3

Good evening,

I'm facing an issue with my OpenVPN installation. Been at it for 3 days now but still cant figure out what is wrong for the life of me...

Basically the issue is that i'm able to connect to my server (ubuntu 14.04 dedicated box) from my client (win 7 pc), but although i'm connected i can NOT access internet and LAN (can't ping server at 10.0.0.1).

I have setup ip forwarding on the server and added iptable rules to the best of my knowledge, as well as setup port forwarding on the router; but still cant manage to get it in working order.

All help would be greatly appreciated as i'm still new to openvpn. Thank you all in advance for your precious time.

Please find below a copy of my server.conf, client.conf, and iptable rules.

Server.conf

dev tun
proto udp
port 1194
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh1024.pem
user nobody
group nogroup
server 10.8.0.0 255.255.255.0
persist-key
persist-tun
client-to-client
push "route 192.168.0.0 255.255.255.0"
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
log-append /var/log/openvpn
plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so openvpn
client-cert-not-required
username-as-common-name
management localhost 7505

IP tables

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     udp  --  anywhere             anywhere             udp dpt:openvpn

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  192.168.0.0/24       anywhere             ctstate NEW
ACCEPT     all  --  10.8.0.0/24          anywhere             ctstate NEW
ACCEPT     all  --  10.8.0.0/24          192.168.0.0/24       ctstate NEW

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Client.conf

client
dev tun
proto udp
remote 196.xxx.xxx.xxx 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
auth-user-pass
comp-lzo
verb 3
1

Summary:

  • The remote LAN is 192.168.0.0/24.

  • The OpenVPN network is 10.8.0.0/24.

  • You OpenVPN client get an IP in 10.8.0.0/24. Let's assume it is 10.8.0.42.

Trying to talk to the remote LAN:

  • When your OpenVPN client sends a packet to an IP in the remote LAN (let's say 192.168.0.56), it is sent with source address 10.8.0.42 and reaches the OpenVPN server.

  • The OpenVPN server drops it unless you have enabled IP forwarding sysctl -w net.ipv4.ip_forward=1).

  • If IP forwarding is enabled, 192.168.0.56 receives the packet and tries to reply by sending packets to 10.8.0.42 but it doesn't have a route for it. Instead it uses the default gateway. Unless the OpenVPN server happens to be the default gateway, the packet will be lost. You can check the route on the remote machine with ip route get 10.8.0.42.

Possible solutions:

  • add a route for to 10.8.0.0/24 each node in the LAN (ip route add 10.8.0.0/24 via $ip_of_vpn_server);

  • add a route to 10.8.0.0/24 on the default gateway

    • the packets will do a useless jump to the router instead of reaching directly the OpenVPN server;

    • but you send_redirects is enabled on the router and accept_redirects is enabled on the LAN nodes, the router will sent a ICMP redirect in order to indicate a better route and the LAN nodes should use this route afterwards;

  • setup NAT on the OpenVPN server in order to hide 10.8.0.0/24 addresses.

The same problem happens when trying to reach public IP from your OpenVPN client:

  • if you used the first or second solution, you must ensure that 10.8.0.0/24 is properly NATed by the router of the remote LAN;

  • if you used NAT in on the OpenVPN server you should not have to do anything else.

I'd suggest using the second solution. The less NAT you have the better.

0

IF you are able to connect to your VPN Server than you are most likely setup correctly for server/client to talk. The issue then becomes one of IP and routing. I usually use pfsense for my openvpn server rather than using the conf file but the effect should be the same.

Every time I've used openvpn, I have never gotten a connection on x.x.x.2 and can ping x.x.x.1 . It might be me, but I have seen it always start at .6 and router of .5

  1. When you connect to the vpn, check your ip address. ipconfig

  2. Check your routing table while connected route print

  3. see if you can ping your vpn IP and the gateway on the vpn. it might be in your case 10.8.0.5

If you can post your IPv4 routes that might help. and we can Narrow down where the issue is.

  • Hey @grag42 thanks for getting back at me so quick. When i connect to the VPN i get assigned 10.8.0.6. i have tried to ping the gateway(10.8.0.5) aswell as the server without success(10.8.0.1). <p>My routing table when connected (win7 client):</p> – BootFracture Jan 28 '15 at 23:02
  • My routing table when connected (win7 client): weshare.me/305d0f4490bec25e/routing_table_client.jpg Any idea what could be wrong?? appreciate your input – BootFracture Jan 28 '15 at 23:25
  • Your routing table did not get any routes set. On your client, you should be able to view the logs and see where it failed to set the routes. Running the vpn client as admin can fix this issue. or you can write a script or add the routes manually. as admin route add 10.8.0.0 mask 255.255.255.0 10.8.0.5 if 10.8.0.6 you may need to change the 0.5 to the interface of the server. – grag42 Jan 28 '15 at 23:43
0

Just because you have a VPN it does not necessarily mean that you can connect right away. You still have to 'tell' your client to route it's traffic over that VPN. If you try to connect to 10.0.0.1, and your client is in a different network, it will try to talk to it's default gateway. Instead you have to tell it to talk to the VPN connection instead.

In administrator CMD:

route add <remote network> <VPN IP>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.