Client routing misconfiguration causes no response

cookiecaper

I've been banging on this all day. I'm trying to set up a VPN connection that will be used only for a certain user. I have gotten to the point where the client is writing packets to the VPN, the VPN is sending those out in plaintext, and then attempting to return the packets. They are written on the client's tun0, but no applications seem to register the new packet that is shown on the tcpdump of the client's tun0.

I believe I am missing a route on the client. If I enable push "redirect-gateway def1 bypass-dhcp" everything works, but I don't want this VPN to become the default route ( I am trying to filter based on user id ). With the setup I have, the machine sends packets out over the VPN, the VPN writes the replies back to the tun, but the client never picks those packets up; they're written to the tun, but don't make it to the application that needs them. Any ideas what I need to do to make this work?

I am not pushing any routes via OpenVPN, mainly because I am not sure how to put them in the right table.

I will send 0.5 bitcoins to the most helpful contributor. 🙂 Please help! I need this resolved ASAP.

Right now my route tables look like:

Server. RackSpace Cloud, eth1 stuff is related to that and seems not to cause problems.

10.8.0.0/24 via 10.8.0.2 dev tun0 
10.8.0.2 dev tun0  proto kernel  scope link  src 10.8.0.1 
xxx.xxx.xxx.xxx/12 via xxx.xxx.xxx.1 dev eth1 
xxx.xxx.xxx.0/19 dev eth1  proto kernel  scope link  src xxx.xxx.xxx.14 
xxx.xxx.xxx.0/18 via xxx.xxx.xxx.1 dev eth1 
yyy.yyy.yyy.0/24 dev eth0  proto kernel  scope link  src yyy.yyy.yyy.

Client

Default table (also RS Cloud)

10.8.0.0/24 via 10.8.0.2 dev tun0 
10.8.0.2 dev tun0  proto kernel  scope link  src 10.8.0.1 
xxx/12 via xxx dev eth1 
xxx/19 dev eth1  proto kernel  scope link  src xxx 
zzz.0/18 via xxx dev eth1 
yyy.0/24 dev eth0  proto kernel  scope link  src yyy.5

Custom table (marked packets forwarded)

# ip route show table 11
10.8.0.5 dev tun0  proto kernel  scope link  src 10.8.0.6 
10.8.0.1 via 10.8.0.5 dev tun0 
0.0.0.0/1 via 10.8.0.5 dev tun0

iptables stuff:

Server

# iptables -S -t nat
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-A POSTROUTING -s 10.8.0.0/16 -o eth0 -j MASQUERADE

# iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -i tun+ -j ACCEPT
-A FORWARD -i tun+ -j ACCEPT

Client

$ sudo iptables -S -t mangle
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-A OUTPUT -m owner --uid-owner box -j MARK --set-xmark 0xb/0xffffffff

$ sudo iptables -S -t nat
-P PREROUTING ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-A POSTROUTING -o tun0 -j MASQUERADE

openvpn configs:

Server:

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key  
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
comp-lzo
persist-key
persist-tun
status openvpn-status.log
log-append  openvpn.log
verb 7

Client:

client
remote xxx.xxx.xxx.xxx
ca ca.crt
cert a1.crt
key a1.key
comp-lzo
dev tun
proto udp
persist-key
persist-tun
nobind

Mimiko

What you want for this client to route? Do you want to redirect all traffic for this client? Or only for some network?

cookiecaper

Only packets marked by iptables for table 11 should be routed to the VPN. iptables should only be marking packets originating from a process owned by user xxx.

Mimiko

This is not OpenVPN's job. Don't use redirect-gateway option and route only with iptables rules.

cookiecaper

Thanks for your response. I am aware it's not OpenVPN's job to configure the routing, I was just hoping someone here would be able to tell me why the raw response packets are written back to the tun from the VPN, but not received by the application that is awaiting them.