open vpen connection issue

Net_Spy

Greetings,

First of all I would like to thanks to all developers and contributors of openvpn , for making such a nice application.

I have two questions :

1# What is openvpnas , is it web based management or what.

2# When I connect openvpn it is not pinging to assigned IP of vpn and not passing my traffic for internet through vpn.

I do not now know what is wrong .

Server.conf

port 1194
proto udp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh1024.pem
server 10.10.10.0 255.255.255.0
mode server
push "redirect-gateway def1"
push "dhcp-option DNS 192.168.1.1"
push "dhcp-option DNS 208.67.222.222"
client-to-client
duplicate-cn
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status /var/log/openvpn.log
log /var/log/openvpn.log
verb 4
mute 20

Clients.conf

client
dev tun
dev-node vpn # my tap adaptor name
proto udp
remote x.x.x.x 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca C:/vpn/ca.crt
cert C:/vpn/client1.crt
key C:/vpn/client1.key
ns-cert-type server
comp-lzo
verb 3

Iptables Rules:

iptables -t nat -A POSTROUTING -s 10.10.10.0/24 -j SNAT --to 123.123.123.123

Enable forwarding as well.

I setup openvpn on my VPS. Now Ive download openvpn client and copied ca.cert and client generated cert key file as well to my windows machine and get connect but I can not browse internet via vpn.

Any idea what am I doing wrong ?.

Regards
Net_Spy

Mimiko

1) OpenVPN AS is a commercial product of OpenVPN.
2) Not all VPS hosts allow internet traffic redirecting. You did quite well on configuring VPN, but ask the hosters if they permit to redirect traffic and how it must be configured.

Net_Spy

Thanks for for your response. Now my quest is that Ive setup open vpn to my an other dedicated. server. Use same configuration above one.

Now Im unable to pass my internet traffic from vpn server . May that vps issue so I did configuration on my dedicated server .

Do I need to make route or such on server please advice what route do I need to add . Hope to hear from you guys.

Regards
Net_Spy

Net_Spy

Finally I make it work to route my traffic via vpn tunnel.

All I did is just added following IP tables rules.

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i eth0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT 
iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT

But when I try to ping vpn assigned gateway IP , it does not ping it but internet working fine 🙂. Pleaese let me know why I can not ping vpn assisnged gateway .

2nd thing is , what if I add following config into my server.conf file.

#Server config routing all traffic via vpn:

push "redirect-gateway def1"
route 10.0.0.0 255.0.0.0
route 172.16.0.0 255.240.0.0
route 192.168.0.0 255.255.0.0
push "route 192.16.33.0 255.255.255.0"

It is just making me confuse .

Regards
Net_Spy

Mimiko

But when I try to ping vpn assigned gateway IP , it does not ping

Do you have rule like:

iptables -A INPUT -tun0 -j ACCEPT
iptables -A OUTPUT -o tun0 -j ACCEPT

route 10.0.0.0 255.0.0.0
route 172.16.0.0 255.240.0.0
route 192.168.0.0 255.255.0.0
push "route 192.16.33.0 255.255.255.0"

Why you have to use this routes?

Net_Spy

Thank you mimiko to helping me out.

Ive removed following route cause I dont need them:

route 10.0.0.0 255.0.0.0
route 172.16.0.0 255.240.0.0
route 192.168.0.0 255.255.0.0
push "route 192.16.33.0 255.255.255.0"

One more thing is it possible to make connection to vpn time based like if I allow connection to stay for 1 day or 2 day or 24 hours only ?

Or the ceritfica we generate with build command will expire as per desire time .

Hope to hear from you.

Regards
Tehseen Javed

Mimiko

One more thing is it possible to make connection to vpn time based like if I allow connection to stay for 1 day or 2 day or 24 hours only ?

Or the ceritfica we generate with build command will expire as per desire time .

Time disconnection from OpenVPN is not realised in the OpenVPN itself, as OpenVPN must keep a stable tunnel as long as possible. So only a cron job may do disconnecting at certain time. Or as you say - set certificate expiration time and enable certificate renegotiation in server.

Net_Spy

Hello,

My vpn running fine. All I want is to block browsing request from vpn tunnel and allow the rest. Here is my IPTABLES rules.

iptables -t nat -F
#iptables -t nat -I POSTROUTING -o tun0 -m tcp -p tcp --dport 80 -j DROP
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i eth0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT
iptables -A INPUT -i tun0 -j ACCEPT
iptables -A OUTPUT -o tun0 -j ACCEPT
iptables -A INPUT -p udp --dport 1194 -j ACCEPT

Hope to hear from you guys.

Regards
Net_Spy

Mimiko

Use

iptables -I FORWARD -i tun0 -p tcp --dport 80 -j DROP