0

I have OpenVPN up and running on my server. I want all traffic from my clients to be routed trough the VPN server.

The client connects just fine but is unable to connect to the internet.

Server config:

port 443
proto udp
dev tun
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/brimstone.crt
key /etc/openvpn/certs/brimstone.key  # This file should be kept secret
dh /etc/openvpn/certs/dh4096.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push redirect-gateway def1
keepalive 10 120
tls-cipher DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-CAMELLIA256-SHA:DHE-RSA-AES256-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-RSA-AES128-SHA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA
cipher AES-256-CBC
auth SHA384
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

iptables-save:

# Generated by iptables-save v1.4.14 on Fri Jul 24 07:44:57 2015
*raw
:PREROUTING ACCEPT [69770:12550856]
:OUTPUT ACCEPT [52469:5225827]
COMMIT
# Completed on Fri Jul 24 07:44:57 2015
# Generated by iptables-save v1.4.14 on Fri Jul 24 07:44:57 2015
*nat
:PREROUTING ACCEPT [171:11702]
:POSTROUTING ACCEPT [136:8184]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -s 10.8.0.0/24 -o venet0 -j MASQUERADE
COMMIT
# Completed on Fri Jul 24 07:44:57 2015
# Generated by iptables-save v1.4.14 on Fri Jul 24 07:44:57 2015
*mangle
:PREROUTING ACCEPT [69770:12550856]
:INPUT ACCEPT [69068:12508784]
:FORWARD ACCEPT [684:41112]
:OUTPUT ACCEPT [52469:5225827]
:POSTROUTING ACCEPT [53153:5266939]
COMMIT
# Completed on Fri Jul 24 07:44:57 2015
# Generated by iptables-save v1.4.14 on Fri Jul 24 07:44:57 2015
*filter
:INPUT DROP [25:2952]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [320:45993]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -m state --state NEW -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 443 -j ACCEPT
-A FORWARD -s 10.8.0.0/24 -j ACCEPT
COMMIT
# Completed on Fri Jul 24 07:44:57 2015

Did I miss something when configuring the forwarding/routing?

edit:

Turns out I made quite a stupid mistake.. I wrote down the iptables rules I need and then forgot one, when actually applying them.

I forgot to allow FORWARDING for established or related sessions..

  • can the vpn server connect to the internet? – Sverre Jul 24 '15 at 9:45
  • yes, the server can access the internet. – apoc Jul 24 '15 at 9:51
  • I see you use venet0, so does that mean that this is a VM? have you allowed this traffic in the firewall in VM layer? – Sverre Jul 24 '15 at 10:44
  • It's a VPS and tun/tap is allowed for the server. – apoc Jul 24 '15 at 11:50
  • Please don't use words like 'SOLVED" in question titles. This doesn't mark a question as solved. If the question truly is solved, please post an answer and then mark the answer. – Michael Hampton Feb 6 '18 at 21:59
0

several things I can think of,

1) make sure your server is a router, e.g it will forward packages from your clients to other networks.. .this is done like this:

echo 1 > /proc/sys/net/ipv4/ip_forward

or to make this more permanent:

pico /etc/sysctl.conf

uncomment or add something like this:

net.ipv4.ip_forward=1

also, does the client get ip address and dns setup? maybe push DHCP over vpn is a good idea

  • I had /proc/sys/net/ipv4/ip_forward enabled, the tun0 adapter of the client gets the 10.8.0.6, I don't think DNS is tunneled, as I can successfully dig addresses, but can't access anything else. – apoc Jul 24 '15 at 10:12
  • do you run the openvpn client with proper rights? (in windows, administrator), so that routing will work? – Sverre Jul 24 '15 at 10:16
  • I run it as root.. – apoc Jul 24 '15 at 10:18
  • can you ssh from client to openvpn server? can you confirm that the traffic is routed via vpn on client? – Sverre Jul 24 '15 at 10:20
  • I can access the server via SSH. How may I confirm that? – apoc Jul 24 '15 at 10:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.