5

I setup an Openvpn server on a centos box and I can get the client to connect (osx) but can't access the internet or even the local network. I thought maybe DNS but couldn't access any sites via IP. Any help would be appreciated. I will list my config files below.

server.conf:::

port 1194 #- port
proto udp #- protocol
dev tun
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
reneg-sec 0
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh2048.pem
plugin /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so /etc/pam.d/login #- Comment this line if you are using FreeRADIUS
#plugin /etc/openvpn/radiusplugin.so /etc/openvpn/radiusplugin.cnf #- Uncomment this line if you are using FreeRADIUS
client-cert-not-required
username-as-common-name
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 5 30
comp-lzo
persist-key
persist-tun
status 1194.log
verb 3


client.conf:::

client
dev tun
proto udp
remote My server IP 1194 # - Your server IP and OpenVPN Port
resolv-retry infinite
nobind
tun-mtu 1500
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
auth-user-pass
comp-lzo
verb 3


ifconfig (client)::

    lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
    options=3<RXCSUM,TXCSUM>
    inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 
    inet 127.0.0.1 netmask 0xff000000 
    inet6 ::1 prefixlen 128 
gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
stf0: flags=0<> mtu 1280
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    ether 10:40:f3:88:27:6c 
    inet6 fe80::1240:f3ff:fe88:276c%en0 prefixlen 64 scopeid 0x4 
    inet 192.168.1.11 netmask 0xffffff00 broadcast 192.168.1.255
    media: autoselect
    status: active
p2p0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 2304
    ether 02:40:f3:88:27:6c 
    media: autoselect
    status: inactive
tun0: flags=8851<UP,POINTOPOINT,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    inet 10.8.0.6 --> 10.8.0.5 netmask 0xffffffff 
    open (pid 7494)

    ifconfig (server)::

eth0      Link encap:Ethernet  HWaddr 00:23:54:03:F2:BB
          inet addr:192.168.0.10  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: fe80::223:54ff:fe03:f2bb/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:113530 errors:0 dropped:0 overruns:0 frame:0
          TX packets:13376 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:25518343 (24.3 MiB)  TX bytes:1310138 (1.2 MiB)
          Interrupt:26 Base address:0xe000

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:6 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:828 (828.0 b)  TX bytes:828 (828.0 b)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:397 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
1
  • 1
    Your client's tun0 says that its remote endpoint it 10.8.0.5, but the server's tun0 address is 10.8.0.1. I find that odd. Aug 26, 2013 at 20:16

4 Answers 4

1

Firstly check that you can ping the OpenVPN Servers VPN Range IP, 10.8.0.1, assuming that is successful:

https://community.openvpn.net/openvpn/wiki/BridgingAndRouting

Follow the instructions under Using Routing, it assumes your internet connection is eth0, if it isn't change the value to your internet connections adapter identifier (ppp0, atm0) etc. It also assumes that your OpenVPN server is your main router for the internet connection.

1

In client box, do these testing:

1. Ping 10.8.0.1, if not ok check client/server firewall let ICMP can pass through, then we can debug deeply.
2. Ping 192.168.0.10, if not ok check:
    A. Client routing table, where the traffic goes while destination network is 192.168.0.0/24, it should go to 10.8.0.5/tun0
    B. Server sysctl net.ipv4.ip_forward, it should be 1.
    C. Server NAT/MASQUERADE with iptables.
3. Traceroute 8.8.8.8, if not ok check which hop stopped the traffic.
4
  • 1
    You can't just route VPN traffic out it's using an RFC1918 address, it has to be NAT'd or masqueraded, also if you read his config file, you'd know that he has the VPN client pushing the default route (ie everything not otherwise specified) through the VPN.
    – Aaron Tate
    Aug 26, 2013 at 8:02
  • Yeah, forget the masquerade.
    – Sunry
    Aug 26, 2013 at 8:04
  • 1. OK 2. OK 3. doesn't even get 1 hop.
    – Fr0ntSight
    Aug 26, 2013 at 22:37
  • Your client doesn't konw where to direct the traffic to 8.8.8.8, check client's route table, the traffic destination to 8.8.8.8 should route to 10.8.0.5/tun0 also.
    – Sunry
    Aug 26, 2013 at 23:28
1

After configuring your OpenVPN server and client, there's one more thing which needs to be done: Add a route on each computer (or in your network's router) in the local network which is supposed to communicate with computers in the vpn network.

Example:

My home network is: 10.13.0.0/24
OpenVPN network is: 10.14.0.0/24

The OpenVPN server physical NIC is configured as: 10.13.0.1/24

The OpenVPN server vpn NIC is configured as: 10.14.0.1/24

When my client connects to the VPN it gets IP: 10.14.0.6/24 In order for the other computers on the 10.13.0.0/24 network (home computers) to be able to communicate with machines which are connected through vpn I had to add a specific route:

route add -net 10.14.0.0/24 gw 10.13.0.1 metric 1

This enables computers on the home network to communicate with computers on the OpenVPN network and vice versa.

In your case it will enable your network computers to communicate with the vpn computers.

I wrote a very detailed article on How to install and configure OpenVPN server and the above steps are described there, feel free to check it out... it may help you: How To: OpenVPN on CentOS

0

on windows, the client have to run as "Administrator" otherwise the routing will not work. I wonder if there is something similar on mac? what openvpn client (if any) do you use on the mac? have you tried to run with elevated permissions?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .