connected to openvpn but cant ping

bryant

deleted
push "route 192.168.11.0 255.255.255.0"
push "route 10.0.8.0. 255.255.255.0"
and disable ALL iptables and leave ONLY the masq rule

now internal network works but cant ping ip 74.125.128.139 (google)
do i need to add something to pass the router gateway ??

netstat -nr
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Administrator>netstat -nr

Route Table
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 21 6b 6a dc 40 ...... Intel(R) WiFi Link 5100 - Packet Scheduler Minip
ort
0x3 ...00 ff 3e 40 c9 ea ...... TAP-Windows Adapter V9 - Packet Scheduler Minipo
rt
0x4 ...00 ff 49 67 d0 63 ...... TAP-Win32 Adapter OAS - Packet Scheduler Minipor
t
0xa0006 ...00 21 4f 61 dc 34 ...... Bluetooth Personal Area Network - Packet Sch
eduler Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 128.0.0.0 10.0.8.5 10.0.8.6 1
0.0.0.0 0.0.0.0 192.168.11.1 192.168.11.38 25
10.0.8.1 255.255.255.255 10.0.8.5 10.0.8.6 1
10.0.8.4 255.255.255.252 10.0.8.6 10.0.8.6 30
10.0.8.6 255.255.255.255 127.0.0.1 127.0.0.1 30
10.255.255.255 255.255.255.255 10.0.8.6 10.0.8.6 30
42.3.128.46 255.255.255.255 192.168.11.1 192.168.11.38 1
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
128.0.0.0 128.0.0.0 10.0.8.5 10.0.8.6 1
192.168.11.0 255.255.255.0 192.168.11.38 192.168.11.38 25
192.168.11.0 255.255.255.0 10.0.8.5 10.0.8.6 1
192.168.11.38 255.255.255.255 127.0.0.1 127.0.0.1 25
192.168.11.255 255.255.255.255 192.168.11.38 192.168.11.38 25
224.0.0.0 240.0.0.0 10.0.8.6 10.0.8.6 30
224.0.0.0 240.0.0.0 192.168.11.38 192.168.11.38 25
255.255.255.255 255.255.255.255 10.0.8.6 10.0.8.6 1
255.255.255.255 255.255.255.255 10.0.8.6 a0006 1
255.255.255.255 255.255.255.255 10.0.8.6 4 1
255.255.255.255 255.255.255.255 192.168.11.38 192.168.11.38 1
Default Gateway: 10.0.8.5
===========================================================================
Persistent Routes:
None

iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
DROP tcp -- anywhere anywhere tcp dpt:ssh
DROP tcp -- anywhere anywhere tcp dpt:telnet
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT 0 -- anywhere anywhere
TCPMSS tcp -- anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
lan2wan 0 -- anywhere anywhere
ACCEPT 0 -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT 0 -- anywhere anywhere
ACCEPT 0 -- anywhere anywhere
TRIGGER 0 -- anywhere anywhere TRIGGER type:in match:0 relate:0
trigger_out 0 -- anywhere anywhere
ACCEPT 0 -- anywhere anywhere state NEW
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain advgrp_1 (0 references)
target prot opt source destination
Chain advgrp_10 (0 references)
target prot opt source destination
Chain advgrp_2 (0 references)
target prot opt source destination
Chain advgrp_3 (0 references)
target prot opt source destination
Chain advgrp_4 (0 references)
target prot opt source destination
Chain advgrp_5 (0 references)
target prot opt source destination
Chain advgrp_6 (0 references)
target prot opt source destination
Chain advgrp_7 (0 references)
target prot opt source destination
Chain advgrp_8 (0 references)
target prot opt source destination
Chain advgrp_9 (0 references)
target prot opt source destination
Chain grp_1 (0 references)
target prot opt source destination
Chain grp_10 (0 references)
target prot opt source destination
Chain grp_2 (0 references)
target prot opt source destination
Chain grp_3 (0 references)
target prot opt source destination
Chain grp_4 (0 references)
target prot opt source destination
Chain grp_5 (0 references)
target prot opt source destination
Chain grp_6 (0 references)
target prot opt source destination
Chain grp_7 (0 references)
target prot opt source destination
Chain grp_8 (0 references)
target prot opt source destination
Chain grp_9 (0 references)
target prot opt source destination
Chain lan2wan (1 references)
target prot opt source destination
Chain logaccept (0 references)
target prot opt source destination
ACCEPT 0 -- anywhere anywhere
Chain logdrop (0 references)
target prot opt source destination
DROP 0 -- anywhere anywhere
Chain logreject (0 references)
target prot opt source destination
REJECT tcp -- anywhere anywhere reject-with tcp-reset
Chain trigger_out (1 references)
target prot opt source destination

maikcat

also post the output of

iptables -L -t nat -v

on openvpn server

Michael.

bryant

Chain PREROUTING (policy ACCEPT 55 packets, 17525 bytes)
pkts bytes target prot opt in out source destination
0 0 DNAT tcp -- any any anywhere 42-3-128-046.static.netvigator.com tcp dpt:webcache to:192.168.110.100:80
0 0 DNAT icmp -- any any anywhere 42-3-128-046.static.netvigator.com to:192.168.110.100
17 14156 TRIGGER 0 -- any any anywhere 42-3-128-046.static.netvigator.com TRIGGER type:dnat match:0 relate:0
Chain INPUT (policy ACCEPT 2003 packets, 148K bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 6 packets, 414 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 6 packets, 414 bytes)
pkts bytes target prot opt in out source destination
26 2711 SNAT 0 -- any vlan2 192.168.110.0/24 anywhere to:42.3.128.46
0 0 RETURN 0 -- any br0 anywhere anywhere PKTTYPE = broadcast
0 0 MASQUERADE 0 -- any eth0 10.8.1.0/24 anywhere

maikcat

hello bryant,

mate...i cant follow you...seriously...

at first postings your openvpn server subnet was 192.168.66.0/24

Server config server 192.168.66.0 255.255.255.0
push "route 192.168.110.0 255.255.255.0"
push "redirect-gateway def1"
push "dhcp-option DNS 192.168.66.1"
dev tun
proto tcp
keepalive 10 120
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
comp-lzo
management localhost 5001

then it became 10.0.8.0/24

server 10.0.8.0 255.255.255.0
dev tun
push "route 192.168.110.0 255.255.255.0"
push "route 192.168.11.0 255.255.255.0"
push "route 10.0.8.0. 255.255.255.0"
push "redirect-gateway def1"
push "dhcp-option DNS 10.0.8.1 255.255.255.0"
proto tcp
keepalive 10 120
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
management localhost 5001

and your NAT rule is

0 0 MASQUERADE 0 -- any eth0 10.8.1.0/24 anywhere

??10.8.1.0??

frustrating.... :ugeek:

Michael.

bryant

i am so sorry to confuse you

i follow openvpn sample so changed to 10.0.8.0/24 in the last two settings
home network VPN network office network
192.168.110.0 /24 ------------------- 10.0.8.0 /24 ---------------------- 192.168.11.0/24
192.168.110.100 (gateway) 192.168.11.1 (gateway)

in masquerade i made a typo :cry:
i corrected it already and please see the latest updated iptables
iptables -t nat -A POSTROUTING -s 10.0.8.0/24 -o eth0 -j MASQUERADE

iptables -L -t nat -v
Chain PREROUTING (policy ACCEPT 446 packets, 32984 bytes)
pkts bytes target prot opt in out source destination
0 0 DNAT tcp -- any any anywhere 42-3-128-046.static.netvigator.com tcp dpt:webcache to:192.168.110.100:80
0 0 DNAT icmp -- any any anywhere 42-3-128-046.static.netvigator.com to:192.168.110.100
19 6138 TRIGGER 0 -- any any anywhere 42-3-128-046.static.netvigator.com TRIGGER type:dnat match:0 relate:0
Chain INPUT (policy ACCEPT 456 packets, 72007 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 123 packets, 9075 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 124 packets, 9135 bytes)
pkts bytes target prot opt in out source destination
71 6172 SNAT 0 -- any vlan2 192.168.110.0/24 anywhere to:42.3.128.46
0 0 RETURN 0 -- any br0 anywhere anywhere PKTTYPE = broadcast
0 0 MASQUERADE 0 -- any eth0 10.0.8.0/24 anywhere

netstat -nr
Microsoft Windows XP [Version 5.1.2600]

C:\Documents and Settings\Administrator>netstat -nr

Route Table
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 21 6b 6a dc 40 ...... Intel(R) WiFi Link 5100 - Packet Scheduler Minip
ort
0x3 ...00 ff 3e 40 c9 ea ...... TAP-Windows Adapter V9 - Packet Scheduler Minipo
rt
0x4 ...00 ff 49 67 d0 63 ...... TAP-Win32 Adapter OAS - Packet Scheduler Minipor
t
0xb0006 ...00 21 4f 61 dc 34 ...... Bluetooth Personal Area Network - Packet Sch
eduler Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 128.0.0.0 10.0.8.5 10.0.8.6 1
0.0.0.0 0.0.0.0 192.168.11.1 192.168.11.38 25
10.0.8.1 255.255.255.255 10.0.8.5 10.0.8.6 1
10.0.8.4 255.255.255.252 10.0.8.6 10.0.8.6 30
10.0.8.6 255.255.255.255 127.0.0.1 127.0.0.1 30
10.255.255.255 255.255.255.255 10.0.8.6 10.0.8.6 30
42.3.128.46 255.255.255.255 192.168.11.1 192.168.11.38 1
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
128.0.0.0 128.0.0.0 10.0.8.5 10.0.8.6 1
192.168.11.0 255.255.255.0 192.168.11.38 192.168.11.38 25
192.168.11.0 255.255.255.0 10.0.8.5 10.0.8.6 1
192.168.11.38 255.255.255.255 127.0.0.1 127.0.0.1 25
192.168.11.255 255.255.255.255 192.168.11.38 192.168.11.38 25
224.0.0.0 240.0.0.0 10.0.8.6 10.0.8.6 30
224.0.0.0 240.0.0.0 192.168.11.38 192.168.11.38 25
255.255.255.255 255.255.255.255 10.0.8.6 10.0.8.6 1
255.255.255.255 255.255.255.255 10.0.8.6 b0006 1
255.255.255.255 255.255.255.255 10.0.8.6 4 1
255.255.255.255 255.255.255.255 192.168.11.38 192.168.11.38 1
Default Gateway: 10.0.8.5
===========================================================================
Persistent Routes:
None

C:\Documents and Settings\Administrator>

bryant

michael please ignore the last post
after reboot DNS works too
now DNS can solve google too but still cant ping google.

Network diagram
192.168.110.0 /24 ------------------- 10.0.8.0 /24 ---------------------- 192.168.11.0/24
192.168.110.100 (gateway) 192.168.11.1 (gateway)

iptables -L -t nat -v
Chain PREROUTING (policy ACCEPT 210 packets, 12494 bytes)
pkts bytes target prot opt in out source destination
0 0 DNAT tcp -- any any anywhere 42-3-128-046.static.netvigator.com tcp dpt:webcache to:192.168.110.100:80
0 0 DNAT icmp -- any any anywhere 42-3-128-046.static.netvigator.com to:192.168.110.100
4 256 TRIGGER 0 -- any any anywhere 42-3-128-046.static.netvigator.com TRIGGER type:dnat match:0 relate:0
Chain INPUT (policy ACCEPT 270 packets, 17417 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 64 packets, 4870 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 65 packets, 4930 bytes)
pkts bytes target prot opt in out source destination
15 1085 SNAT 0 -- any vlan2 192.168.110.0/24 anywhere to:42.3.128.46
0 0 RETURN 0 -- any br0 anywhere anywhere PKTTYPE = broadcast
0 0 MASQUERADE 0 -- any eth0 10.0.8.0/24 anywhere

netstat -nr
Network Destination Netmask Gateway Interface Metric
0.0.0.0 128.0.0.0 10.0.8.5 10.0.8.6 1
0.0.0.0 0.0.0.0 192.168.11.1 192.168.11.38 25
10.0.8.1 255.255.255.255 10.0.8.5 10.0.8.6 1
10.0.8.4 255.255.255.252 10.0.8.6 10.0.8.6 30
10.0.8.6 255.255.255.255 127.0.0.1 127.0.0.1 30
10.255.255.255 255.255.255.255 10.0.8.6 10.0.8.6 30
42.3.128.46 255.255.255.255 192.168.11.1 192.168.11.38 1
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
128.0.0.0 128.0.0.0 10.0.8.5 10.0.8.6 1
192.168.11.0 255.255.255.0 192.168.11.38 192.168.11.38 25
192.168.11.38 255.255.255.255 127.0.0.1 127.0.0.1 25
192.168.11.255 255.255.255.255 192.168.11.38 192.168.11.38 25
192.168.110.0 255.255.255.0 10.0.8.5 10.0.8.6 1
224.0.0.0 240.0.0.0 10.0.8.6 10.0.8.6 30
224.0.0.0 240.0.0.0 192.168.11.38 192.168.11.38 25
255.255.255.255 255.255.255.255 10.0.8.6 10.0.8.6 1
255.255.255.255 255.255.255.255 10.0.8.6 b0006 1
255.255.255.255 255.255.255.255 10.0.8.6 4 1
255.255.255.255 255.255.255.255 192.168.11.38 192.168.11.38 1
Default Gateway: 10.0.8.5
===========================================================================
Persistent Routes:

server config
server 10.0.8.0 255.255.255.0
dev tun
push "route 192.168.110.0 255.255.255.0"
push "redirect-gateway def1"
push "dhcp-option DNS 10.0.8.1 255.255.255.0"
proto tcp
keepalive 10 120
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
management localhost 5001

bryant

additional my remote notebook is using wifi to connect
do i correct to use "eth0" ??

iptables -t nat -A POSTROUTING -s 10.0.8.0/24 -o eth0 -j MASQUERADE

maikcat

the iptables command is for your openvpn server only...

i assume that openvpn servers ethernet interface is eth0...right??

can you post the output of

ifconfig

on your openvpn server? (i 've just seen a br0 somewhere in your iptables output... :?: )

Michael.

bryant

there is noway to dump ipconfig in the router
it seems that doesnt support command ipconfig

but i saw the router is using vlan2, should i change eth0 to vlan2 ??

Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 42.3.128.254 0.0.0.0 UG 0 0 0 vlan2
10.0.8.0 10.0.8.2 255.255.255.0 UG 0 0 0 tun0
10.0.8.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
42.3.128.0 0.0.0.0 255.255.255.0 U 0 0 0 vlan2
127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 br0
192.168.110.0 0.0.0.0 255.255.255.0 U 0 0 0 br0
239.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 br0

bryant

thank michael !!!! finally it works 🙂

but when i turn on my firewall, i cant connect to my vpn server
then add ip rule in the iptables

iptables -I INPUT 1 -p tcp --dport 1194 -j ACCEPT
then i have connection but it will reconnect after few seconds

do you have any idea ??

maikcat

troubleshooting ip tables can be a PITA...

generic rules are:

allow traffic from anywhere , source port any,dest port 1194,proto udp,chain INPUT
allow traffic from tun0 interface to eth0 and vice versa chain FORWARD
also add the MASQ rule..

i am not iptables guru though...

Michael.

« Previous Page