Possible addition to README for use of NAT

[Kevin Cernekee]

On Fri, Jul 31, 2015 at 5:31 AM, P Cause <pcause at hotmail.com> wrote:
> Thanks for ocserv.  I was able to build easily and start and connect but
> network routing wasn't working. After a lot of time and searching I found
> these steps and thought perhaps the README could be updated to add the
> steps.  I found at
> https://www.vultr.com/docs/setup-openconnect-vpn-server-for-cisco-anyconnect-on-ubuntu-14-04-x64
> What I suggest be added:
>
> Steps to enable NAT
>
> Enable NAT in iptables
>
> iptables -t nat -A POSTROUTING -j MASQUERADE

IIRC this rule might cause weird side effects on the loopback
interface.  Also, you'll probably need to enable MSS clamping to get
things working reliably.

Here is the script that I run from rc.local on boot (this setup is for
IPv4 only):

#!/bin/bash

ipt=/sbin/iptables

sysctl --quiet -w net.ipv4.ip_forward=1

$ipt -F FORWARD
$ipt -P FORWARD DROP
$ipt -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
$ipt -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
$ipt -A FORWARD -i vpns+ -o eth0 -j ACCEPT
$ipt -A FORWARD -i vpns+ -o vpns+ -j ACCEPT

$ipt -t nat -F POSTROUTING
$ipt -t nat -A POSTROUTING -o eth0 -j MASQUERADE

exit 0