Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've looked at a lot of different pages on this site and in other places but I couldn't find any solution to this problem I've spent the afternoon on.

I want to setup an OpenVPN server on a VPS CentOS 6.5 machine. I have successfully done that and I'm able to establish a tunnel to the server, ping the remote gateway IP address etc. However I am unable to reach Internet from the VPN. After a lot of time troubleshooting the OpenVPN configuration, I believe the issue comes from the VPS itself since the tun0 interface itself can't reach Internet (so it can't very well route it!).

If I try to reach Internet from the tun0 (OpenVPN) interface, it doesn't work:

[root@vps3580 ~]# ping -I tun0 8.8.8.8
PING 8.8.8.8 (8.8.8.8) from 10.44.3.1 tun0: 56(84) bytes of data.
--- 8.8.8.8 ping statistics ---
6 packets transmitted, 0 received, 100% packet loss, time 5301ms

If I ping from the default interface (venet0:0) it works fine:

[root@vps3580 ~]# ping -I venet0:0 8.8.8.8
Warning: cannot bind to specified iface, falling back: No such device
PING 8.8.8.8 (8.8.8.8) from 37.187.42.146 venet0:0: 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=49 time=10.0 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=49 time=10.0 ms
--- 8.8.8.8 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1793ms
rtt min/avg/max/mdev = 10.038/10.056/10.074/0.018 ms

This is what my ifconfig looks like (I modified the public IP for this post) :

[root@vps3580 ~]# ifconfig
lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:5013190 errors:0 dropped:0 overruns:0 frame:0
          TX packets:5013190 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:677461812 (646.0 MiB)  TX bytes:677461812 (646.0 MiB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.44.3.1  P-t-P:10.44.3.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:2004 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1287 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:223030 (217.8 KiB)  TX bytes:329848 (322.1 KiB)

venet0    Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:127.0.0.1  P-t-P:127.0.0.1  Bcast:0.0.0.0  Mask:255.255.255.255
          inet6 addr: 2001:41d0:52:100::e84/56 Scope:Global
          UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1
          RX packets:1027193 errors:0 dropped:0 overruns:0 frame:0
          TX packets:878383 errors:0 dropped:318 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:508829024 (485.2 MiB)  TX bytes:133008265 (126.8 MiB)

venet0:0  Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:73.83.42.22  P-t-P:73.83.42.22  Bcast:37.187.43.255  Mask:255.255.252.0
          UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1

And my routes:

[root@vps3580~]# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.44.3.2       *               255.255.255.255 UH    0      0        0 tun0
10.44.3.0       10.44.3.2       255.255.255.248 UG    0      0        0 tun0
73.83.42.22     *               255.255.252.0   U     0      0        0 venet0
link-local      *               255.255.0.0     U     0      0        0 *
link-local      *               255.255.0.0     U     1002   0        0 venet0
198.18.0.0      *               255.254.0.0     U     0      0        0 *
172.16.0.0      *               255.240.0.0     U     0      0        0 *
default         *               255.0.0.0       U     0      0        0 *
default         *               0.0.0.0         U     0      0        0 venet0

I suspect there is something wrong with one of the route but I can't figure out what. When I traceroute I get this:

[root@vps3580~]# traceroute -i tun0 8.8.8.8
traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets
 1  * * *
 2  * * *
 3  * * *
 4  * * *
 5  * * *
 6  * * *
 7  * * *
 8  * * *
 9  * * *
10  * * *
 [...]
30  * *

I'm not familiar with "tun" interfaces and I've been struggling with this for hours and was really hoping somebody could help me troubleshoot this!

Edit: Firewall rules:

[root@vps3580~]# iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i venet0 -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT
-A INPUT -i venet0 -p tcp -m tcp --dport 443 -m state --state NEW -j ACCEPT
-A INPUT -i venet0 -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT
-A INPUT -i venet0 -p udp -m udp --dport 1194 -m state --state NEW -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.44.3.0/29 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
share|improve this question
    
Did you enable IP forwarding on the server ? –  Iain Apr 16 at 16:20
    
The problem is not with IP forwarding I think, as the server interface itself can't reach Internet (as the first ping example shows). But yes, IP forwarding is enabled. –  Astaar Apr 16 at 16:32
add comment

2 Answers 2

Did you check the firewall configuration? iptables -S

In iptables, if you have INPUT or OUTPUT default policies set to DROP, you will need will need to open the ports and allow access to the devices using iptables rules.

The CentOS wiki has a full walkthrough of iptables.


2014-04-16 Edit: Do you want to route all traffic over tun0?

route add -net 10.44.3.2 netmask 255.255.255.255 gw 73.83.42.22
route add default gw dev tun0 
share|improve this answer
    
output is set to accept. I added the firewall rules to the question though. –  Astaar Apr 16 at 16:34
    
Did you try pinging the OpenVPN server itself by tun0? This would prove the firewall at OpenVPN server will allow ICMP. –  Guy Hughes Apr 16 at 16:44
    
Yes, that works :/ –  Astaar Apr 16 at 16:53
    
I found the issue. OpenVZ needs to be configured as SNAT and not Masquarade in the firewall rules! –  Astaar Apr 16 at 16:55
add comment
up vote 0 down vote accepted

I found the answer. It was, in fact, a firewall problem. OpenVZ doesn't support MASQUERADE, you need to use SNAT.

This won't work:

iptables -t nat -A POSTROUTING -s 10.44.3.0/29 -o venet0 -j MASQUERADE

But this will work:

iptables -t nat -A POSTROUTING -o venet0 -j SNAT --to-source <server public IP>
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.