You know, there's blog posts and howto's on the web to install/configure anything and everything including the kitchen sink. The problem is that most of them only tell you the happy flow. As soon as something does not go according to what the writer expects, you're up the proverbial shit creek without a paddle. So, here's two tips to fix issues when faced with vpn / iptables / networking that's not working.

Troubleshooting network packets

sudo tcpdump -n -vvv -i any "put your tcpdump/wireshark filter here"

Some filters include:

• port 53 (for DNS troubleshooting)
• net 10.20.30.0/24 (for dumping traffic from a specific network/host)
• udp port 1194 (for the default openvpn port)

More filters can be found on the wireshark homepage.

Troubleshooting iptables

Ever had the problem where traffic just seemed to disappear? A good way to see where this happens (if you have access) is to add a LOG line to iptables:

sudo iptables -A FORWARD -m limit --limit 5/min -j LOG --log-prefix "This packet dropped: " --log-level 7

That way, any packet going through your linux (OpenVPN) router will immediately pop up if it is not matched by a more important rule than you just added. You can see the kernel log by (for example) using the command:

dmesg -T

A final tip, maybe not as ready-to-use as the previous two, but very important: troubleshoot step by step. Babysteps will quickly isolate the problem.

P.S. Don't forget to enable routing in linux (it's called forwarding) by using the sysctl configuration file.