Help with iptables && tinc

[Guus Sliepen]

On Mon, Jan 30, 2017 at 02:05:43PM +0000, Dave Albert wrote:

>   I've been able to get tinc setup when I flush all my iptables, but after
> enabling iptables and a delay I get a "Destination Net Unknown".

Destination Net Unknown means that tinc does not know a Subnet that
matches the destination IP address of VPN packets, either because there
is no such Subnet, or because the host that has that Subnet is not
connected. So it seems that with the iptables rules enabled, WEB and
MASTER cannot make a TCP connection with HOME (and/or vice versa).

From the firewall rules you posted:

> Chain INPUT
[...]
> 0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0 0.0.0.0/0            tcp dpt:655 state NEW,ESTABLISHED
> 6  8976 ACCEPT     udp  --  *      *       0.0.0.0/0 0.0.0.0/0            udp dpt:655 state NEW,ESTABLISHED

That means no TCP connection to port 655 was ever attempted. But your
OUTPUT rules are more interesting:

> Chain OUTPUT
[...]
> 0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0 0.0.0.0/0            tcp spt:655 state NEW,ESTABLISHED
> 6  8976 ACCEPT     udp  --  *      *       0.0.0.0/0 0.0.0.0/0            udp spt:655 state NEW,ESTABLISHED

This only allows TCP connections from port 655 if they are NEW or
ESTABLISHED. But tinc never makes outgoing TCP connections with source
port 655! Outgoing TCP connections normally have a random port number.
There is no other rule that allows outgoing TCP connections to port 655,
except to those hosts within the IP range 10.0.3.0/24.

I recommend you add a rule that ACCEPTs anything with state
RELATED,ESTABLISHED in the OUTPUT chain. Put that rule first. Then you
want to allow NEW outgoing connections with *destination* port 655.

-- 
Met vriendelijke groet / with kind regards,
     Guus Sliepen <guus at tinc-vpn.org>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://www.tinc-vpn.org/pipermail/tinc/attachments/20170130/320c55c1/attachment.sig>