Thanks! Looks like my biggest problem was I had --sport for INPUT and --dport for OUTPUT but was missing the reverse.
On 30/01/2017, 16:39, "tinc on behalf of Guus Sliepen" <[email protected] on behalf of [email protected]> wrote: On Mon, Jan 30, 2017 at 02:05:43PM +0000, Dave Albert wrote: > I've been able to get tinc setup when I flush all my iptables, but after > enabling iptables and a delay I get a "Destination Net Unknown". Destination Net Unknown means that tinc does not know a Subnet that matches the destination IP address of VPN packets, either because there is no such Subnet, or because the host that has that Subnet is not connected. So it seems that with the iptables rules enabled, WEB and MASTER cannot make a TCP connection with HOME (and/or vice versa). From the firewall rules you posted: > Chain INPUT [...] > 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:655 state NEW,ESTABLISHED > 6 8976 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:655 state NEW,ESTABLISHED That means no TCP connection to port 655 was ever attempted. But your OUTPUT rules are more interesting: > Chain OUTPUT [...] > 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:655 state NEW,ESTABLISHED > 6 8976 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:655 state NEW,ESTABLISHED This only allows TCP connections from port 655 if they are NEW or ESTABLISHED. But tinc never makes outgoing TCP connections with source port 655! Outgoing TCP connections normally have a random port number. There is no other rule that allows outgoing TCP connections to port 655, except to those hosts within the IP range 10.0.3.0/24. I recommend you add a rule that ACCEPTs anything with state RELATED,ESTABLISHED in the OUTPUT chain. Put that rule first. Then you want to allow NEW outgoing connections with *destination* port 655. -- Met vriendelijke groet / with kind regards, Guus Sliepen <[email protected]> _______________________________________________ tinc mailing list [email protected] https://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc _______________________________________________ tinc mailing list [email protected] https://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc
