0

I have been trying to better understand how OpenVPN works and so I have setup a OpenVPN server and client through VMs on my machine. I have an Ubuntu VM acting as the OpenVPN server and a Kali machine as the OpenVPN client (since Kali does not come with firewalls I though this will make it easier).

I have managed to set it up, passed the TLS verifications, get a confirmed connection from the Kali to the server but I cannot browse the internet!! I have enabled port forwarding (both now and on restarts), I have setup the ufw firewall on the server to allow port 1194 UDP through, however I still believe it is due to some other firewall issue on the Ubuntu server side but I cannot workout what it is and how to fix it. Any help you can give would be greatly appreciated!!

Below are some useful diagnostics to help. If you need any more then please feel free to ask.

Note: Internet browsing works fine when VPN is not active.

client_before_VPN_enabled: netstat-rn Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 0.0.0.0 192.168.1.254 0.0.0.0 UG 0 0 0 eth0 0.0.0.0 192.168.1.254 0.0.0.0 UG 0 0 0 eth0 192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0

client_while_VPN_enabled: netstat-rn Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 0.0.0.0 10.8.0.5 128.0.0.0 UG 0 0 0 tun0 0.0.0.0 192.168.1.254 0.0.0.0 UG 0 0 0 eth0 0.0.0.0 192.168.1.254 0.0.0.0 UG 0 0 0 eth0 10.8.0.1 10.8.0.5 255.255.255.255 UGH 0 0 0 tun0 10.8.0.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun0 128.0.0.0 10.8.0.5 128.0.0.0 UG 0 0 0 tun0 192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 192.168.1.96 192.168.1.254 255.255.255.255 UGH 0 0 0 eth0

iptables on server side - there is more but I dont want to put it in as I dont want to make the post too long. Chain INPUT (policy DROP) target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ufw-before-logging-input all -- anywhere anywhere
ufw-before-input all -- anywhere anywhere
ufw-after-input all -- anywhere anywhere
ufw-after-logging-input all -- anywhere anywhere
ufw-reject-input all -- anywhere anywhere
ufw-track-input all -- anywhere anywhere

Chain FORWARD (policy ACCEPT) target prot opt source destination
ufw-before-logging-forward all -- anywhere anywhere
ufw-before-forward all -- anywhere anywhere
ufw-after-forward all -- anywhere anywhere
ufw-after-logging-forward all -- anywhere anywhere
ufw-reject-forward all -- anywhere anywhere
ufw-track-forward all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT) target prot opt source destination
ufw-before-logging-output all -- anywhere anywhere
ufw-before-output all -- anywhere anywhere
ufw-after-output all -- anywhere anywhere
ufw-after-logging-output all -- anywhere anywhere
ufw-reject-output all -- anywhere anywhere
ufw-track-output all -- anywhere anywhere

Any help you can give would be great. Thanks allot.

0

If your client can ping the address 'eth0' of your server I think you miss a NAT basic rule as "iptables -t nat -A POSTROUTING -j MASQUERADE" for browsing to internet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.