0

I've got an OpenVPN server set up and it works wonderfully, with all internet traffic using the VPN connection. On one specific WiFi network, I can use telnet/openssl s_client to connect to web servers, but not in the browser. I really want to stress that this is not the typical "no internet with OpenVPN" question, but it's unique to one single network. Is there a good place to start looking to resolve this? Thanks for any advice, and here's relevant information:

OpenVPN 2.4.0 on Ubuntu 17.04 server config:

dev tun
ca ca.crt
cert server.crt
key server.key
dh dh4096.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
tls-auth ta.key 0
key-direction 0
cipher AES-256-GCM
auth SHA512
compress lz4-v2
push "compress lz4-v2"
user nobody
user nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
explicit-exit-notify 1
server-ipv6 <ipv6>
push "route-ipv6 2000::/3"

Client Viscosity on macOS Sierra using OpenVPN 2.4 config:

client
dev tun
proto udp
remote (host) 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
remote-cert-tls server
tls-auth ta.key 1
key-direction 1
cipher AES-256-GCM
auth SHA512
verb 3
<ca>
(certificate)
</ca>
<cert>
(certificate)
</cert>
<key>
(key)
</key>
<tls-auth>
(key)
</tls-auth>

Affected WiFi network, with unique features highlighted:

Authentication type: WPA2 enterprise using EAP-PEAP and MSCHAPv2, no certificate verification required (unique)
DNS servers: 8.8.8.8, 8.8.4.4
Search domains: macewan.ca (unique)
Local IP address: 10.60.34.32

What works:

telnet -4 www.google.ca 80
openssl s_client -connect www.google.ca:443
ssh with IP or domain

What doesn't work:

Browsing internet in any web browser on any host/domain
2
  • 1
    Dive in to the traffic, look for port 53 DNS queries and responses. Then check 3-way TCP handshake. Then it'd be nice to look at clients and server route table. Showing firewall iptables rules at server and client also would be nice. Is there something special with the "specific" WiFi like for example "wireless isolation" ? Sep 8 '17 at 15:27
  • I'm not sure about the wireless isolation, this is a university network that I don't have much information on. DNS should work as the host can be resolved using telnet/openssl, correct?
    – Nathan
    Sep 8 '17 at 15:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.