4930K 1167M DOCKER-USER 0 -- * * 0.0.0.0/0 0.0.0.0/0
4930K 1167M DOCKER-ISOLATION-STAGE-1 0 -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- * docker0 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 DOCKER 0 -- * docker0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- docker0 docker0 0.0.0.0/0 0.0.0.0/0
2596K 668M ACCEPT 0 -- * br-c36ba2fb1e97 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
3595K 1434M ACCEPT 0 -- * br-c36ba2fb1e97 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
713 50334 DOCKER 0 -- * br-c36ba2fb1e97 0.0.0.0/0 0.0.0.0/0
4973K 947M ACCEPT 0 -- br-c36ba2fb1e97 !br-c36ba2fb1e97 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- br-c36ba2fb1e97 br-c36ba2fb1e97 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- tun1 tun0 10.8.1.0/24 10.8.0.0/24 ctstate NEW
0 0 ACCEPT 0 -- tun1 eth1 10.8.1.0/24 0.0.0.0/0 ctstate NEW
0 0 ACCEPT 0 -- tun1 eth0 10.8.1.0/24 0.0.0.0/0 ctstate NEW
0 0 ACCEPT 0 -- tun1 eth0 10.8.1.0/24 172.12.0.0/24 ctstate NEW
2 120 ACCEPT 0 -- tun0 eth1 10.8.0.0/24 0.0.0.0/0 ctstate NEW
5890M 3889G ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
8811 2753K ACCEPT 0 -- tun0 eth0 10.8.0.0/24 0.0.0.0/0 ctstate NEW
0 0 ACCEPT 0 -- tun0 eth0 10.8.0.0/24 172.12.0.0/24 ctstate NEW
0 0 ACCEPT 0 -- tun0 eth1 10.8.0.0/24 172.12.1.0/24 ctstate NEW
0 0 ACCEPT 0 -- tun1 eth1 10.8.1.0/24 172.12.1.0/24 ctstate NEW
8 864 ACCEPT 0 -- * tun+ 0.0.0.0/0 0.0.0.0/0
203 9308 ACCEPT 0 -- tun+ * 0.0.0.0/0 0.0.0.0/0
321K 24M ACCEPT 0 -- eth1 eth0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- eth0 eth1 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
Chain OUTPUT (policy ACCEPT 1427K packets, 1087M bytes)
pkts bytes target prot opt in out source destination
10179 984K ACCEPT 0 -- * tun+ 0.0.0.0/0 0.0.0.0/0
Chain DOCKER (2 references)
pkts bytes target prot opt in out source destination
Chain DOCKER-ISOLATION-STAGE-1 (1 references)
pkts bytes target prot opt in out source destination
0 0 DOCKER-ISOLATION-STAGE-2 0 -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0
2181K 348M DOCKER-ISOLATION-STAGE-2 0 -- br-c36ba2fb1e97 !br-c36ba2fb1e97 0.0.0.0/0 0.0.0.0/0
4930K 1167M RETURN 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain DOCKER-ISOLATION-STAGE-2 (2 references)
pkts bytes target prot opt in out source destination
0 0 DROP 0 -- * docker0 0.0.0.0/0 0.0.0.0/0
0 0 DROP 0 -- * br-c36ba2fb1e97 0.0.0.0/0 0.0.0.0/0
2181K 348M RETURN 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain DOCKER-USER (1 references)
pkts bytes target prot opt in out source destination
11M 3751M RETURN 0 -- * * 0.0.0.0/0 0.0.0.0/0
/home/admin #
OpenVPN Server config
port 443
proto udp
dev tun0
fast-io
txqueuelen 2000
sndbuf 512000
rcvbuf 512000
push "sndbuf 512000"
push "rcvbuf 512000"
ca /etc/openvpn/keys/pki/ca.crt
cert /etc/openvpn/keys/pki/issued/OpenVPNsrv.crt
dh /etc/openvpn/keys/pki/dh2048.pem
key /etc/openvpn/keys/pki/private/OpenVPNsrv.key
tls-auth /etc/openvpn/keys/pki/tls-auth/ta.key 0 # As ca.crt, this is also shared with the client!
data-ciphers AES-256-GCM:AES-256-CBC
data-ciphers-fallback AES-256-GCM
server 10.8.0.0 255.255.255.0
askpass /etc/openvpn/ehmm.txt
push "redirect-gateway def1"
ifconfig-pool-persist ipp.txt
push "route 10.8.0.0 255.255.255.0"
push "route 172.12.0.0 255.255.255.0"
push "route 172.12.1.0 255.255.255.0"
push "route 192.192.24.0 255.255.255.0"
push "dhcp-option DNS 172.12.0.1"
push "dhcp-option DOMAIN .lan"
keepalive 10 120
user nobody
group nobody
persist-key
persist-tun
tun-mtu 1470
status /var/log/openvpn/status.log
log-append /var/log/openvpn/openvpn.log
verb 3
Some context from the client side behind OpenVPN:
pietro@toilet ~ $ traceroute vswitch0.lan
traceroute to vswitch0.lan (172.12.0.118), 30 hops max, 60 byte packets
1 172-12-0-118.lightspeed.sgnwmi.sbcglobal.net (172.12.0.118) 178.319 ms 178.313 ms 178.310 ms
pietro@toilet ~ $ traceroute 192.192.24.24
traceroute to 192.192.24.24 (192.192.24.24), 30 hops max, 60 byte packets
1 10.8.0.1 (10.8.0.1) 213.096 ms 213.090 ms 213.089 ms
2 192.192.24.24 (192.192.24.24) 213.088 ms 213.088 ms 213.087 ms
pietro@toilet ~ $ telnet vswitch0.lan 6501
Trying 172.12.0.118...
telnet: Unable to connect to remote host: No route to host
pietro@toilet ~ $ telnet 192.192.24.24 6501
Trying 192.192.24.24...
telnet: Unable to connect to remote host: No route to host
pietro@toilet ~ $
pietro@toilet ~ $ ip route show
0.0.0.0/1 via 10.8.0.5 dev tun0
default via 192.168.0.1 dev wlan0 proto dhcp src 192.168.0.20 metric 600
10.0.2.0/24 dev virbr1 proto kernel scope link src 10.0.2.2 linkdown
10.8.0.0/24 via 10.8.0.5 dev tun0
10.8.0.1 via 10.8.0.5 dev tun0
10.8.0.5 dev tun0 proto kernel scope link src 10.8.0.6
86.31.79.20 via 192.168.0.1 dev wlan0
128.0.0.0/1 via 10.8.0.5 dev tun0
172.12.0.0/24 via 10.8.0.5 dev tun0
172.12.1.0/24 via 10.8.0.5 dev tun0
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown
192.168.0.0/24 dev wlan0 proto kernel scope link src 192.168.0.20 metric 600
192.168.16.0/20 dev br-d252343c3ac3 proto kernel scope link src 192.168.16.1
192.168.56.0/24 dev br0 proto kernel scope link src 192.168.56.254 linkdown
192.168.64.0/20 dev br-a520ce578721 proto kernel scope link src 192.168.64.1 linkdown
192.168.122.0/24 dev virbr0 proto kernel scope link src 192.168.122.1 linkdown
192.192.24.0/24 via 10.8.0.5 dev tun0
pietro@toilet ~ $
pietro@toilet ~ $ ifconfig
br0: flags=4099 mtu 1500
inet 192.168.56.254 netmask 255.255.255.0 broadcast 192.168.56.255
ether 5e:96:85:83:a8:5d txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
br-a520ce578721: flags=4099 mtu 1500
inet 192.168.64.1 netmask 255.255.240.0 broadcast 192.168.79.255
ether 02:42:bf:e6:8f:cb txqueuelen 0 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
br-d252343c3ac3: flags=4163 mtu 1500
inet 192.168.16.1 netmask 255.255.240.0 broadcast 192.168.31.255
inet6 fe80::42:4dff:fe43:3ea1 prefixlen 64 scopeid 0x20
ether 02:42:4d:43:3e:a1 txqueuelen 0 (Ethernet)
RX packets 162 bytes 14290 (13.9 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 281 bytes 3123059 (2.9 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
docker0: flags=4099 mtu 1500
inet 172.17.0.1 netmask 255.255.0.0 broadcast 172.17.255.255
ether 02:42:bd:96:21:8b txqueuelen 0 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
eth0: flags=4099 mtu 1500
ether 9c:2d:cd:5f:be:40 txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
device interrupt 16 memory 0xbe180000-be1a0000
lo: flags=73 mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10
loop txqueuelen 1000 (Local Loopback)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
tun0: flags=4305 mtu 1470
inet 10.8.0.6 netmask 255.255.255.255 destination 10.8.0.5
inet6 fe80::dda0:a978:58f:e77e prefixlen 64 scopeid 0x20
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 500 (UNSPEC)
RX packets 6168 bytes 1086960 (1.0 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 6740 bytes 624579 (609.9 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
veth550a2eb: flags=4163 mtu 1500
inet6 fe80::2c:5ff:feaf:3e9d prefixlen 64 scopeid 0x20
ether 02:2c:05:af:3e:9d txqueuelen 0 (Ethernet)
RX packets 502 bytes 65645 (64.1 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 606 bytes 3170670 (3.0 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
vethad57629: flags=4163 mtu 1500
inet6 fe80::d8c0:ffff:fe9b:9cd prefixlen 64 scopeid 0x20
ether da:c0:ff:9b:09:cd txqueuelen 0 (Ethernet)
RX packets 304 bytes 45543 (44.4 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 488 bytes 72804 (71.0 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
virbr0: flags=4099 mtu 1500
inet 192.168.122.1 netmask 255.255.255.0 broadcast 192.168.122.255
ether 52:54:00:dd:38:7c txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
virbr1: flags=4099 mtu 1500
inet 10.0.2.2 netmask 255.255.255.0 broadcast 10.0.2.255
ether 52:54:00:d6:bf:2f txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
virbr2: flags=4099 mtu 1500
ether 52:54:00:47:68:a9 txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
virbr3: flags=4099 mtu 1500
ether 52:54:00:4d:70:5b txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
wlan0: flags=4163 mtu 1500
inet 192.168.0.20 netmask 255.255.255.0 broadcast 192.168.0.255
inet6 2001:1260:312:80e6:75ab:9a69:139b:7140 prefixlen 64 scopeid 0x0
inet6 2001:1260:312:80e6:be14:64fe:1a87:39d2 prefixlen 128 scopeid 0x0
inet6 fe80::8e0a:f19e:5494:2f33 prefixlen 64 scopeid 0x20
ether 3c:e9:f7:b0:5d:b5 txqueuelen 1000 (Ethernet)
RX packets 84957 bytes 94483506 (90.1 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 23352 bytes 4683529 (4.4 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
pietro@toilet ~ $
Thanks.