3

I have openvpn on a remote server, it's Arch Linux. I'm able to connect to it, but there's no internet after I connect, meaning, when I open a browser and trying to load a website, it's getting stock at "looking up..."

No errors on either side. The server isn't behind NAT, as far as I can see, I'm -- a client -- is.

No firewall on the server.

Something related to routing, forwarding I figure?

  • Client machine - Windows or Linux? – Alexander Tolkachev May 19 '17 at 6:07
  • @AlexanderT, linux – Jodarim255 May 19 '17 at 8:05
  • Could you include the client's output? Is should print the routing commands the client tries to execute. – Lacek May 19 '17 at 8:48
2

When you create a VPN connection between your client and VPN server, a private network is formed between the too, with address starting with 192.168.x.x, 10.x.x.x or 172.16.x.x.

When you want to route traffic from the VPN client to the global Internet, you must use NAT on the server so that it translates the VPN client's private network address to the server's public IP address.

This is independent of the fact if your client's connection is behind NAT or not.

So, in addition to installing the VPN software, you need to add firewall rules for NAT in your server.

  • ok. 1) why particulary 192.168.x.x, 10.x.x.x or 172.16.x.x. ? 2) by firewall rules, do you mean I have to install and turn on firewall? 3) and create forwarding rules via iptables? – Jodarim255 May 19 '17 at 13:58
  • 1
    1) Those are subnets specified in RFC1918 for non-routable private networks. 2,3) Yes. – Tero Kilkanen May 19 '17 at 13:59
8

I checked your logs and haven't find any problems. But you said that there is No firewall on the server. It could cause problems, because you should enable forwarding for working NAT. Here is output from guide.

ufw

In order to configure your ufw settings for VPN traffic first add the following to /etc/default/ufw:

DEFAULT_FORWARD_POLICY="ACCEPT"

Now change /etc/ufw/before.rules, and add the following code after the header and before the "*filter" line. Do not forget to change the IP/subnet mask to match the one in /etc/openvpn/server/server.conf. The adapter ID in the example is generically called eth0 so edit it for your system accordingly.

/etc/ufw/before.rules

# NAT (Network Address Translation) table rules
*nat
:POSTROUTING ACCEPT [0:0]

# Allow traffic from clients to eth0
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

# do not delete the "COMMIT" line or the NAT table rules above will not be processed
COMMIT

Open OpenVPN port 1194:

# ufw allow 1194

Lastly, reload UFW:

# ufw reload

iptables

In order to allow VPN traffic through your iptables firewall of your server, first create an iptables rule for NAT forwarding [3] on the server, assuming the interface you want to forward to is named eth0:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

And don't forget to enable forwarding in sysctl

sysctl -w net.ipv4.ip_forward=1
  • if there's no firewall, why on earh woul there be any problem? no nat, no firewall – Jodarim255 May 19 '17 at 10:54
  • @Jodarim255 you don't have internet on your machine? Or you want to pass al your traffic trough VPN? Because during connection it route all traffic to your VPN connection – Alexander Tolkachev May 19 '17 at 11:07
  • these 2 questions are unrelated. "you didn't eat your breakfest? or you're a java programmer?" – Jodarim255 May 19 '17 at 11:59
  • I want to connect to openvpn on the server, what's not clear? of course, I have internet, of course, all traffic will be tunnelled through vpn. – Jodarim255 May 19 '17 at 12:00
  • @Jodarim255 so, you should use NAT on your OpenVPN server to have access to Internet trough VPN, as you use NAT to have access to Internet from your home, – Alexander Tolkachev May 19 '17 at 12:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.