Problems with iCloud stuff after connecting

tacobob

Greetings!
I am having some problems with Apple push services once I am connected to my VPN. I am referring to the Mountain Lion application called "Messages" and the other iCloud services such as push services to Calendar and Photo Stream. The biggest issue is with the Messages application.
* Not connected to OpenVPN = all iCloud things work fine. Messages get delivered. A friend sends me a message, and it appears on my desktop client and my iPhone simultaneously. Life is good.
* Connected to my OpenVPN box = the above does not happen. Life is bad.

So far, the iCloud stuff is the only stuff that does not work properly while I am connected. Email, web, ftp, ssh all work. Skype also works just fine.

My configuration is pretty simple.
* 1 Ubuntu OpenVZ VPS, with a bare bones Ubuntu 11.10 install. There are no other services running on the machine, and memory & CPU are not an issue.
* 1 OpenVPN package installed & configured.
* 1 client, 10.8.2 with the Viscosity OpenVPN client. I have contacted the developer about this and they are unable to reproduce it on their end. Another friend with the same client is unable to reproduce it either. Then again, they are not using my openvpn server, so I think I can eliminate the client as a culprit.

I have the feeling it's more in the iptables side of things, but i'm asking you folks first because the two go hand in hand.

Server config:

status openvpn-status.log
log /var/log/openvpn.log
verb 4
port 1194
proto udp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh1024.pem
server 10.9.8.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push “dhcp-option DNS 10.9.8.1″
keepalive 10 120
duplicate-cn
cipher BF-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
tun-mtu 1500
mssfix 1400

Here's the iptables script that I run. There are no rules set to fire off at startup.

iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -A FORWARD -i tun0 -o venet0 -j ACCEPT
iptables -A FORWARD -i venet0 -o tun0 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 1194 -j ACCEPT
iptables -A INPUT -p udp --dport 1194 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.9.8.0/24 -j SNAT --to-source (server's IP)
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -L -v

I've tried forwarding things too with no success. 5223 is the Apple push notification port, and is used for some of the Apple services that I'm having problems with. The others are related to iChat/Messages.

iptables -A FORWARD -p tcp -d 10.9.8.0/24 --dport 5222:5230 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp --dport 5222:5230 -j DNAT --to-destination 10.9.8.6

If I run tcpdump on the client and against the tunnel on the openvpn server, I can see oodles of traffic talking to icloud.com, akamai, apple.com, and everything that looks like it's appropriate. But the problem still exists.
Within just a few seconds of disconnecting from the VPN, I get my messages, calendar updates, and new pictures in Photo Stream once again.

Another potential issue: I am sometimes in a double NAT situation. But if anything, the traffic should be hitting my VPN server first, right?

Sometimes it's client -> Airport Express -> other NAT box -> my openvpn box -> internet.
Sometimes it's client -> other_vpn -> my openvpn box -> internet.

I have no control over the particular situations, only over my own client and my own openvpn box.

I'm completely stumped with this, and it seems to be a situation that nobody else on the entire internet has run into.. and if they have, it's impossible to Google for.

Help?

Mimiko

iptables -t nat -A PREROUTING -p tcp --dport 5222:5230 -j DNAT --to-destination 10.9.8.6

Are you sure that your client gets this ip everytime?

If over VPN all everything is working and not iCloud, then might be iCloud have some limitation or detection of using VPN?

tacobob

Yes, it gets the same IP every time.

And the one thing that I can safely rule out is iCloud. Cannot stress this enough.. it is not an Apple limitation, restriction, etc. Only pointing out because I've had a few people just brush this off as "Oh, meh, Apple junk that doesn't work" which doesn't help at all.

But it looks like I was wrong about eliminating the client... the Tunnelblick client functions and everything works as expected. But as soon as I switch over to the Viscosity client, it stops working.
Going back to the developer and working on it further.

I tested further by removing the Ubuntu OpenVPN package entirely and installing the package fromhere. Then when 2.3_b1 was released, I removed all packages and compiled from source and have been testing with it. The results have been consistent - works with one client, not the other. I was mistaken in earlier troubleshooting. :/

So, i'll keep plugging away and will update with what I find in case someone else has a similar problem. Cheers!

tacobob

It turns out that there was a bug in the client. It's now fixed.

http://www.sparklabs.com/forum/viewtopic.php?p=3223