I have a VPS (Debian stable) with one network interface and one public IP address configured on it. I installed on that VPS the openvpn package, and I wanted to configure an VPN server. I was using this HOWTO.
Here are the config files.
Server:
# egrep -v "^#|^;|^$" /etc/openvpn/server-vpn.conf
local 151.80.57.162
port 11941
proto udp
dev tun
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/server-vpn.crt
key /etc/openvpn/certs/server-vpn.key
dh /etc/openvpn/certs/dh4096.pem
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
cipher AES-256-CBC
auth SHA512
keysize 256
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 4
Client:
# egrep -v "^#|^;|^$" /etc/openvpn/client-vpn.conf
client
dev tun
proto udp
remote 151.80.57.162 11941
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/client-vpn.crt
key /etc/openvpn/certs/client-vpn.key
remote-cert-tls server
cipher AES-256-CBC
auth SHA512
keysize 256
comp-lzo
verb 4
auth-nocache
script-security 2
up /etc/openvpn/update-resolv-conf.sh
down /etc/openvpn/update-resolv-conf.sh
I also enabled forwarding on the server and added NAT rule:
# iptables -S FORWARD
-P FORWARD DROP
-A FORWARD -s 10.8.0.0/24 -i tun0 -o eth0 -j ACCEPT
-A FORWARD -d 10.8.0.0/24 -i eth0 -o tun0 -j ACCEPT
# iptables -S -t nat
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 151.80.57.162
# sysctl -a | grep -i net.ipv4.ip_forward
net.ipv4.ip_forward = 1
The VPN port is also opened in the INPUT chain.
I'm able to ping the server from the client and also the client from the server. So the connection works well. Here's the routing table on the client after establishing the tunnel:
$ ip route show
0.0.0.0/1 via 10.8.0.1 dev tun0 default via 192.168.1.1 dev eth0
10.8.0.0/24 dev tun0 proto kernel scope link src 10.8.0.4
128.0.0.0/1 via 10.8.0.1 dev tun0
151.80.57.162 via 192.168.1.1 dev eth0
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.150
192.168.10.0/24 dev br-lxc proto kernel scope link src 192.168.10.100
Here are the eth0 and tun0 interfaces on the client:
$ ip addr show eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 3c:4a:92:00:4c:5b brd ff:ff:ff:ff:ff:ff
inet 192.168.1.150/24 brd 192.168.1.255 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::3e4a:92ff:fe00:4c5b/64 scope link
valid_lft forever preferred_lft forever
$ ip addr show tun0
74: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 100
link/none
inet 10.8.0.4/24 brd 10.8.0.255 scope global tun0
valid_lft forever preferred_lft forever
inet6 fe80::dc57:9092:9cc2:abcc/64 scope link flags 800
valid_lft forever preferred_lft forever
And here are also routes and interfaces on the server:
# ip route show
default via 151.80.57.1 dev eth0
10.8.0.0/24 dev tun0 proto kernel scope link src 10.8.0.1
151.80.57.1 dev eth0 scope link
# ip addr show eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether fa:16:3e:dd:db:03 brd ff:ff:ff:ff:ff:ff
inet 151.80.57.162/32 brd 151.80.57.162 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::f816:3eff:fedd:db03/64 scope link
valid_lft forever preferred_lft forever
# ip addr show tun0
60: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 100
link/none
inet 10.8.0.1/24 brd 10.8.0.255 scope global tun0
valid_lft forever preferred_lft forever
So the connection between the client and the server can be established and it looks like that it works well. But when I want to send some traffic via this VPN server, it works only partially. I mean some of the client's traffic is successfully routed through the VPN but some of it don't, and I don't know why.
Wireshark shows something like this (the tun0 interface on the client):
And I think that's why pages in FF don't load, but my jabber client works well, as you can see on the same picture. DNS also works. I can ping 8.8.8.8 and resolve domains through the VPN, but for some reasons WWW/MAIL traffic (and probably some others as well) can't make it through the VPN server.
Looking at the VPN server logs (verb 4), I can see lots of the following messages:
Wed Nov 30 17:59:48 2016 us=146856 client-vpn/94.254.226.118:7669 MULTI: bad source address from client [192.168.1.150], packet dropped
Wed Nov 30 17:59:48 2016 us=421203 client-vpn/94.254.226.118:7669 MULTI: bad source address from client [192.168.1.150], packet dropped
Wed Nov 30 17:59:49 2016 us=10514 client-vpn/94.254.226.118:7669 MULTI: bad source address from client [192.168.1.150], packet dropped
I have other VPN servers that I connect to, but they're not mine and the connections work without problems, so something is wrong probably with my VPN server. I just want to connect to the VPN in order to change my own IP address when browsing the net. So the question is: how to make the VPN work?
