>[оверквотинг удален]
>>>Проблема в цепочке OUTPUT.
>>>Ставлю политику по-умолчанию ACCEPT и пингуются оба vpn IP.
>>
>>пингуете из локалки или с сервера?
>>>Хм.
>>
>>без текущих правил даже при большом желании мысли не появятся.
>>iptables-save -c показывайте если нужен какой-то ответ.
>
>и адреса с какого какой пингуете # Generated by iptables-save v1.4.0 on Mon Apr 6 16:50:13 2009
*mangle
:PREROUTING ACCEPT [14931:5801601]
:INPUT ACCEPT [250415:69917025]
:FORWARD ACCEPT [73903:33526804]
:OUTPUT ACCEPT [7069:1192882]
:POSTROUTING ACCEPT [331132:110211330]
COMMIT
# Completed on Mon Apr 6 16:50:13 2009
# Generated by iptables-save v1.4.0 on Mon Apr 6 16:50:13 2009
*nat
:PREROUTING ACCEPT [510:31781]
:POSTROUTING ACCEPT [97:7045]
:OUTPUT ACCEPT [96:6985]
[377:18324] -A POSTROUTING -s 192.168.50.0/24 -o eth1 -j SNAT --to-source 192.168.1.2
[0:0] -A POSTROUTING -s 192.168.50.0/24 -d 192.168.80.40/32 -o ppp+ -j SNAT --to-source 192.168.1.2
[23:1332] -A POSTROUTING -s 192.168.50.0/24 -d 192.168.80.40/32 -o ppp+ -j SNAT --to-source 192.168.80.40
COMMIT
# Completed on Mon Apr 6 16:50:13 2009
# Generated by iptables-save v1.4.0 on Mon Apr 6 16:50:13 2009
*filter
:INPUT DROP [84:11676]
:FORWARD DROP [10:528]
:OUTPUT ACCEPT [1:60]
:allowed - [0:0]
:bad_tcp_packets - [0:0]
:icmp_packets - [0:0]
:tcp_packets - [0:0]
:udp_packets - [0:0]
[4282:633984] -A INPUT -p tcp -j bad_tcp_packets
[3481:317248] -A INPUT -s 192.168.50.0/24 -i eth2 -j ACCEPT
[630:94077] -A INPUT -s 127.0.0.1/32 -i lo -j ACCEPT
[0:0] -A INPUT -s 192.168.50.77/32 -i lo -j ACCEPT
[0:0] -A INPUT -s 192.168.1.2/32 -i lo -j ACCEPT
[123:130379] -A INPUT -i ppp0 -j ACCEPT
[2:168] -A INPUT -s 192.168.80.40/32 -j ACCEPT
[1928:1560817] -A INPUT -i eth1 -p gre -j ACCEPT
[0:0] -A INPUT -i eth1 -p tcp -m tcp --dport 1723 -j ACCEPT
[0:0] -A INPUT -i eth2 -p udp -m udp --sport 68 --dport 67 -j ACCEPT
[602:182921] -A INPUT -d 192.168.1.2/32 -m state --state RELATED,ESTABLISHED -j ACCEPT
[21:1634] -A INPUT -i eth1 -p tcp -j tcp_packets
[62:8589] -A INPUT -i eth1 -p udp -j udp_packets
[0:0] -A INPUT -i eth1 -p icmp -j icmp_packets
[52:8415] -A INPUT -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "IPT INPUT packet died: " --log-level 7
[7613:3467698] -A FORWARD -p tcp -j bad_tcp_packets
[3905:670908] -A FORWARD -i eth2 -j ACCEPT
[4103:2828349] -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
[6:336] -A FORWARD -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "IPT FORWARD packet died: " --log-level 7
[4904:922103] -A OUTPUT -p tcp -j bad_tcp_packets
[630:94077] -A OUTPUT -s 127.0.0.1/32 -j ACCEPT
[4153:839325] -A OUTPUT -s 192.168.50.77/32 -j ACCEPT
[2245:242887] -A OUTPUT -s 192.168.1.2/32 -j ACCEPT
[2:168] -A OUTPUT -o ppp0 -j ACCEPT
[2:168] -A OUTPUT -d 192.168.80.40/32 -j ACCEPT
[0:0] -A OUTPUT -o eth1 -p gre -j ACCEPT
[0:0] -A OUTPUT -o eth1 -p tcp -m tcp --dport 1723 -j ACCEPT
[0:0] -A OUTPUT -s 192.168.50.0/24 -d 192.168.80.40/32 -j ACCEPT
[0:0] -A OUTPUT -s 192.168.80.40/32 -d 192.168.20.30/32 -j ACCEPT
[1:60] -A OUTPUT -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "IPT OUTPUT packet died: " --log-level 7
[0:0] -A OUTPUT -s 192.168.50.0/24 -d 192.168.80.40/32 -j ACCEPT
[0:0] -A allowed -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
[21:1634] -A allowed -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A allowed -p tcp -j DROP
[0:0] -A bad_tcp_packets -p tcp -m tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset
[6:300] -A bad_tcp_packets -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j LOG --log-prefix "New not syn:"
[6:300] -A bad_tcp_packets -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
[0:0] -A icmp_packets -s 192.168.50.0/24 -p icmp -m icmp --icmp-type 8 -j ACCEPT
[0:0] -A icmp_packets -s 192.168.50.0/24 -p icmp -m icmp --icmp-type 11 -j ACCEPT
[0:0] -A tcp_packets -s 192.168.50.0/24 -p tcp -m tcp --dport 21 -j allowed
[18:1292] -A tcp_packets -s 192.168.50.0/24 -p tcp -m tcp --dport 22 -j allowed
[0:0] -A tcp_packets -s 192.168.50.0/24 -p tcp -m tcp --dport 113 -j allowed
[3:342] -A tcp_packets -s 192.168.50.0/24 -p tcp -m tcp --dport 3128 -j allowed
[0:0] -A udp_packets -s 192.168.50.0/24 -p udp -m udp --dport 2074 -j ACCEPT
[0:0] -A udp_packets -s 192.168.50.0/24 -p udp -m udp --dport 4000 -j ACCEPT
COMMIT
# Completed on Mon Apr 6 16:50:13 2009
Пингую (192.168.80.40 и 192.168.20.30) и с сервера (с сервера и при политике по-умолчанию DROP), и с локалки.
