Hi,
I installed Openvpn from binaries on Centos 6.2. I want to configure one openvpn server for multiple clients and the client should send everything over the tunnel.
I think the configuration is ok, but something is still wrong. The client is able to connect to the server, but the gateway doesn't work(no route error).
Here my configs:
client.conf
# We are a client
client
# Using a routed tunnel
dev tun
# Connecting to your server
proto udp
remote irc.want.pm 443
# If just above you specified a hostname, uncomment the following line
resolv-retry infinite
# Don't bind to a specific local port
nobind
# Make things persistant
persist-key
persist-tun
# The usual stuff
ca ca.crt
cert client1.crt
key client1.key
# Verify server certificate by checking that the certicate has the nsCertType
ns-cert-type server
# Compress
redirect-gateway
comp-lzo
# Be kinda verbose
verb 3
pull
server.conf
qport 443
proto udp
dev tun
ca easy-rsa/2.0/keys/ca.crt
cert easy-rsa/2.0/keys/server.crt
key easy-rsa/2.0/keys/server.key # This file should be kept secret
dh easy-rsa/2.0/keys/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
keepalive 10 120
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log openvpn.log
log-append openvpn.log
verb 3
output of iptables -L on the server:
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT icmp -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:rrac
ACCEPT udp -- anywhere anywhere state NEW udp dpt:https
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT)
target prot opt source destination
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
output of route -n on the server
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.8.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
193.107.84.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
169.254.0.0 0.0.0.0 255.255.0.0 U 1002 0 0 eth0
0.0.0.0 193.107.84.254 0.0.0.0 UG 0 0 0 eth0
output of netstat -rn on the Client(Mac OS X Lion 10,7.4) before the VPN connection:
Routing tables
Internet:
Destination Gateway Flags Refs Use Netif Expire
default 192.168.2.1 UGSc 17 0 en1
127 127.0.0.1 UCS 0 0 lo0
127.0.0.1 127.0.0.1 UH 1 1059 lo0
169.254 link#5 UCS 0 0 en1
192.168.2 link#5 UCS 1 0 en1
192.168.2.1 0:12:bf:fc:d:92 UHLWIi 15 0 en1 1199
192.168.2.11 127.0.0.1 UHS 0 0 lo0
netstat -rn while connected to the VPN
Internet:
Destination Gateway Flags Refs Use Netif Expire
0/1 10.8.0.5 UGSc 0 0 tun0
default 192.168.2.1 UGSc 11 0 en1
10.8.0.1/32 10.8.0.5 UGSc 0 0 tun0
10.8.0.5 10.8.0.6 UH 3 0 tun0
127 127.0.0.1 UCS 0 0 lo0
127.0.0.1 127.0.0.1 UH 3 1089 lo0
128.0/1 10.8.0.5 UGSc 0 0 tun0
169.254 link#5 UCS 0 0 en1
192.168.2 link#5 UCS 1 0 en1
192.168.2.1 0:12:bf:fc:d:92 UHLWIi 2 0 en1 1200
192.168.2.11 127.0.0.1 UHS 0 0 lo0
193.107.84.60/32 192.168.2.1 UGSc 1 0 en1
I use "Tunnelblick" to connect to the VPN.
I hope somebody can give me a tip.
Ok, I got it working now. It was an issue with iptables. Thanks for the help.
