Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to use OpenVPN to access the internet over a secure connection.

I have openVPN configured and running on Amazon EC2 in bridge mode with client certs. I can successfully connect from the client, but I cannot get access to the internet or ping anything from the client

I checked the following and everything seems to shows a successful connection between the vpn client/server and UDP traffic on 1194

[server] sudo tcpdump -i eth0 udp port 1194
      (shows UDP traffic after establishing connection)

[server] sudo iptables -L

    Chain INPUT (policy ACCEPT)
    target     prot opt source               destination
    ACCEPT     all  --  anywhere             anywhere
    ACCEPT     all  --  anywhere             anywhere

    Chain FORWARD (policy ACCEPT)
    target     prot opt source               destination
    ACCEPT     all  --  anywhere             anywhere

    Chain OUTPUT (policy ACCEPT)
    target     prot opt source               destination

[server] sudo iptables -L -t nat

    Chain PREROUTING (policy ACCEPT)
    target     prot opt source               destination

    Chain POSTROUTING (policy ACCEPT)
    target     prot opt source               destination
    MASQUERADE  all  --  ip-W-X-Y-0.us-west-1.compute.internal/24  anywhere

    Chain OUTPUT (policy ACCEPT)
    target     prot opt source               destination


[server] openvpn.log
    Wed Oct 19 03:11:26 2011 localhost/a.b.c.d:61905 [localhost] Inactivity timeout (--ping-restart), restarting
    Wed Oct 19 03:11:26 2011 localhost/a.b.c.d:61905 SIGUSR1[soft,ping-restart] received, client-instance restarting
    Wed Oct 19 03:41:31 2011 MULTI: multi_create_instance called
    Wed Oct 19 03:41:31 2011 a.b.c.d:57889 Re-using SSL/TLS context
    Wed Oct 19 03:41:31 2011 a.b.c.d:57889 LZO compression initialized
    Wed Oct 19 03:41:31 2011 a.b.c.d:57889 Control Channel MTU parms [ L:1574 D:166 EF:66 EB:0 ET:0 EL:0 ]
    Wed Oct 19 03:41:31 2011 a.b.c.d:57889 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
    Wed Oct 19 03:41:31 2011 a.b.c.d:57889 Local Options hash (VER=V4): '360696c5'
    Wed Oct 19 03:41:31 2011 a.b.c.d:57889 Expected Remote Options hash (VER=V4): '13a273ba'
    Wed Oct 19 03:41:31 2011 a.b.c.d:57889 TLS: Initial packet from [AF_INET]a.b.c.d:57889, sid=dd886604 ab6ebb38
    Wed Oct 19 03:41:35 2011 a.b.c.d:57889 VERIFY OK: depth=1, /C=US/ST=CA/L=SanFrancisco/O=EXAMPLE/CN=EXAMPLE_CA/emailAddress=info@EXAMPLE.com
    Wed Oct 19 03:41:35 2011 a.b.c.d:57889 VERIFY OK: depth=0, /C=US/ST=CA/L=SanFrancisco/O=EXAMPLE/CN=localhost/emailAddress=info@EXAMPLE.com
    Wed Oct 19 03:41:37 2011 a.b.c.d:57889 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
    Wed Oct 19 03:41:37 2011 a.b.c.d:57889 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
    Wed Oct 19 03:41:37 2011 a.b.c.d:57889 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
    Wed Oct 19 03:41:37 2011 a.b.c.d:57889 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
    Wed Oct 19 03:41:37 2011 a.b.c.d:57889 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
    Wed Oct 19 03:41:37 2011 a.b.c.d:57889 [localhost] Peer Connection Initiated with [AF_INET]a.b.c.d:57889
    Wed Oct 19 03:41:39 2011 localhost/a.b.c.d:57889 PUSH: Received control message: 'PUSH_REQUEST'
    Wed Oct 19 03:41:39 2011 localhost/a.b.c.d:57889 SENT CONTROL [localhost]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,route-gateway W.X.Y.Z,ping 10,ping-restart 120,ifconfig W.X.Y.Z 255.255.255.0' (status=1)
    Wed Oct 19 03:41:40 2011 localhost/a.b.c.d:57889 MULTI: Learn: (IPV6) -> localhost/a.b.c.d:57889

[client] tracert google.com
    Tracing route to google.com [74.125.71.104] over a maximum of 30 hops:
      1   347 ms   349 ms   348 ms  PC [w.X.Y.Z]
      2     *        *        *     Request timed out.

I can also successfully ping the server IP address from the client, and ping google.com from an SSH shell on the server. What am I doing wrong?

Here is my config (Note: W.X.Y.Z == amazon EC2 private ipaddress)

bridge config on br0

ifconfig eth0 0.0.0.0 promisc up
brctl addbr br0
brctl addif br0 eth0
ifconfig br0 W.X.Y.X netmask 255.255.255.0 broadcast W.X.Y.255 up
route add default gw W.X.Y.1 br0

/etc/openvpn/server.conf (from https://help.ubuntu.com/10.04/serverguide/C/openvpn.html)

local W.X.Y.Z
dev tap0
up "/etc/openvpn/up.sh br0"
down "/etc/openvpn/down.sh br0"
;server W.X.Y.0 255.255.255.0
server-bridge W.X.Y.Z 255.255.255.0 W.X.Y.105 W.X.Y.200
;push "route W.X.Y.0 255.255.255.0" 
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
tls-auth ta.key 0 # This file is secret
user nobody
group nogroup 
log-append openvpn.log

iptables config

sudo iptables -A INPUT -i tap0 -j ACCEPT
sudo iptables -A INPUT -i br0 -j ACCEPT
sudo iptables -A FORWARD -i br0 -j ACCEPT
sudo iptables -t nat -A POSTROUTING -s W.X.Y.0/24 -o eth0 -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward

Routing Tables added

route -n
    Kernel IP routing table
    Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
    W.X.Y.0     0.0.0.0         255.255.255.0   U     0      0        0 br0
    0.0.0.0         W.X.Y.1     0.0.0.0         UG    0      0        0 br0

C:>route print
    ===========================================================================
    Interface List
     32...00 ff ac d6 f7 04 ......TAP-Win32 Adapter V9
     15...00 14 d1 e9 57 49 ......Microsoft Virtual WiFi Miniport Adapter #2
     14...00 14 d1 e9 57 49 ......Realtek RTL8191SU Wireless LAN 802.11n USB 2.0 Net
    work Adapter
     10...00 1f d0 50 1b ca ......Realtek PCIe GBE Family Controller
      1...........................Software Loopback Interface 1
     11...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
     16...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
     17...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
     18...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
     36...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #5
    ===========================================================================

    IPv4 Route Table
    ===========================================================================
    Active Routes:
    Network Destination        Netmask          Gateway       Interface  Metric
              0.0.0.0          0.0.0.0         10.1.2.1       10.1.2.201     25
             10.1.2.0    255.255.255.0         On-link        10.1.2.201    281
           10.1.2.201  255.255.255.255         On-link        10.1.2.201    281
           10.1.2.255  255.255.255.255         On-link        10.1.2.201    281
            127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
            127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
      127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
            224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
            224.0.0.0        240.0.0.0         On-link        10.1.2.201    281
      255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      255.255.255.255  255.255.255.255         On-link        10.1.2.201    281
    ===========================================================================
    Persistent Routes:
      Network Address          Netmask  Gateway Address  Metric
              0.0.0.0          0.0.0.0         10.1.2.1  Default
    ===========================================================================

C:>tracert google.com

    Tracing route to google.com [74.125.71.147]
    over a maximum of 30 hops:

      1   344 ms   345 ms   343 ms  PC [W.X.Y.221]
      2     *        *        *     Request timed out.
share|improve this question
    
$100 says this is a routing error –  Silverfire Oct 19 '11 at 4:22
    
append the routing table on the client route print and on the server route -n? –  quanta Oct 19 '11 at 4:27
    
routing tables added –  michael Oct 19 '11 at 4:42
    
Is client running Windows 7? –  quanta Oct 19 '11 at 4:52
    
yes. sorry, should have added that in the post –  michael Oct 19 '11 at 6:50
add comment

1 Answer

I think, mistake is in bridge definition. Bridge must consist of eth0-device and tap0-device.

For MY example it`s so:

brctl show br0

bridge name bridge id       STP enabled interfaces
br0     8000.000c29af7f50   no      tap1
                            eth2

Bridge-device has in IP 10.1.2.1 (from your example) and iptables (FORWARD-chain is default ACCEPT in your example):

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  10.1.2.0/24  anywhere

So client with 10.1.2.201 will have MASQUERADE-action on OpenVPN server.

Config of openvpn-server must have (for example):

server-bridge 10.1.2.1 255.255.255.0 10.1.2.2 10.1.2.200 
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.