1

I set up an OpenVPN server on my VPS, using this guide: http://vpsnoc.com/blog/how-to-install-openvpn-on-a-debianubuntu-vps-instantly/

And I can connect to it without problems. Connect, that is, because no traffic is being redirected. When I try to load a webpage when connected to the vpn I just get an error.

This is the config file it generated:

dev tun
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
push "route 10.8.0.0 255.255.255.0"
push "redirect-gateway"
comp-lzo
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
group daemon
daemon

This is my iptables.conf

# Generated by iptables-save v1.4.4 on Sat May  7 13:09:44 2011
*raw
:PREROUTING ACCEPT [37938267:10998335127]
:OUTPUT ACCEPT [35616847:14165347907]
COMMIT
# Completed on Sat May  7 13:09:44 2011
# Generated by iptables-save v1.4.4 on Sat May  7 13:09:44 2011
*nat
:PREROUTING ACCEPT [794948:91051460]
:POSTROUTING ACCEPT [1603974:108147033]
:OUTPUT ACCEPT [1603974:108147033]
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
-A POSTROUTING -s 10.8.0.0/24 -o eth1 -j MASQUERADE
-A POSTROUTING -s 10.8.0.0/24 -o venet0 -j MASQUERADE
COMMIT
# Completed on Sat May  7 13:09:44 2011
# Generated by iptables-save v1.4.4 on Sat May  7 13:09:44 2011
*mangle
:PREROUTING ACCEPT [37938267:10998335127]
:INPUT ACCEPT [37677226:10960834925]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [35616847:14165347907]
:POSTROUTING ACCEPT [35680187:14169930490]
COMMIT
# Completed on Sat May  7 13:09:44 2011
# Generated by iptables-save v1.4.4 on Sat May  7 13:09:44 2011
*filter
:INPUT ACCEPT [37677226:10960834925]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [35616848:14165347947]
-A INPUT -i eth0 -j LOG --log-prefix "BANDWIDTH_IN:" --log-level 7
-A FORWARD -o eth0 -j LOG --log-prefix "BANDWIDTH_OUT:" --log-level 7
-A FORWARD -i eth0 -j LOG --log-prefix "BANDWIDTH_IN:" --log-level 7
-A OUTPUT -o eth0 -j LOG --log-prefix "BANDWIDTH_OUT:" --log-level 7
COMMIT
# Completed on Sat May  7 13:09:44 2011
  • Is the config you posted for your VPN server or client? Can you post both? What is the error you received when trying to load a webpage? – tehfink May 7 '11 at 22:52
3

Just make sure you add a NAT rule to permit outbound traffic over your server's gateway.

You haven't mentioned your client pool - so I'll just take a guess, but correct it to suit.

iptables -t nat -I POSTROUTING -o tun+ -s 10.8.1.0/24 -j MASQUERADE

And depending on your other firewall rules, you might need to add this too

iptables -P FORWARD ACCEPT
iptables -A INPUT -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -j ACCEPT

I also wrote a detailed configuration for a basic set-up here https://serverfault.com/a/403016/113375

2

You should try this :

edit server.conf and add :

push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"

Router config

echo "1" > /proc/sys/net/ipv4/ip_forward

Edit /etc/sysctl.conf and add

net.ipv4.ip_forward = 1

Then

sudo sh -c "iptables-save > /etc/iptables.rules"

REstart your VPN:

sudo service openvpn restart

This should worx

1

Make sure you have uncommented the below line in your /etc/sysctl.conf file

net.ipv4.ip_forward=1
0

Fix for Ubuntu/Debian

edit - /etc/openvpn/server.conf

add: push "redirect-gateway def1"

edit - /etc/sysctl.conf

add: net.ipv4.ip_forward=1

Add these rules to your Iptables:

iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT iptables -A FORWARD -j REJECT iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

Install dnsmasq - apt-get install dnsmasq

edit - /etc/openvpn/server.conf

add: push "dhcp-option DNS 10.8.0.1"

Reboot Server.

Server should now tunnel ipv4 and DNS traffic.

  • Hmm, dnsmasq doesn't want to start because "the" address is already in use. Is it talking about 10.8.0.1, my tun1 device? – skerit May 8 '11 at 21:11
  • Why not simply redefine the default route to use the VPN server as gateway ? – Kedare Jun 28 '11 at 19:28

protected by Community Oct 29 '18 at 1:27

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.