OpenVPN not routing over tun0 interface

Question

I've looked at a lot of different pages on this site and in other places but I couldn't find any solution to this problem I've spent the afternoon on.

I want to setup an OpenVPN server on a VPS CentOS 6.5 machine. I have successfully done that and I'm able to establish a tunnel to the server, ping the remote gateway IP address etc. However I am unable to reach Internet from the VPN. After a lot of time troubleshooting the OpenVPN configuration, I believe the issue comes from the VPS itself since the tun0 interface itself can't reach Internet (so it can't very well route it!).

If I try to reach Internet from the tun0 (OpenVPN) interface, it doesn't work:

[root@vps3580 ~]# ping -I tun0 8.8.8.8
PING 8.8.8.8 (8.8.8.8) from 10.44.3.1 tun0: 56(84) bytes of data.
--- 8.8.8.8 ping statistics ---
6 packets transmitted, 0 received, 100% packet loss, time 5301ms

If I ping from the default interface (venet0:0) it works fine:

[root@vps3580 ~]# ping -I venet0:0 8.8.8.8
Warning: cannot bind to specified iface, falling back: No such device
PING 8.8.8.8 (8.8.8.8) from 37.187.42.146 venet0:0: 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=49 time=10.0 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=49 time=10.0 ms
--- 8.8.8.8 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1793ms
rtt min/avg/max/mdev = 10.038/10.056/10.074/0.018 ms

This is what my ifconfig looks like (I modified the public IP for this post) :

[root@vps3580 ~]# ifconfig
lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:5013190 errors:0 dropped:0 overruns:0 frame:0
          TX packets:5013190 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:677461812 (646.0 MiB)  TX bytes:677461812 (646.0 MiB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.44.3.1  P-t-P:10.44.3.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:2004 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1287 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:223030 (217.8 KiB)  TX bytes:329848 (322.1 KiB)

venet0    Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:127.0.0.1  P-t-P:127.0.0.1  Bcast:0.0.0.0  Mask:255.255.255.255
          inet6 addr: 2001:41d0:52:100::e84/56 Scope:Global
          UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1
          RX packets:1027193 errors:0 dropped:0 overruns:0 frame:0
          TX packets:878383 errors:0 dropped:318 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:508829024 (485.2 MiB)  TX bytes:133008265 (126.8 MiB)

venet0:0  Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:73.83.42.22  P-t-P:73.83.42.22  Bcast:37.187.43.255  Mask:255.255.252.0
          UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1

And my routes:

[root@vps3580~]# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.44.3.2       *               255.255.255.255 UH    0      0        0 tun0
10.44.3.0       10.44.3.2       255.255.255.248 UG    0      0        0 tun0
73.83.42.22     *               255.255.252.0   U     0      0        0 venet0
link-local      *               255.255.0.0     U     0      0        0 *
link-local      *               255.255.0.0     U     1002   0        0 venet0
198.18.0.0      *               255.254.0.0     U     0      0        0 *
172.16.0.0      *               255.240.0.0     U     0      0        0 *
default         *               255.0.0.0       U     0      0        0 *
default         *               0.0.0.0         U     0      0        0 venet0

I suspect there is something wrong with one of the route but I can't figure out what. When I traceroute I get this:

[root@vps3580~]# traceroute -i tun0 8.8.8.8
traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets
 1  * * *
 2  * * *
 3  * * *
 4  * * *
 5  * * *
 6  * * *
 7  * * *
 8  * * *
 9  * * *
10  * * *
 [...]
30  * *

I'm not familiar with "tun" interfaces and I've been struggling with this for hours and was really hoping somebody could help me troubleshoot this!

Edit: Firewall rules:

[root@vps3580~]# iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i venet0 -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT
-A INPUT -i venet0 -p tcp -m tcp --dport 443 -m state --state NEW -j ACCEPT
-A INPUT -i venet0 -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT
-A INPUT -i venet0 -p udp -m udp --dport 1194 -m state --state NEW -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.44.3.0/29 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited

Answer 1

I found the answer. It was, in fact, a firewall problem. OpenVZ doesn't support MASQUERADE, you need to use SNAT.

This won't work:

iptables -t nat -A POSTROUTING -s 10.44.3.0/29 -o venet0 -j MASQUERADE

But this will work:

iptables -t nat -A POSTROUTING -o venet0 -j SNAT --to-source <server public IP>

Answer 2

Did you check the firewall configuration? iptables -S

In iptables, if you have INPUT or OUTPUT default policies set to DROP, you will need will need to open the ports and allow access to the devices using iptables rules.

The CentOS wiki has a full walkthrough of iptables.

---

2014-04-16 Edit: Do you want to route all traffic over tun0?

route add -net 10.44.3.2 netmask 255.255.255.255 gw 73.83.42.22
route add default gw dev tun0 

Answer 3

On CentOS 7 works

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE