Cannot browse ipv4 websites (OpenVPN )

Question

I have set up an openVPN tunnel on my VPS (OpenVZ - Ubuntu 12.04).
The problem is when I'm connected to the vpn, I can only browse websites which support ipv6 like google. Ipv4 sites aren't loading (no error, just waiting indefinitely).
http://whatismyv6.com/ reports me that I've an ipv6 address, so I guess this is the problem.

Server configuration:

dev tun  
server 10.8.0.0 255.255.255.0  
ifconfig-pool-persist ipp.txt  
ca /etc/openvpn/easy-rsa/keys/ca.crt  
cert /etc/openvpn/easy-rsa/keys/server.crt  
key /etc/openvpn/easy-rsa/keys/server.key  
dh /etc/openvpn/easy-rsa/keys/dh1024.pem  
push "route 10.8.0.0 255.255.255.0"  
push "dhcp-option DNS 8.8.8.8"  
push "dhcp-option DNS 8.8.4.4"  
push "redirect-gateway def1"  
comp-lzo  
persist-tun  
persist-key  
status openvpn-status.log  
log /var/log/openvpn.log  
verb 3

Client configuration:

client  
remote xx.xx.xx.xx 1194  
dev tun  
comp-lzo  
ca ca.crt  
cert client1.crt  
key client1.key  
redirect-gateway def1  
verb 3  

I have configured NAT with this command: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to xx.xx.xx.xx
Can someone explain me how I can make it works (forcing ipv4?)
I had the same problem with another vps and I also tried on another client (All Windows 7).

Answer 1

Your vpn server does not seem to be able to reroute packets destined to the internet as they come through the vpn. As you use the "reroute-gateway def1" directive, thereby forcing all external ipv4 traffic from your client through the vpn tunnel, you need to facilitate rerouting capability in conjunction with your vpn server.

I would guess you are able to connect directly to ipv6 sites since ipv6 is not tunneled through the vpn, as seen in your configuration.

You can either: a) set up your vpn server network to reroute correctly to the internet. This is elegant in practice but messy to describe using the info given (kind of turns into a dialogue which I don´t have time for right now). I have done it in conjunction with openvpn, can confirm it is a viable design option, and NAT is your friend :-)

b) configure a web proxy behind or on your openvpn server and tell your client web browser to use it. This is easy and I happen to have a squid config handy, just by way of inspiration. Understand that you could opt to use any web proxy server you like, this is just a config I once used and which is now just lying around my hard drive. It was used to solve exactly your issue with openvpn using "reroute-gateway def1" though.

To install and configure squid, use one of all the gazillion excellent howtos on the internet. Here is a simple change needed in the squid.conf just to get it working:

Open /etc/squid/squid.conf

change

http_port 3128

directive to

http_port 8080 # This really could be any port you choose, just open your firewall to permit it from the vpn tunnel to your squid.

Change acls:

acl localnet src 10.0.0.0/8     # RFC1918 possible internal network
acl localnet src 172.20.0.0/12  # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network

to instead reflect your actual local nets:

acl localnet src 10.8.0.0/24   # Your internal LAN

Uncomment the line:

# http_access deny to_localhost

Save /etc/squid/squid.conf

Start squid and when you connect your vpn client configure your web browser to use an http proxy, give it the ip address to your squid machine and the port 8080 (or whatever port you chose).

Best of luck, and hope it floats your boat!

Answer 2

Switching to a tcp port fixed the problem. I have no idea why... (firewalls open)