Hi,
I've managed to install OpenVPN on my Debian VPS by pretty much by following this guide
https://help.ubuntu.com/10.04/serverguide/openvpn.html .
I wanted to have a VPN setup so that I can use my server's spare IP address for VPN access from my laptop. I'm not sure if I've done things in the best way but I've gone for a bridged network like the above guide. On my laptop I've used the Viscosity app for Mac.
My server log is as follows:
openvpn --config /etc/openvpn/server.conf --dh /etc/openvpn/dh1024.pem --ca /etc/openvpn/ca.crt --cert /etc/openvpn/server.crt --key /etc/openvpn/server.key --script-security 2
Mon Feb 25 22:29:10 2013 OpenVPN 2.1.3 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Feb 20 2012
Mon Feb 25 22:29:10 2013 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA. OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Mon Feb 25 22:29:10 2013 WARNING: you are using user/group/chroot/setcon without persist-tun -- this may cause restarts to fail
Mon Feb 25 22:29:10 2013 WARNING: you are using user/group/chroot/setcon without persist-key -- this may cause restarts to fail
Mon Feb 25 22:29:10 2013 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
Mon Feb 25 22:29:10 2013 WARNING: --keepalive option is missing from server config
Mon Feb 25 22:29:10 2013 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Mon Feb 25 22:29:10 2013 /usr/bin/openssl-vulnkey -q -b 1024 -m <modulus omitted>
Mon Feb 25 22:29:10 2013 TUN/TAP device tap0 opened
Mon Feb 25 22:29:10 2013 /etc/openvpn/up.sh br0 tap0 1500 1575 init
Mon Feb 25 22:29:10 2013 GID set to nogroup
Mon Feb 25 22:29:10 2013 UID set to nobody
Mon Feb 25 22:29:10 2013 Listening for incoming TCP connection on [AF_INET]85.119.83.25:1194
Mon Feb 25 22:29:10 2013 TCPv4_SERVER link local (bound): [AF_INET]85.119.83.25:1194
Mon Feb 25 22:29:10 2013 TCPv4_SERVER link remote: [undef]
Mon Feb 25 22:29:10 2013 Initialization Sequence Completed
Mon Feb 25 22:29:39 2013 Re-using SSL/TLS context
Mon Feb 25 22:29:39 2013 TCP connection established with [AF_INET]92.40.253.55:49533
Mon Feb 25 22:29:39 2013 TCPv4_SERVER link local: [undef]
Mon Feb 25 22:29:39 2013 TCPv4_SERVER link remote: [AF_INET]92.40.253.55:49533
Mon Feb 25 22:29:58 2013 92.40.253.55:49533 [discodave.local] Peer Connection Initiated with [AF_INET]92.40.253.55:49533
My server's configuration:
# cat /etc/openvpn/server.conf
local 85.119.83.25
dev tap0
up "/etc/openvpn/up.sh br0"
down "/etc/openvpn/down.sh br0"
server-bridge 85.119.83.25 255.255.255.0 85.119.83.45 85.119.83.45
push "route 85.119.80.1 255.255.255.0"
#push "dhcp-option DNS 172.18.100.20"
#push "dhcp-option DOMAIN example.com"
proto tcp
#tls-auth ta.key 0 # This file is secret
user nobody
group nogroup
My network interfaces (a bit of a mess, will tidy up when this is working!)
cat /etc/network/interfaces
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
# The loopback network interface
auto lo
iface lo inet loopback
pre-up /etc/network/pre-up
# The primary network interface
#auto eth0
#iface eth0 inet static
## address 85.119.83.25
# netmask 255.255.248.0
gateway 85.119.80.1
#auto eth0:1
#iface eth0:1 inet static
# address 85.119.83.45
# netmask 255.255.248.0
iface eth0 inet6 static
address 2001:ba8:1f1:f099::2
netmask 64
gateway 2001:ba8:1f1:f099::1
pre-up echo 0 > /proc/sys/net/ipv6/conf/default/accept_ra || true
pre-up echo 0 > /proc/sys/net/ipv6/conf/all/accept_ra || true
pre-up echo 0 > /proc/sys/net/ipv6/conf/$IFACE/accept_ra || true
pre-up echo 0 > /proc/sys/net/ipv6/conf/default/autoconf || true
pre-up echo 0 > /proc/sys/net/ipv6/conf/all/autoconf || true
pre-up echo 0 > /proc/sys/net/ipv6/conf/$IFACE/autoconf || true
auto br0
iface br0 inet static
address 85.119.83.25
# network 85.119.83.0
netmask 255.255.248.0
# broadcast 85.119.83.255
gateway 85.119.80.1
bridge_ports eth0
bridge_fd 9
bridge_hello 2
bridge_maxage 12
bridge_stp off
iface eth0 inet manual
up ip link set $IFACE up promisc on
down ip link set $IFACE down promisc off
#auto tunnel
#iface tunnel inet ppp
# provider iris
# up route add -net 10.10.6.0 netmask 255.255.255.0 dev ppp0
I can successfully connect to the VPN but I can't then get anything tunnelling through to the internet. I can ping the server's IP address but any others, for example a IP address for Google, fail. It says there's no route to host. (Pinging the same IP address from the server works fine.)
Any help would be appreciated,
Cheers, Dave.
