Alright I'm a bit stumped by this one. I'm trying to setup a vpn on port 443 using tcp to negate a firewall and just for funsies. I prefer the flexibility of tap vs tun (any downsides to tap I should know about?). I'm able to connect to the server fine and everything, I'm just unable to ping out of it, to "8.8.8.8". As for everything else, I'll let the config files speak for themselves.
server.conf
# main configuration #
mode server
port 443
proto tcp
# bridging directive - this is needed to use the br0
dev tap0
# script to attach the tap0 interface to the bridge
up "/etc/openvpn/up.sh br0"
down "/etc/openvpn/down.sh br0"
persist-key
persist-tun
#certificates and encryption
ca ca.crt
cert dellserver.crt
key dellserver.key # This file should be kept secret
dh dh1024.pem
cipher BF-CBC # Blowfish (default)
comp-lzo # compression
# enable communication between vpn clients
client-to-client
# enable multiple access from the same client certificate
duplicate-cn
# DHCP configuration #
# ipp.txt saves the status of the dhcp leases
ifconfig-pool-persist ipp.txt
# pool of addresses available for VPN leases
# format: <server IP> <netmask> <pool start IP> <pool end IP>
server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
# additional option to give to dhcp clients
push "dhcp-option DNS 10.8.0.4"
# maximium number of clients connected at a time
max-clients 10
# log and security #
user nobody
group nogroup
keepalive 60 300
status openvpn-status.log
verb 3
script-security 3 system
push "redirect-gateway def1"
up.sh
#!/bin/sh
BR=$1
DEV=$2
MTU=$3
/sbin/ip link set "$DEV" up promisc on mtu "$MTU"
/sbin/brctl addif $BR $DEV
down.sh
#!/bin/sh
BR=$1
DEV=$2
/usr/sbin/brctl delif $BR $DEV
/sbin/ifconfig $DEV down
interfaces
auto lo
iface lo inet loopback
auto br0
iface br0 inet static
#ip, netmask, ecc are the original ones
address 192.168.1.5
netmask 255.255.255.0
gateway 192.168.1.1
#network interfaces on which to enable the bridge
bridge_ports eth0
iptables -t nat -L
output
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- anywhere anywhere
MASQUERADE all -- 10.8.0.50 anywhere
MASQUERADE all -- 10.8.0.51 anywhere
MASQUERADE all -- 10.8.0.52 anywhere
MASQUERADE all -- 10.8.0.53 anywhere
MASQUERADE all -- 10.8.0.54 anywhere
MASQUERADE all -- 10.8.0.55 anywhere
Client .conf
client
dev tap
proto tcp
remote [ServerIP] 443
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert imuhim.crt
key imuhim.key
comp-lzo
verb 3
sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1
Thanks a lot, this is really a last resort, I'm not really sure what else I can do.
