[resolved] Routing issue

Miles

I setup OpenVPN using the easy-RSA script on my server.

Here is the config file :

# Serveur TCP/443
mode server
proto tcp
port 443
dev tun

# Cles et certificats

ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
tls-auth ta.key 0
cipher AES-256-CBC

# Reseau

server 10.53.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 10.53.0.1" # Définit le serveur VPN comme DNS par défaut
push "dhcp-option DNS 4.4.4.4"
push "dhcp-option DNS 8.8.8.8"

keepalive 10 120

# Securite

user nobody
group nogroup
chroot /etc/openvpn/jail
persist-key
persist-tun
comp-lzo

# Log

verb 3
mute 20
status openvpn-status.log
log-append /var/log/openvpn.log

I can connect to my VPN using my Windows OpenVPN client. But I can not access any server or website other than the openvpn server, using either its DNS or its own IP : it's like there is no routing outwards the VPN.

IPTables firewall config is as follows :

# VPN

iptables -t nat -A POSTROUTING -s 10.53.0.0/16 -j MASQUERADE

# ouverture du 443 pour openvpn
iptables -t filter -A OUTPUT -p tcp --dport 443 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 443 -j ACCEPT

Server routing table :

# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.200.1   0.0.0.0         UG    0      0        0 eth0
10.53.0.0       10.53.0.2       255.255.255.0   UG    0      0        0 tun0
10.53.0.2       *               255.255.255.255 UH    0      0        0 tun0
localnet        *               255.255.255.0   U     0      0        0 eth0

Local routing table:

C:\Users\Florian>netstat -nr
===========================================================================
Liste d'Interfaces
 41...00 ff bf 3f dc 1a ......TAP-Win32 Adapter V9
 25...08 00 27 00 e4 5c ......VirtualBox Host-Only Ethernet Adapter
 19...e0 b9 a5 b3 57 9c ......Microsoft Virtual WiFi Miniport Adapter
 12...00 90 f5 c0 f6 8b ......JMicron PCI Express Gigabit Ethernet Adapter
 11...e0 b9 a5 b3 57 9c ......Realtek RTL8188CE Wireless LAN 802.11n COMBO PCI-E NIC
 17...7a 79 05 d9 58 cb ......Hamachi Network Interface
  1...........................Software Loopback Interface 1
 39...00 00 00 00 00 00 00 e0 Carte Microsoft ISATAP
 13...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
 45...00 00 00 00 00 00 00 e0 Carte Microsoft ISATAP #3
 40...00 00 00 00 00 00 00 e0 Carte Microsoft ISATAP #2
 52...00 00 00 00 00 00 00 e0 Carte Microsoft ISATAP #4
 53...00 00 00 00 00 00 00 e0 Carte Microsoft ISATAP #5
 54...00 00 00 00 00 00 00 e0 Carte Microsoft ISATAP #6
===========================================================================

IPv4 Table de routage
===========================================================================
Itinéraires actifs :
Destination réseau    Masque réseau  Adr. passerelle   Adr. interface Métrique
          0.0.0.0          0.0.0.0          5.0.0.1     5.217.88.203   9256
          0.0.0.0          0.0.0.0      192.168.1.1     192.168.1.35     30
          0.0.0.0        128.0.0.0        10.53.0.5        10.53.0.6     30
          5.0.0.0        255.0.0.0         On-link      5.217.88.203   9256
     5.217.88.203  255.255.255.255         On-link      5.217.88.203   9256
    5.255.255.255  255.255.255.255         On-link      5.217.88.203   9256
        10.53.0.1  255.255.255.255        10.53.0.5        10.53.0.6     30
        10.53.0.4  255.255.255.252         On-link         10.53.0.6    286
        10.53.0.6  255.255.255.255         On-link         10.53.0.6    286
        10.53.0.7  255.255.255.255         On-link         10.53.0.6    286
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        128.0.0.0        128.0.0.0        10.53.0.5        10.53.0.6     30
      169.254.0.0      255.255.0.0         On-link   169.254.247.188    276
  169.254.247.188  255.255.255.255         On-link   169.254.247.188    276
  169.254.255.255  255.255.255.255         On-link   169.254.247.188    276
      192.168.1.0    255.255.255.0         On-link      192.168.1.35    286
     192.168.1.35  255.255.255.255         On-link      192.168.1.35    286
    192.168.1.255  255.255.255.255         On-link      192.168.1.35    286
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link   169.254.247.188    276
        224.0.0.0        240.0.0.0         On-link      192.168.1.35    286
        224.0.0.0        240.0.0.0         On-link         10.53.0.6    286
        224.0.0.0        240.0.0.0         On-link      5.217.88.203   9256
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link   169.254.247.188    276
  255.255.255.255  255.255.255.255         On-link      192.168.1.35    286
  255.255.255.255  255.255.255.255         On-link         10.53.0.6    286
  255.255.255.255  255.255.255.255         On-link      5.217.88.203   9256
===========================================================================
Itinéraires persistants :
  Adresse réseau    Masque réseau  Adresse passerelle Métrique
          0.0.0.0          0.0.0.0          5.0.0.1  Par défaut
===========================================================================

IPv6 Table de routage
===========================================================================
Itinéraires actifs :
 If Metric Network Destination      Gateway
  1    306 ::1/128                  On-link
 17    276 2620:9b::/64             On-link
 17    276 2620:9b::/96             On-link
 17    276 2620:9b::5d9:58cb/128    On-link
 25    276 fe80::/64                On-link
 11    286 fe80::/64                On-link
 41    286 fe80::/64                On-link
 17    276 fe80::/64                On-link
 11    286 fe80::1dd5:9b47:3506:e324/128
                                    On-link
 17    276 fe80::a1d9:d42c:469c:58bc/128
                                    On-link
 41    286 fe80::b042:7b6f:fe77:3131/128
                                    On-link
 25    276 fe80::f99d:410d:baf4:f7bc/128
                                    On-link
  1    306 ff00::/8                 On-link
 25    276 ff00::/8                 On-link
 11    286 ff00::/8                 On-link
 41    286 ff00::/8                 On-link
 17    276 ff00::/8                 On-link
===========================================================================
Itinéraires persistants :
 If Metric Network Destination      Gateway
  0 4294967295 2620:9b::/96             On-link
===========================================================================

    net.ipv4.ip_forward = 1

is set in /etc/sysctl.conf.

maikcat

disable hamachi and try again

Michael.

rashid47010

I think you have to put the PREROUTING rule like

iptables -t nat -A PREROUTING -i tun0 -d 192.168.1.0/24 -j DNAT --to 10.8.0.1

192.168.1.0/24 is my server side lan
and 10.8.0.1 is ip that is assigned to my server side virtual interface

please update if it is helpful for you.

Miles

I uninstalled Hamachi, and the situation remains the same.
Rashid, I will try your solution later and report back. Thanks !

maikcat

try this to your openvpn server

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

Michael.

Miles

I tried both

 iptables -t nat -A POSTROUTING -s 10.53.0.0/24 -o eth0 -j MASQUERADE

and

 iptables -t nat -A POSTROUTING -s 10.53.0.0/16 -o eth0 -j MASQUERADE

(since I chose to have all adresses beginning with 10.53)

but it did not solve the problem.

iptables -t nat -A PREROUTING -i tun0 -d 192.168.200.0/24 -j DNAT --to 10.53.0.1

(adapted with my settings for local network and vpn)
did not work either.

ifconfig goes

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.53.0.1  P-t-P:10.53.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:8217 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4386 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:717697 (700.8 KiB)  TX bytes:5752310 (5.4 MiB)

is the address mask right here ? 255.255.255.255 for 10.53.x.x seems wrong, where do I change that ?
It seems I'm not sure at all of the masks I set up. CIDR and netmask got me confused.

Mimiko

Do you have forwarding enabled on linux server? Do you have forwardin rule:

iptables -a FORWARD -i tun+ -o eth0 -j accept
iptables -a forward -i eth0 -o tun9 -j accept

If the server has multiple interface you must specify to what IP to masquerade:

iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source <IP of the server in lan>

rashid47010

Miles

please tell me that are you able to ping any server
if unsuccessfull then please check your iptables again in /etc/sysconfig/iptables
and comment these two below lines
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited

after that server address should be pingable.

I have following iptable rules:

iptables -A FORWARD -i tun0 -o tun0 -j ACCEPT
iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT
iptables -A FORWARD -i eth0 -o tun0 -j ACCEPT

then then the
iptables -t nat -A PREROUTING -i tun0 -d <your internal network> -j DNAT --to 10.8.0.1

this 10.8.0.1 is the ip address of tun0 interface as you have 10.53.0.1

if you please give me your email id so I can forward you my network diagram.........

Rashid

Miles

Okay,

iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT
iptables -A FORWARD -i eth0 -o tun0 -j ACCEPT

was missing it seems. Everything works fine now, thank you all ! 🙂