OpenVPN Connecting But Not changing IP

TechN9ne1730

As the title says, it connects just fine, but for some reason it does not change my IP.

server.conf

port 1194
proto udp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
log /var/log/openvpn.log
verb 3

Here is my client log:
http://pastebin.com/BWPTz2Uv
Server log:
http://pastebin.com/N6pNxH0Q
Note, I edited out the contents of the keys like country code and such just to be safe. I set the verb to 6 in both configs, and for the record I am running OpenVPN as an admin on a Win 7 Machine(client), the server is running Debian Wheezy.

janjust

why would your IP change in this setup? if you want to redirect all traffic via the VPN then add

push "redirect-gateway def1"

to the server config and restart the server openvpn process, then reconnect the client.

TechN9ne1730

janjust wrotewhy would your IP change in this setup?

TechN9ne1730

Sorry if this is a double post, but I forgot if I submitted a reply or not. With the mod preview restriction I can not see my posts until approved so here it is again with a slight update:

janjust wrotewhy would your IP change in this setup?

How should I know? Thats why I asked. 😉

New problem..after connecting I can not access any web sites. They just time out.

new server log:
http://pastebin.com/GW7vdEYS
new client log:
http://pastebin.com/AfWP91gF

I have NoMachine set up on the server(bassicly a VNC connection) and I can access websites fine with in the desktop environment.

janjust

you're now a registered user, so your posts are automatically approved.

As for your setup, try adding

echo 1 > /proc/sys/net/ipv4/ip_forwarding
iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE

to your server - most likely the return routes are going haywire.

TechN9ne1730

janjust wroteyou're now a registered user, so your posts are automatically approved.

Thanks!

As for your setup, try adding

echo 1 > /proc/sys/net/ipv4/ip_forwarding
iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE

to your server - most likely the return routes are going haywire.

The first line returned this:
#echo 1 > /proc/sys/net/ipv4/ip_forwarding
-bash: /proc/sys/net/ipv4/ip_forwarding: No such file or directory

But after adding the second line, everything is working fine now! Thanks alot!

TechN9ne1730

My posts are still not showing up instantly. :s

janjust

yep I noticed, seems to be something wrong with your userid in the database; I have no clue how to fix that, however.

I'm getting rusty, btw; that should have been

echo 1 > /proc/sys/net/ipv4/ip_forward

TechN9ne1730

Well I got no return off that command, so I dunno if thats a good thing or bad. Does it really make a difference? I hope that doesn't sound sarcastic as it is a serious question since everything works fine.

My next question is how would I be able to actually create csr,crt,etc files in to a user home dir and use them as the files specified in server.conf?

Thanks for all the help Jan. Feel free to delete any mostly redundant posts that no dot have an update in them if you would like to clean up the thread.

janjust

yes it is expected that you would not see any output.
The command was a bit superfluous, but without it your setup would not have worked - this simply means that IP forwarding/routing was set up elsewhere already.

As for generating keys and certs: read up on this at
http://openvpn.net/index.php/open-source/documentation/howto.html#pki

TechN9ne1730

Thanks again. Just for the sake of clarity, I assume the specific section I need is "Generate certificates & keys for 3 clients" since I already know how to make keys? And I don't need more then 2 keys, but out of curiosity could that be repeated an infinite number of times?

TechN9ne1730

Ok I am all set up and running, but I have one question I dont see covered in the howto. If it is, and I missed it,my apologies. Anyways, I created the certificates & keys for "client1" inside /etc/openvpn/keys and copied client1.csr, client1.crt, client1.key, ca.crt, and tls-auth.key to /home/client1/keys. Now I know ca.crt, server.crt,server.key,and tls-auth.key need to remain on the server where they are, but what about the client1 keys and certificates? I know they need to remain in the home dir, but what about the originals in /etc/openvpn/keys/ ? Can those client certs and keys be removed?

janjust

Proper key management would involve a separate box on which all keys are generated and stored. The openvpn server only needs

ca.crt
server.crt
server.key
ta.key
dhNNNN.pem

the client only needs

ca.crt
client1.crt
client1.key
ta.key

In theory, after generating the keys you can remove them from the 'keys' directory. I would not remove the certificates themselves, as you can use them to revoke a certificate that has been compromised.