0

I've issue on my Openvpn server where a client is unable to reach the internet via the server.

Client can successfully connect to the Openvpn server and route is being pushed towards the server properly, but my test ping to google dns (8.8.8.8) doesn't work.

I know many users have already posted their problems and have a solution, I've already did all the tips/solutions but to no avail. I can't even ping from this client to 10.8.0.1. I've disabled all ICMP blocking on the server but I manage to ping public interface (facing internet- en0).

My Setup:

Client ----> OpenVPN Server ----> Public internet

iptables configuration:

*mangle
:PREROUTING ACCEPT [1381:181833]
:INPUT ACCEPT [1381:181833]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [670:141877]
:POSTROUTING ACCEPT [670:141877]
-A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
COMMIT

*nat
:PREROUTING ACCEPT [41:3498]
:INPUT ACCEPT [41:3498]
:OUTPUT ACCEPT [1:164]
:POSTROUTING ACCEPT [1:164]
-A POSTROUTING -s 10.8.0.0/24 -o eno1 -j MASQUERADE
COMMIT

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [16:3245]
-A INPUT -p tcp -m tcp --dport 2288 -j ACCEPT
-A INPUT -s 127.0.0.1/32 -p udp -m udp --dport 111 -j ACCEPT
-A INPUT -p udp -m udp --dport 111 -j DROP
-A INPUT -i tun0 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i tun0 -p tcp -m tcp --dport 1194 -j ACCEPT
-A FORWARD -i eth0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.8.0.0/24 -o eth0 -j ACCEPT
-A FORWARD -i tun0 -j ACCEPT
-A FORWARD -i eno0 -o tun+ -j ACCEPT
-A FORWARD -i tun+ -o eno0 -j ACCEPT
COMMIT

server.conf:

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
cipher AES-256-CBC
comp-lzo
user nobody
group nobody
status openvpn-status.log
verb 3

client config:

client
dev tun
proto udp
remote <server> 1194
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo
verb 3
ca ca.crt
cert client.crt
key client.key

NIC's details:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eno1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
    link/ether 00:1e:c9:f8:e6:b4 brd ff:ff:ff:ff:ff:ff
    inet - brd - scope global eno1
       valid_lft forever preferred_lft forever
    inet6 2001:f40:0:1::f5:a/126 scope global 
       valid_lft forever preferred_lft forever
    inet6 fe80::7a50:f43b:ba31:ab6/64 scope link 
       valid_lft forever preferred_lft forever
3: eno2: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN qlen 1000
    link/ether 00:1e:c9:f8:e6:b5 brd ff:ff:ff:ff:ff:ff
4: enp7s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast state DOWN qlen 1000
    link/ether 00:15:17:8f:f3:09 brd ff:ff:ff:ff:ff:ff
6: virbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN qlen 1000
    link/ether 52:54:00:a9:e6:9d brd ff:ff:ff:ff:ff:ff
    inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0
       valid_lft forever preferred_lft forever
7: virbr0-nic: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast master virbr0 state DOWN qlen 1000
    link/ether 52:54:00:a9:e6:9d brd ff:ff:ff:ff:ff:ff
8: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100
    link/none 
    inet 10.8.0.1 peer 10.8.0.2/32 scope global tun0
       valid_lft forever preferred_lft forever

I highly suspect that the problem is with my iptables configuration, but I don't know what to do more than what I've done already.

I think I've messed up iptables already, hope we may find answer together.

| improve this question | | | | |
  • I don't see a rule like this: -I INPUT -p udp -s 0.0.0.0/0 --dport 1194 -j DROP which means you allow all udp traffic on port 1194 into the machine (openvpn port. Can you please include the error you get when you try to ping 8.8.8.8? thanks – Itai Ganot Mar 29 '17 at 11:35
  • when i ping 8.8.8.8 from client, it just request timeout. and also i've traceroute not even go to 1st hop. – razerzone1 Mar 30 '17 at 7:55
  • Is the client a virtual machine? – Itai Ganot Mar 30 '17 at 8:06
  • no, its not vm. – razerzone1 Apr 4 '17 at 1:28
0

If you've installed Openvpn server and iptables is blocking the service by default then use these configurations for Openvpn to function properly.

First let's allow the tcp connection on the openvpn port. If you are using udp or another port number then change this line accordingly.

iptables -A INPUT -i eth0 -m state --state NEW -p udp --dport 1194 -j ACCEPT

Allow TUN interface connections to OpenVPN server:

iptables -A INPUT -i tun+ -j ACCEPT

Allow TUN interface connections to be forwarded through other interfaces

iptables -A FORWARD -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT

NAT the VPN client traffic to the Internet. change the ip address mask according to your info of tun0 result while running "ifconfig" command.

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

If your default iptables OUTPUT value is not ACCEPT, you will also need a line like:

iptables -A OUTPUT -o tun+ -j ACCEPT

That's it now restart the iptables service and it should work.

Also, make sure that the client's configuration is configured to connect to the proper server address incase you forgot to change the <server> line.

More information can be found here.

This is a good article which explains how to install OpenVPN server correctly and how to configure it.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.