Another successful connection but no internet

Sereniity

I have been on this for hours and I'm totally lost as to what I'm supposed to do, here's my setup:

ReadyNAS running OpenVPN - 192.168.1.10

Client is Viscosity on OSX

The client connects to the server fine, but it just doesn't connect to the internet, I can browse shares on the NAS fine.

I followed this guide to the letter - http://blog.roychowdhury.org/2011/05/10/adding-a-vpn-server-to-readynas/

server.conf:

local 192.168.1.10
port 1195
proto udp
mssfix 1400
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/JellyVPN.crt
key /etc/openvpn/JellyVPN.key
dh /etc/openvpn/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.1.0 255.255.255.0"  <-- I've tried both of these
;push "redirect-gateway def1"               <--
keepalive 10 120
cipher BF-CBC
comp-lzo
max-clients 2
persist-key
persist-tun
status openvpn-status.log
verb 4
user openvpn
group openvpn

Client.conf

I can't copy this as it's via a GUI but this is what information I can get from it:

proto udp
dev tun
remote my.dyndns.org
port 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert Client01.crt
key Client01.key
ns-cert-type server
cipher BF-CBC
comp-lzo

I set up a static route on my 7800N router but it didn't do anything to give me internet access.

This is the OpenVPN log if needed:

Tue May  1 22:19:27 2012 us=617008 OpenVPN 2.0.9 i486-pc-linux-gnu [SSL] [LZO] [EPOLL] built on Sep 20 2007
Tue May  1 22:19:27 2012 us=622451 Diffie-Hellman initialized with 1024 bit key
Tue May  1 22:19:27 2012 us=622938 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue May  1 22:19:27 2012 us=623328 TUN/TAP device tun0 opened
Tue May  1 22:19:27 2012 us=623355 TUN/TAP TX queue length set to 100
Tue May  1 22:19:27 2012 us=623381 ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Tue May  1 22:19:27 2012 us=625508 route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Tue May  1 22:19:27 2012 us=626861 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue May  1 22:19:27 2012 us=628301 GID set to openvpn
Tue May  1 22:19:27 2012 us=628359 UID set to openvpn
Tue May  1 22:19:27 2012 us=628389 Socket Buffers: R=[1048576->131072] S=[1048576->131072]
Tue May  1 22:19:27 2012 us=628414 UDPv4 link local (bound): 192.168.1.10:1195
Tue May  1 22:19:27 2012 us=628424 UDPv4 link remote: [undef]
Tue May  1 22:19:27 2012 us=628442 MULTI: multi_init called, r=256 v=256
Tue May  1 22:19:27 2012 us=628612 IFCONFIG POOL: base=10.8.0.4 size=62
Tue May  1 22:19:27 2012 us=628655 IFCONFIG POOL LIST
Tue May  1 22:19:27 2012 us=628666 Kasia,10.8.0.4
Tue May  1 22:19:27 2012 us=628693 Initialization Sequence Completed
Tue May  1 22:21:26 2012 us=359085 MULTI: multi_create_instance called
Tue May  1 22:21:26 2012 us=359192 192.168.1.254:62389 Re-using SSL/TLS context
Tue May  1 22:21:26 2012 us=359244 192.168.1.254:62389 LZO compression initialized
Tue May  1 22:21:26 2012 us=359420 192.168.1.254:62389 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue May  1 22:21:26 2012 us=359435 192.168.1.254:62389 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue May  1 22:21:26 2012 us=359475 192.168.1.254:62389 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Tue May  1 22:21:26 2012 us=359486 192.168.1.254:62389 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Tue May  1 22:21:26 2012 us=359514 192.168.1.254:62389 Local Options hash (VER=V4): '530fdded'
Tue May  1 22:21:26 2012 us=359529 192.168.1.254:62389 Expected Remote Options hash (VER=V4): '41690919'
Tue May  1 22:21:26 2012 us=359566 192.168.1.254:62389 TLS: Initial packet from 192.168.1.254:62389, sid=1a25c768 f6c6563b
Tue May  1 22:21:26 2012 us=995759 192.168.1.254:62389 VERIFY OK: depth=1, /C=UK/ST=NA/L=IBORO/O=JellyVPN/CN=Jelly/emailAddress=email
Tue May  1 22:21:26 2012 us=995917 192.168.1.254:62389 VERIFY OK: depth=0, /C=UK/ST=NA/O=JellyVPN/CN=Kasia/emailAddress=email
Tue May  1 22:21:27 2012 us=189875 192.168.1.254:62389 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue May  1 22:21:27 2012 us=189909 192.168.1.254:62389 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue May  1 22:21:27 2012 us=189962 192.168.1.254:62389 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue May  1 22:21:27 2012 us=189974 192.168.1.254:62389 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue May  1 22:21:27 2012 us=235773 192.168.1.254:62389 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue May  1 22:21:27 2012 us=235822 192.168.1.254:62389 [Kasia] Peer Connection Initiated with 192.168.1.254:62389
Tue May  1 22:21:27 2012 us=235907 Kasia/192.168.1.254:62389 MULTI: Learn: 10.8.0.6 -> Kasia/192.168.1.254:62389
Tue May  1 22:21:27 2012 us=235921 Kasia/192.168.1.254:62389 MULTI: primary virtual IP for Kasia/192.168.1.254:62389: 10.8.0.6
Tue May  1 22:21:29 2012 us=643561 Kasia/192.168.1.254:62389 PUSH: Received control message: 'PUSH_REQUEST'
Tue May  1 22:21:29 2012 us=643689 Kasia/192.168.1.254:62389 SENT CONTROL [Kasia]: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.1,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)

Any help would be greatly appreciated, I've read so many guides and posts about this but I just don't get it (could be due to tiredness but hey, we can't know it all 😉)

Many thanks. (p.s I won't be able to reply until 1800GMT)

janjust

check the routing table on the mac os client - the server does push "redirect-gateway def1" but perhaps the viscosity client is not picking this up correctly.

Sereniity

I don't know what I'm supposed to be looking for here:

netstat -rn - this is with the vpn connected

Routing tables

Internet:
Destination        Gateway            Flags        Refs      Use   Netif Expire
default            192.168.44.1       UGSc           25        5     en2
10.8.0.1/32        10.8.0.5           UGSc            0        0    tun0
10.8.0.5           10.8.0.6           UH              2        0    tun0
10.37.129/24       link#9             UC              2        0   vnic1
10.37.129.2        0:1c:42:0:0:9      UHLWIi          1        1     lo0
10.37.129.255      ff:ff:ff:ff:ff:ff  UHLWbI          0        1   vnic1
10.211.55/24       link#8             UC              2        0   vnic0
10.211.55.2        0:1c:42:0:0:8      UHLWIi          1        1     lo0
10.211.55.255      ff:ff:ff:ff:ff:ff  UHLWbI          0        1   vnic0
127                127.0.0.1          UCS             0        0     lo0
127.0.0.1          127.0.0.1          UH             17   704406     lo0
169.254            link#10            UCS             0        0     en2
192.168.1          10.8.0.5           UGSc            0        0    tun0
192.168.44         link#10            UCS             2        0     en2
192.168.44.1       90:21:55:8d:34:b9  UHLWIi         26      105     en2   1194
192.168.44.226     127.0.0.1          UHS             0        0     lo0
192.168.44.255     ff:ff:ff:ff:ff:ff  UHLWbI          0        1     en2

I tried: iptables -t nat -i POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

But iptables doesn't exist in osx apparantly, so again, I'm lost - is there another command I can use to add the same information above in an osx command format to achieve the same thing?

I also tried iptables on the nas but the kernel doesn't support it or so I've read.

janjust

just as I thought - the viscosity client does not seem to pick up the 'redirect-gateway' correctly. That's a viscosity issue (of which I know nothing).

Sereniity

Odd, I shall try tunnelblick tomorrow, thanks for the reply.