I am currently in China and set up OpenVPN in bridging mode on a Linux server back in the U.S. and am running a client on my Linux laptop. It seems to be working as expected, but I still can't access sites like Facebook. I am new to OpenVPN, so I am unsure if it is an issue with my configuration or if there is something else going on, such as the DPI (Deep Packet Inspection) I've heard about.
The symptoms are:
- The server and client seem to recognize each other and initialize without any error messages
- When I go to Google, I can query using google.com rather than being redirected to google.com.hk as is typically the case.
- When I go to Google Maps and search for "Where am I," it tells me it thinks I am in the United States right where I would expect it to.
- I can ping the server and the server's gateway
- When I sniff the packets on Wireshark, it seems to be directing browser requests through tap0.
- However, when I try to go to Facebook or YouTube, the browser times out as it does when I'm not on the VPN.
I've read that there are recommendations against TCP over TCP and using TUN rather than TAP, and I'm using both TCP and TAP, but that shouldn't make a difference when it comes to blocks on Facebook, should it? There are many moving parts, and I was hoping someone could confirm that I'm not just doing something boneheaded before I spend a week trying to adjust each permutation of configuration options, possibly to no effect.
I'm not sure what information would be most helpful, but I've included the following below (with some editing of identifying information such as IP addresses etc.):
0) My iptables listing on the server
1) My server OpenVPN configuration
2) The server startup log
3) My client OpenVPN configuration
4) The client startup output
Is there any other information, such as ifconfig output or route output that would be helpful? Here is the information, and thanks in advance to whomever replies:
0) My iptables listing on the server:
iptables -v --list
Chain INPUT (policy ACCEPT 19556 packets, 1453K bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- tap0 any anywhere anywhere
1108K 144M ACCEPT all -- br0 any anywhere anywhere
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
136K 38M ACCEPT all -- br0 any anywhere anywhere
Chain OUTPUT (policy ACCEPT 900K packets, 1104M bytes)
pkts bytes target prot opt in out source destination
iptables -v -t nat -n -L
Chain PREROUTING (policy ACCEPT 13177 packets, 878K bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 10882 packets, 669K bytes)
pkts bytes target prot opt in out source destination
9592 612K MASQUERADE all -- * br0 192.168.1.25 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 10131 packets, 620K bytes)
pkts bytes target prot opt in out source destination
1) My server OpenVPN configuration
port 443
proto tcp
dev tap0
ca ../keys/ca.crt
cert ../keys/server.crt
key ../keys/server.key # This file should be kept secret
dh ../keys/dh2048.pem
ifconfig-pool-persist ipp.txt
server-bridge 192.168.1.14 255.255.255.0 192.168.1.25 192.168.1.26
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 192.168.15.1"
keepalive 10 120
cipher BF-CBC # Blowfish (default)
comp-lzo
max-clients 1
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log-append openvpn.log
verb 4
mute 20
2) The server startup log. Note that XX.YY.ZZ.?? represents my IP address here in China.
us=931738 Current Parameter Settings:
us=931830 config = 'openvpn-server-test-bridged.conf'
us=931842 mode = 1
us=931850 persist_config = DISABLED
us=931858 persist_mode = 1
us=931866 show_ciphers = DISABLED
us=931873 show_digests = DISABLED
us=931881 show_engines = DISABLED
us=931888 genkey = DISABLED
us=931896 key_pass_file = '[UNDEF]'
us=931904 show_tls_ciphers = DISABLED
us=931920 Connection profiles [default]:
us=931928 proto = tcp-server
us=931936 local = '[UNDEF]'
us=931943 local_port = 443
us=931950 remote = '[UNDEF]'
us=931957 remote_port = 443
us=931964 remote_float = DISABLED
us=931971 bind_defined = DISABLED
us=931978 bind_local = ENABLED
us=931985 NOTE: --mute triggered...
us=932001 245 variation(s) on previous 20 message(s) suppressed by --mute
us=932011 OpenVPN 2.1.0 x86_64-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Jul 20 2010
us=932093 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
us=932197 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
us=945381 Diffie-Hellman initialized with 2048 bit key
us=945919 /usr/bin/openssl-vulnkey -q -b 2048 -m <modulus omitted>
us=24611 TLS-Auth MTU parms [ L:1576 D:140 EF:40 EB:0 ET:0 EL:0 ]
us=24740 TUN/TAP device tap0 opened
us=24761 TUN/TAP TX queue length set to 100
us=24796 Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ]
us=25854 GID set to nogroup
us=25913 UID set to nobody
us=25940 Listening for incoming TCP connection on [undef]
us=25970 Socket Buffers: R=[87380->131072] S=[16384->131072]
us=25985 TCPv4_SERVER link local (bound): [undef]
us=25993 TCPv4_SERVER link remote: [undef]
us=26007 MULTI: multi_init called, r=256 v=256
us=26077 IFCONFIG POOL: base=192.168.1.25 size=2
us=26118 IFCONFIG POOL LIST
us=26128 laptop,192.168.1.25
us=26152 MULTI: TCP INIT maxclients=1 maxevents=5
us=26180 Initialization Sequence Completed
us=718447 MULTI: multi_create_instance called
us=718541 Re-using SSL/TLS context
us=718628 LZO compression initialized
us=719008 Control Channel MTU parms [ L:1576 D:140 EF:40 EB:0 ET:0 EL:0 ]
us=719044 Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ]
us=719097 Local Options String: 'V4,dev-type tap,link-mtu 1576,tun-mtu 1532,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
us=719118 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1576,tun-mtu 1532,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
us=719156 Local Options hash (VER=V4): 'SOMEHASH'
us=719173 Expected Remote Options hash (VER=V4): 'SOMEOTHERHASH'
us=719209 TCP connection established with [AF_INET]XX.YY.ZZ.128:51344
us=719226 Socket Buffers: R=[131072->131072] S=[131072->131072]
us=719237 TCPv4_SERVER link local: [undef]
us=719246 TCPv4_SERVER link remote: [AF_INET]XX.YY.ZZ.128:51344
us=421622 XX.YY.ZZ.128:51344 TLS: Initial packet from [AF_INET]XX.YY.ZZ.128:51344, sid=eef2a18c ac5edb69
us=133139 XX.YY.ZZ.128:51344 VERIFY OK: depth=1, /C=US/ST=XX/L=CityName/O=MyName/CN=www.mydomain.com/name=MyName/emailAddress=myemail@mydomain.com
us=133450 XX.YY.ZZ.128:51344 VERIFY OK: depth=0, /C=US/ST=XX/L=CityName/O=MyName/CN=laptop/name=MyName/emailAddress=myemail@mydomain.com
us=248474 XX.YY.ZZ.128:51344 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
us=248595 XX.YY.ZZ.128:51344 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
us=249397 XX.YY.ZZ.128:51344 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
us=249419 XX.YY.ZZ.128:51344 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
us=206686 XX.YY.ZZ.128:51344 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
us=206719 XX.YY.ZZ.128:51344 [laptop] Peer Connection Initiated with [AF_INET]XX.YY.ZZ.128:51344
us=806485 laptop/XX.YY.ZZ.128:51344 PUSH: Received control message: 'PUSH_REQUEST'
us=806558 laptop/XX.YY.ZZ.128:51344 SENT CONTROL [laptop]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 192.168.1.1,route-gateway 192.168.1.14,ping 10,ping-restart 120,ifconfig 192.168.1.25 255.255.255.0' (status=1)
us=724654 laptop/XX.YY.ZZ.128:51344 MULTI: Learn: H1:H2:H3:H4:H5:H6 -> laptop/XX.YY.ZZ.128:51344
3) My client OpenVPN configuration
client
dev tap
proto tcp
remote PP.QQ.RR.SS 443
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca ca.crt
cert laptop.crt
key laptop.key
ns-cert-type server
cipher BF-CBC # Blowfish (default)
comp-lzo
verb 4
mute 20
4) The client startup output. Note that XX.YY.ZZ.?? is the IP address assigned here in China.
anonymous@laptop:~/openvpn/bridged$ sudo openvpn openvpn-client-test-bridged.conf
[sudo] password for anonymous:
us=475632 Current Parameter Settings:
us=475679 config = 'openvpn-client-test-bridged.conf'
us=475694 mode = 0
us=475707 persist_config = DISABLED
us=475731 persist_mode = 1
us=475745 show_ciphers = DISABLED
us=475764 show_digests = DISABLED
us=475782 show_engines = DISABLED
us=475800 genkey = DISABLED
us=475817 key_pass_file = '[UNDEF]'
us=475836 show_tls_ciphers = DISABLED
us=475851 Connection profiles [default]:
us=475866 proto = tcp-client
us=475879 local = '[UNDEF]'
us=475893 local_port = 0
us=475906 remote = 'PP.QQ.RR.SS'
us=475920 remote_port = 443
us=475933 remote_float = DISABLED
us=475946 bind_defined = DISABLED
us=475960 bind_local = DISABLED
us=475974 NOTE: --mute triggered...
us=475995 253 variation(s) on previous 20 message(s) suppressed by --mute
us=476012 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Mar 30 2012
us=476084 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
us=476802 LZO compression initialized
us=476861 Control Channel MTU parms [ L:1576 D:140 EF:40 EB:0 ET:0 EL:0 ]
us=476894 Socket Buffers: R=[87380->131072] S=[16384->131072]
us=476925 Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ]
us=476950 Local Options String: 'V4,dev-type tap,link-mtu 1576,tun-mtu 1532,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
us=476965 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1576,tun-mtu 1532,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
us=476990 Local Options hash (VER=V4): 'SOMEHASH'
us=477009 Expected Remote Options hash (VER=V4): 'SOMEOTHERHASH'
us=477257 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
us=477283 Attempting to establish TCP connection with [AF_INET]PP.QQ.RR.SS:443 [nonblock]
us=477484 TCP connection established with [AF_INET]PP.QQ.RR.SS:443
us=477603 TCPv4_CLIENT link local: [undef]
us=477648 TCPv4_CLIENT link remote: [AF_INET]PP.QQ.RR.SS:443
us=772764 TLS: Initial packet from [AF_INET]PP.QQ.RR.SS:443, sid=628e4a8b c8ff5215
us=82325 VERIFY OK: depth=1, /C=US/ST=XX/L=MyCity/O=MyName/CN=www.mydomain.com/name=MyName/emailAddress=myemail@mydomain.com
us=82738 VERIFY OK: nsCertType=SERVER
us=82764 VERIFY OK: depth=0, /C=US/ST=XX/L=MyCity/O=MyName/CN=server/name=MyName/emailAddress=myemail@mydomain.com
us=931884 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
us=931970 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
us=932096 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
us=932158 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
us=932286 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
us=932353 [server] Peer Connection Initiated with [AF_INET]PP.QQ.RR.SS:443
us=862688 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
us=454251 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 192.168.1.1,route-gateway 192.168.1.14,ping 10,ping-restart 120,ifconfig 192.168.1.25 255.255.255.0'
us=454409 OPTIONS IMPORT: timers and/or timeouts modified
us=454431 OPTIONS IMPORT: --ifconfig/up options modified
us=454444 OPTIONS IMPORT: route options modified
us=454455 OPTIONS IMPORT: route-related options modified
us=454467 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
us=454760 ROUTE default_gateway=XX.YY.ZZ.1
us=455540 TUN/TAP device tap0 opened
us=455613 TUN/TAP TX queue length set to 100
us=455675 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
us=455791 /sbin/ifconfig tap0 192.168.1.25 netmask 255.255.255.0 mtu 1500 broadcast 192.168.1.255
us=460114 /sbin/route add -net PP.QQ.RR.SS netmask 255.255.255.255 gw XX.YY.ZZ.1
us=463520 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 192.168.1.14
us=464994 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 192.168.1.14
us=466265 GID set to nogroup
us=466310 UID set to nobody
us=466326 Initialization Sequence Completed
