Traffic Routing Issues

macneedshelp

Hello,

I am trying to set up OpenVPN 2.2.1 on my CentOS 6 (64-bit) VPS. This is my first time setting up, and everything went smoothly. The service is running, and the client is able to connect. My intention is to forward all my traffic from the client, to my VPS, to the internet. However, I am met with a problem.

When pinging the VPS IP, everything works fine. However, when pinging ANY other IP/name server on the internet, it refuses to connect.

I have spent the past 3 hours reading threads and looking for solutions, but none of them applied to me. The nature of the problem has led me to believe that it is an issue with the traffic not being routed correctly.

OpenVPN Server Config:

local 5.34.244.*** (asterisks applied for privacy)
port 443
proto tcp
dev tun
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so /etc/pam.d/login
client-cert-not-required
username-as-common-name
server 1.2.4.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 4.2.2.1"
keepalive 5 30
comp-lzo
persist-key
persist-tun
status server-tcp.log
verb 3

In my sysctl.conf file, I've enabled IP forwarding:

net.ipv4.ip_forward = 1

Edited to specify OS version.

maikcat

hi there,

please post the output of:

sestatus
iptables -L -t nat -v
iptables -L -v

also post the correct server directive & client config.

Michael.

macneedshelp

maikcat wrotehi there,

please post the output of:

sestatus
iptables -L -t nat -v
iptables -L -v

also post the correct server directive & client config.

Michael.

Hello Michael, thank you for choosing to help me with my problem.

Sestatus returns:

-bash: sestatus: command not found

iptables -L -t nat -v returns:

Chain PREROUTING (policy ACCEPT 6706 packets, 397K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 6406 packets, 377K bytes)
 pkts bytes target     prot opt in     out     source               destination
 2386  145K SNAT       all  --  any    any     1.2.4.0/24           anywhere            to:5.34.244.*** #ip 1
    0     0 SNAT       all  --  any    any     1.2.4.0/24           anywhere            to:5.34.244.*** #ip 2
    0     0 MASQUERADE  all  --  any    eth0    1.2.4.0/24           anywhere

Chain OUTPUT (policy ACCEPT 5270 packets, 312K bytes)
 pkts bytes target     prot opt in     out     source               destination

iptables -L -v returns:

Chain INPUT (policy ACCEPT 1377 packets, 415K bytes)
 pkts bytes target     prot opt in     out     source               destination
    4   216 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:87
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:87
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:87
    1    60 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:87
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:87
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:87
    0     0 ACCEPT     all  --  tun0   any     anywhere             anywhere

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  tun0   any     anywhere             anywhere

Chain OUTPUT (policy ACCEPT 140K packets, 3823K bytes)
 pkts bytes target     prot opt in     out     source               destination

The client config is:

client
dev tun
proto tcp
remote 5.34.244.*** 443
resolv-retry infinite
nobind
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
persist-key
persist-tun
ca ca.crt
cert sample.crt
key sample.key
comp-lzo
verb 3
route-method exe
route-delay 2

I'm not sure what you mean by the server directive. Could you please specify?

Also, I guess I should mention that I'm attempting to run OpenVPN on a fresh installation of CentOS 6 (64-bit).

Thanks.

maikcat

hi there,

-bash: sestatus: command not found

are you running sestatus as root?

you iptables NAT look ok... 🙁

can you post the output of ifconfig?

Michael.