11

I have openvpn on a remote server, it's Arch Linux. I'm able to connect to it, but there's no internet after I connect, meaning, when I open a browser and trying to load a website, it's getting stock at "looking up..."

No errors on either side. The server isn't behind NAT, as far as I can see, I'm -- a client -- is.

No firewall on the server.

Something related to routing, forwarding I figure?

3
  • Client machine - Windows or Linux? May 19, 2017 at 6:07
  • @AlexanderT, linux
    – Jodarim255
    May 19, 2017 at 8:05
  • Could you include the client's output? Is should print the routing commands the client tries to execute.
    – Lacek
    May 19, 2017 at 8:48

3 Answers 3

5

When you create a VPN connection between your client and VPN server, a private network is formed between the two, with address starting with 192.168.x.x, 10.x.x.x or 172.16.x.x.

When you want to route traffic from the VPN client to the global Internet, you must use NAT on the server so that it translates the VPN client's private network address to the server's public IP address.

This is independent of the fact that your client's connection is behind NAT or not.

So, in addition to installing the VPN software, you need to add firewall rules for NAT in your server.

2
  • ok. 1) why particulary 192.168.x.x, 10.x.x.x or 172.16.x.x. ? 2) by firewall rules, do you mean I have to install and turn on firewall? 3) and create forwarding rules via iptables?
    – Jodarim255
    May 19, 2017 at 13:58
  • 1
    1) Those are subnets specified in RFC1918 for non-routable private networks. 2,3) Yes. May 19, 2017 at 13:59
18

I checked your logs and haven't find any problems. But you said that there is No firewall on the server. It could cause problems, because you should enable forwarding for working NAT. Here is output from guide.

ufw

In order to configure your ufw settings for VPN traffic first add the following to /etc/default/ufw:

DEFAULT_FORWARD_POLICY="ACCEPT"

Now change /etc/ufw/before.rules, and add the following code after the header and before the "*filter" line. Do not forget to change the IP/subnet mask to match the one in /etc/openvpn/server/server.conf. The adapter ID in the example is generically called eth0 so edit it for your system accordingly.

/etc/ufw/before.rules

# NAT (Network Address Translation) table rules
*nat
:POSTROUTING ACCEPT [0:0]

# Allow traffic from clients to eth0
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

# do not delete the "COMMIT" line or the NAT table rules above will not be processed
COMMIT

Open OpenVPN port 1194:

# ufw allow 1194

Lastly, reload UFW:

# ufw reload

iptables

In order to allow VPN traffic through your iptables firewall of your server, first create an iptables rule for NAT forwarding [3] on the server, assuming the interface you want to forward to is named eth0:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

And don't forget to enable forwarding in sysctl

sysctl -w net.ipv4.ip_forward=1
17
  • if there's no firewall, why on earh woul there be any problem? no nat, no firewall
    – Jodarim255
    May 19, 2017 at 10:54
  • @Jodarim255 you don't have internet on your machine? Or you want to pass al your traffic trough VPN? Because during connection it route all traffic to your VPN connection May 19, 2017 at 11:07
  • these 2 questions are unrelated. "you didn't eat your breakfest? or you're a java programmer?"
    – Jodarim255
    May 19, 2017 at 11:59
  • I want to connect to openvpn on the server, what's not clear? of course, I have internet, of course, all traffic will be tunnelled through vpn.
    – Jodarim255
    May 19, 2017 at 12:00
  • 1
    It's worth nothing using ufw with nftables can result in weird behavior and things not working properly... In my case, I had NAT and forwarding configured and working fine for years but after a Debian upgrade, packets would go no further than the OpenVPN server. It turns out that Buster defaults to using nftables. Going back to iptables-legacy fixes the issue.
    – Léo Lam
    Feb 12, 2020 at 18:19
0

Perhaps permissions on install of the OpenVPN Linux client as it was NOT creating a TUN. So I made one myself (that was the actual issue):

sudo ip tuntap add name tun0 mode tun
sudo ip link show

and it connected after asking for VPN Username & Password.

FYI openvpn3 linux client auto installer may help you too: https://github.com/OpenVPN/openvpn3-linux

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .