OpenVPN Server to Replace OS X Server VPN

stvs

I'm trying to stand up an OpenVPN server on OS X Server (Mountain Lion) to replace OS X Server's native L2TP/PPTP-based VPN service and get a secure certificate-based VPN solution on iOS.

Should be easy, and I'm almost there, but not quite: clients can connect, but the networking is fouled up I'm still too much of a n00b to figure out the problem. Any help would be much appreciated.

The networking problem is strange: the client (ip 10.0.9.2) can ping/ssh/http/etc. to the server's IP (10.0.1.3), but cannot do the same with the server's domain name, which resolves to 10.0.1.3 on the LAN. I'm pushing 10.0.1.3 as the name server to clients, so the client should be able to resolve the server's domain name. But this is not simply a DNS snafu: the client cannot ping the router (10.0.1.1), though the server can ping the client!

server$ ping -c 1 10.0.9.2
PING 10.0.9.2 (10.0.9.2): 56 data bytes
64 bytes from 10.0.9.2: icmp_seq=0 ttl=64 time=470.780 ms

iPhone$ ping -c 1 10.0.1.3
PING 10.0.1.3 (10.0.1.3): 56 data bytes
64 bytes from 10.0.1.3: icmp_seq=0 ttl=64 time=170.943 ms
64 bytes from 10.0.1.3: icmp_seq=1 ttl=64 time=112.755 ms
64 bytes from 10.0.1.3: icmp_seq=2 ttl=64 time=129.476 ms
--- 10.0.1.3 ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max/stddev = 112.755/137.725/170.943/24.461 ms
iPhone$ ping domainname.com
ping: unknown host
iPhone$ ping 10.0.1.1 
PING 10.0.1.1 (10.0.1.1): 56 data bytes
--- 10.0.1.1 ping statistics ---
4 packets transmitted, 0 packets received, 100% packet loss

My LAN looks like this:

Airport Extreme Router (10.0.1.1, DHCP+NAT, DNS) <----->
Airport Express network extension (10.0.1.2, 255.255.255.0) <----->
OS X Server (10.0.1.3, 255.255.255.0, DNS)

For the server, I've tried both Tunnelblick and a simple command 'openvpn2 --conf server.conf'. The router is set up to forward udp port 1194 to the server, and though I've added the ipfw rule,

$ sudo ipfw add 12368 allow udp from any to any 1194

OS X firewalling is completely disabled (and double-checked) using the commands:

$ sudo pfctl -d
$ sudo ipfw disable firewall
$ /usr/sbin/sysctl net.inet.ip.fw.enable
net.inet.ip.fw.enable: 0

The client is GuizmOVPN on iOS. Both Tunnelblick and openvpn2 servers exhibit the same networking problems descibed above.

Configs:

Server (OS X Server 10.8.2)

local 10.0.1.3
port 1194
proto udp
dev tun
ca /opt/local/etc/openvpn2/keys/ca.crt
cert /opt/local/etc/openvpn2/keys/server.crt
key /opt/local/etc/openvpn2/keys/server.key
tls-auth /opt/local/etc/openvpn2/keys/ta.key 0
dh /opt/local/etc/openvpn2/keys/dh2048.pem
server 10.0.9.0 255.255.255.0
topology subnet
push "route 10.0.1.0/255.255.255.0"
push "dhcp-option DNS 10.0.1.3"
push "dhcp-option DOMAIN domainname.com"
client-to-client
keepalive 10 120
comp-lzo
max-clients 100
user nobody
group nobody
persist-key
persist-tun
ifconfig-pool-persist /opt/local/etc/openvpn2/ipp.txt
verb 3

Client (GuizmOVPN on iPhone)

client
dev tun
proto udp
remote server.domainname.com 1194
redirect-gateway def1
resolv-retry infinite
nobind
;user nobody
;group nobody
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
ns-cert-type server
tls-auth ta.key 1
;auth-user-pass
tls-remote server
tls-cipher DHE-RSA-AES256-SHA
comp-lzo
verb 3

ifconfig's:

server$ ifconfig -a
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
	options=3<RXCSUM,TXCSUM>
	inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 
	inet 127.0.0.1 netmask 0xff000000 
	inet6 ::1 prefixlen 128 
gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
stf0: flags=0<> mtu 1280
en0: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
	options=2b<RXCSUM,TXCSUM,VLAN_HWTAGGING,TSO4>
	ether 15:20:c3:fb:56:4d 
	inet 10.0.1.3 netmask 0xffff0000 broadcast 10.0.255.255
	media: autoselect (1000baseT <full-duplex,flow-control>)
	status: active
en1: flags=8822<BROADCAST,SMART,SIMPLEX,MULTICAST> mtu 1500
	ether 61:f3:33:1e:88:cd 
	media: autoselect (<unknown type>)
	status: inactive
p2p0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> mtu 2304
	ether 02:f3:33:1e:88:cd 
	media: autoselect
	status: inactive
fw0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 4078
	lladdr ee:14:63:c0:ff:fb:a5:42 
	media: autoselect <full-duplex>
	status: inactive
tun0: flags=8851<UP,POINTOPOINT,RUNNING,SIMPLEX,MULTICAST> mtu 1500
	inet 10.0.9.1 --> 10.0.9.1 netmask 0xffffff00 
	open (pid 14410)

iPhone$ ifconfig -a
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
	inet 127.0.0.1 netmask 0xff000000 
ap0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> mtu 1500
	ether 46:5d:15:8e:39:03 
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
	ether 24:5b:6c:58:22:59 
en1: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
	ether 24:4a:15:75:21:f4 
pdp_ip0: flags=8011<UP,POINTOPOINT,MULTICAST> mtu 1430
	inet 10.167.208.92 --> 10.167.208.92 netmask 0xffffffff 
pdp_ip1: flags=8011<UP,POINTOPOINT,MULTICAST> mtu 1024
pdp_ip2: flags=8011<UP,POINTOPOINT,MULTICAST> mtu 1024
pdp_ip3: flags=8011<UP,POINTOPOINT,MULTICAST> mtu 1024
ppp0: flags=8011<UP,POINTOPOINT,MULTICAST> mtu 1500
	inet 10.0.9.2 --> 10.0.9.2 netmask 0xffffff00

Mimiko

First, does your OpenVPN server has a DNS service? If not, then pushing this option will not work.
Second, as the OpenVPN server is not the lan's default gateway, then you have to read this: https://forums.openvpn.net/topic9465.html

stvs

Thank you for the pointer. I took some time to read it, but am still unable to connect to my LAN or the internet from a iPhone on a 3G/LTE or remote location.

First, the server on which I am running the OpenVPN server is also a name server for my LAN, but never mind that now -- assume I'll just use Google 8.8.8.8 for DNS.

Second, the tutorial you wrote is very clear, but I don't see how to apply it to mobile device clients without fixed IPs.

I've fumbled around with adding route commands to the config files and played a little with sysctl and ipfw (the BSD version of iptables), all without success. I'm beginning to wonder if an OpenVPN server can be hosted on an OS X Server without some more serious tinkering. I've reposted my server.conf file and GuizmoVPN client logs in case they reveal anything useful. Thanks again.

server.conf:

local 10.0.1.3
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
tls-auth ta.key 0
dh dh2048.pem
server-bridge 10.0.1.3 255.255.255.0 10.0.1.235 10.0.1.254
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DOMAIN domainname.com"
client-to-client
keepalive 10 120
comp-lzo
max-clients 100
user nobody
group nobody
persist-key
persist-tun
ifconfig-pool-persist ipp.txt
verb 3

I also Googled a little and tried some ipfw masquerading commands:

sudo sysctl -w net.inet.ip.forwarding=1
sudo ipfw add 00010 divert natd ip from any to any via tun0

I've also tried various combinations of route commands, per the page Accessing LAN resources when OpenVPN is not LAN's GW

push "route 10.0.1.0 255.255.255.0"
route 10.0.1.0 255.255.255.0

None of these work either, and I'm not sure how to troubleshoot at this point.

GuizmoVPN Client Log:

Running openvpn --cd /var/mobile/Documents/Configurations/DomainNameVPN_tap --config "DomainNameVPN_tap.conf" 

Tue Oct  9 20:24:58 2012 OpenVPN 2.2.1_GuizmOVPN_1.1.7 arm-apple-darwin10 [SSL] [LZO2] [eurephia] built on Jul  8 2012
Tue Oct  9 20:24:58 2012 WARNING: Make sure you understand the semantics of --tls-remote before using it (see the man page).
Tue Oct  9 20:24:59 2012 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Tue Oct  9 20:24:59 2012 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Oct  9 20:24:59 2012 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Oct  9 20:24:59 2012 LZO compression initialized
Tue Oct  9 20:24:59 2012 Control Channel MTU parms [ L:1574 D:166 EF:66 EB:0 ET:0 EL:0 ]
Tue Oct  9 20:24:59 2012 Socket Buffers: R=[42080->65536] S=[9216->65536]
Tue Oct  9 20:25:00 2012 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Tue Oct  9 20:25:00 2012 Local Options hash (VER=V4): '13a273ba'
Tue Oct  9 20:25:00 2012 Expected Remote Options hash (VER=V4): '360696c5'
Tue Oct  9 20:25:00 2012 UDPv4 link local: [undef]
Tue Oct  9 20:25:00 2012 UDPv4 link remote: 50.136.93.98:1194
Tue Oct  9 20:25:01 2012 TLS: Initial packet from 50.136.93.98:1194, sid=af4bfd7c 7bb10687
Tue Oct  9 20:25:01 2012 VERIFY OK: depth=1, /C=US/ST=OR/L=Springfield/O=DomainName/OU=DomainName/CN=DomainName.com/name=OpenVPN-CA/emailAddress=admin@DomainName.com
Tue Oct  9 20:25:01 2012 VERIFY OK: nsCertType=SERVER
Tue Oct  9 20:25:01 2012 VERIFY X509NAME OK: /C=US/ST=OR/L=Springfield/O=DomainName/OU=DomainName/CN=server-DomainName/name=OpenVPN-CA/emailAddress=admin@DomainName.com
Tue Oct  9 20:25:01 2012 VERIFY OK: depth=0, /C=US/ST=OR/L=Springfield/O=DomainName/OU=DomainName/CN=server-DomainName/name=OpenVPN-CA/emailAddress=admin@DomainName.com
Tue Oct  9 20:25:04 2012 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Oct  9 20:25:04 2012 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Oct  9 20:25:04 2012 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Oct  9 20:25:04 2012 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Oct  9 20:25:04 2012 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Tue Oct  9 20:25:04 2012 [server-DomainName] Peer Connection Initiated with 50.136.93.98:1194
Tue Oct  9 20:25:06 2012 SENT CONTROL [server-DomainName]: 'PUSH_REQUEST' (status=1)
Tue Oct  9 20:25:08 2012 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 8.8.8.8,route-gateway 10.0.1.3,ping 10,ping-restart 120,ifconfig 10.0.1.235 255.255.255.0'
Tue Oct  9 20:25:08 2012 Tapemu : Received local IP : 10.0.1.235/255.255.255.0
Tue Oct  9 20:25:08 2012 OPTIONS IMPORT: timers and/or timeouts modified
Tue Oct  9 20:25:08 2012 OPTIONS IMPORT: --ifconfig/up options modified
Tue Oct  9 20:25:08 2012 OPTIONS IMPORT: route options modified
Tue Oct  9 20:25:08 2012 OPTIONS IMPORT: route-related options modified
Tue Oct  9 20:25:08 2012 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Oct  9 20:25:08 2012 ROUTE default_gateway=10.29.90.172
Tue Oct  9 20:25:08 2012 Tapemu : Starting TAP emulation.
Tue Oct  9 20:25:08 2012 Tapemu : Local MAC address : 0A:00:20:21:03:0E
Tue Oct  9 20:25:08 2012 TUN/TAP device tunemu:/ppp0 opened
Tue Oct  9 20:25:08 2012 /sbin/ifconfig ppp0 delete
ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
Tue Oct  9 20:25:08 2012 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
Tue Oct  9 20:25:08 2012 /sbin/ifconfig ppp0 10.0.1.235 10.0.1.235 netmask 255.255.255.0 mtu 1500 up
Tue Oct  9 20:25:08 2012 /sbin/route add -net 10.0.1.0 10.0.1.235 255.255.255.0
add net 10.0.1.0: gateway 10.0.1.235
Tue Oct  9 20:25:08 2012 Tapemu : Route added for 10.0.1.0/255.255.255.0 gateway 10.0.1.235
Tue Oct  9 20:25:08 2012 Running script
Setting DNS to /Network/Service/0194EE12-B201-4B4D-964C-FB48075BB2FA/DNS (8.8.8.8)
Tue Oct  9 20:25:09 2012 Script ended
Tue Oct  9 20:25:09 2012 /sbin/route add -net 50.136.93.98 10.29.90.172 255.255.255.255
add net 50.136.93.98: gateway 10.29.90.172
Tue Oct  9 20:25:09 2012 Tapemu : Route added for 50.136.93.98/255.255.255.255 gateway 10.29.90.172
Tue Oct  9 20:25:09 2012 /sbin/route add -net 0.0.0.0 10.0.1.3 128.0.0.0
add net 0.0.0.0: gateway 10.0.1.3
Tue Oct  9 20:25:09 2012 Tapemu : Route added for 0.0.0.0/128.0.0.0 gateway 10.0.1.3
Tue Oct  9 20:25:09 2012 /sbin/route add -net 128.0.0.0 10.0.1.3 128.0.0.0
add net 128.0.0.0: gateway 10.0.1.3
Tue Oct  9 20:25:09 2012 Tapemu : Route added for 128.0.0.0/128.0.0.0 gateway 10.0.1.3
Tue Oct  9 20:25:09 2012 Initialization Sequence Completed
Tue Oct  9 20:25:11 2012 Tapemu : Requesting MAC address for 10.0.1.3
Tue Oct  9 20:25:20 2012 Tapemu : Requesting MAC address for 10.0.1.3
Tue Oct  9 20:25:22 2012 Tapemu : Requesting MAC address for 10.0.1.3
Tue Oct  9 20:25:34 2012 Tapemu : Requesting MAC address for 10.0.1.3
Tue Oct  9 20:25:52 2012 Tapemu : Requesting MAC address for 10.0.1.3
Tue Oct  9 20:26:02 2012 Tapemu : Requesting MAC address for 10.0.1.3
Tue Oct  9 20:26:03 2012 Tapemu : Requesting MAC address for 10.0.1.3
Tue Oct  9 20:26:06 2012 Tapemu : Requesting MAC address for 10.0.1.3
Tue Oct  9 20:26:15 2012 Tapemu : Requesting MAC address for 10.0.1.3
Tue Oct  9 20:27:01 2012 Tapemu : Requesting MAC address for 10.0.1.3
Tue Oct  9 20:27:14 2012 Tapemu : Requesting MAC address for 10.0.1.3

Mimiko

You switched from routing method to bridged method. In case of bridged setup, the post I linked to does not apply. First try with some regular workstation and see if it is working.

viktorf768

Look "Configuring VPN Server on OS X 10.8.2 as Router with NAT".
Here you can find the needed commands.
https://forums.openvpn.net/topic11401.html

stvs

viktorf768 wroteLook "Configuring VPN Server on OS X 10.8.2 as Router with NAT".
Here you can find the needed commands.
https://forums.openvpn.net/topic11401.html

Woot! That did it -- I'm in. Thank you very much! I plan to throw some rocks at this setup and post an explanation about how to get a OpenVPN server on OS X Server with GuizmoVPN client, but until then here's a terse description of a working setup:

1. Tunnelblick

2. Server config (ignoring authentication):

dev tun
server 10.8.0.0 255.255.255.0
push "route 10.0.1.0/255.255.255.0"
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"

3. This is necessary: make sure that ipfw is running for step 3:

$ sudo ipfw enable firewall

4. This: https://forums.openvpn.net/topic11401.html [I'd also recommend changing the plist name to net.openvpn.enable-vpn-forward-nat.plist, and make the corresponding name change in the <key>Label</key> String itself.]

5. GuizmoVPN on iOS with standard client config.

If you don't mind, I'd like to tweak this baseline setup and get a few things working that don't work right now: use of my own DNS server, and bridged connections. If anyone knows fixes to the following two problems, I'll test and include in a more extensive write-up:

A. My LAN's DNS server is at 10.0.1.3 (same as the OpenVPN server), which serves up LAN addresses for my server and local clients. I'd like to use this DNS server as my OpenVPN client's DNS server rather than 8.8.8.8. Problem is, DNS is fail when I specify

push "dhcp-option DNS 10.0.1.3"

in the server config above. Why?! Could the client be trying to hit 10.0.1.3 on the internet, rather than my LAN? That's the only thing I can think of, but that doesn't make sense to me either because I can OpenVPN into VNC via 10.0.1.3:5900 just fine, as well http on 10.0.1.3:80 and all other services. Why would LAN DNS fail?

B. I'd like to use bridging mode with the settings:

server-bridge 10.0.1.98 255.255.255.0 10.0.1.50 10.0.1.90

But that fails -- the client connects, but its packets don't appear to go anywhere. Pings fail in both directions, web at 10.0.1.3:80 fails, and of course DNS fails. Any suggestions to troubleshoot or magic ipfw incantations would be greatly appreciated.

stvs

My OpenVPN ipfw setup no longer works with Mavericks 10.9, though it worked fine on Mountain Lion. I used ipfw to divert all natd packets, allowing VPN LAN IPs on, say 10.2.1.0/24 to 10.0.1.0/24. Now VPN no longer works, and if I run this ipfw script, it breaks my servers internet and LAN access as well!

It looks like ipfw and natd are obsolete on OS X, and it's finally time to learn how to implement divert using pfctl.

Has anyone used pfctl with tunnelblick? What are the command to obtain a divert, as done below with natd/ipfw?

#!/bin/bash
#
# Reference: https://forums.openvpn.net/topic11401.html
#
# Sleep is necessary cause network has to be up at the time of following commands
# Otherwise the network will not work at all
#
sleep 15
#
/usr/sbin/sysctl -w net.inet.ip.fw.enable=1
/usr/sbin/sysctl -w net.inet.ip.forwarding=1
/usr/sbin/natd -interface en0
/sbin/ipfw add divert natd ip from any to any via en0

The natd command throws the error on Mavericks:

natd: Unable to bind divert socket.: Address already in use

stvs

I read The Boof of PF and figured it out. The essential pfctl NAT and filter rules are

nat on en0 from 10.0.0.0/8 to any -> (en0)
pass from { lo0, 10.0.0.0/8 } to any keep state

and you have to do a lot of trial-and-error to make sure you don't break your access while integrating these rules into OS X Server's basic rule set. A description of the complete setup with the following pf.conf is here.

sudo vi /etc/pf.conf

# References for modifications:
# The Book of PF by Peter N.M. Hansteen
# http://hints.macworld.com/article.php?story=20121011004626997
# http://blog.scottlowe.org/2013/05/15/using-pf-on-os-x-mountain-lion/
# http://krypted.com/mac-security/a-cheat-sheet-for-using-pf-in-os-x-lion-and-up/

# Options

set block-policy drop
set fingerprints "/etc/pf.os"
set ruleset-optimization basic

set skip on lo0

# Normalization

# Scrub incoming packets
scrub in all no-df

#
# com.apple anchor point
#
scrub-anchor "com.apple/*"

# Queueing

# Translation

# OpenVPN Server NAT
#
# The Book of PF, p. 21
int_if = "en0" # macro for internal interface
localnet = "10.0.0.0/8"
nat on $int_if from $localnet to any -> ($int_if)

nat-anchor "com.apple/*"
rdr-anchor "com.apple/*"
dummynet-anchor "com.apple/*"
anchor "com.apple/*"
load anchor "com.apple" from "/etc/pf.anchors/com.apple"

# Filtering

lan_server = 10.0.1.3

# Antispoof
antispoof log quick for { lo0 en0 }

# Block by default
block in log

# Allow outgoing traffic from NAT'd { lo0, $localnet }
# The Book of PF, p. 21
pass from { lo0, $localnet } to any keep state

# Block to/from illegal destinations or sources
block in log quick from no-route to any

# Allow critical system traffic
pass in quick inet proto udp from any port 67 to any port 68

# Allow ICMP from home LAN
pass in log proto icmp from $lan_server:network

# Allow outgoing traffic
pass out inet proto tcp from any to any keep state
pass out inet proto udp from any to any keep state

# Internet services
internet_udp_services = "{ https, 500, 1194, 1701, 4500, 5060, 5190, 5297, 5298, 5678, 16384 }"
internet_tcp_services = "{ ssh, smtp, https, 143, 587, 993, 995, 1640, 2170, 2195, 2196, 4190,\
5218, 5223, 5190, 5220, 5222, 5298, 8008, 8443, 8800, 8843 }"
pass in quick inet proto tcp from any to { lo0, $lan_server } port $internet_tcp_services
pass in quick inet proto udp from any to { lo0, $lan_server } port $internet_udp_services

# LAN services: block access, except from localnet
lan_udp_services = "{ 5001 }"
lan_tcp_services = "{ domain, auth, nntp, www, 311, 3128, 5001, 5900:5909, 8118, 8123 }"
pass in quick inet proto tcp from { lo0, $localnet } to { lo0, $lan_server } port $lan_tcp_services
pass in quick inet proto udp from { lo0, $localnet } to { lo0, $lan_server } port $lan_udp_services