Connecting (ping), but no internet on OpenVPN setup

blah

Hi all,

I am able to ping the ubuntu 12.04 vpn server (10.8.0.1, which is able to ping the internet) when connected to the vpn, but i cannot ping the internet (e.g. 8.8.8.8) from my ubuntu 12.04 client. My configurations are below. I have mainly been following the openvpn howto guide (http://openvpn.net/index.php/open-source/documentation/howto.html) and have included the suggestions for funneling all client internet traffic through the VPN server ( i.e. add "redirect-gateway def1", 'push "dhcp-option DNS 10.8.0.1"', and natting "iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE" on server). The guide states that extra server side scripting may be necessary to push the DNS config to a non-windows client. I added up/down scripts pointint to update-resolve-conf to try to resolve this. Perhaps this is my issue? Please enlighten me. Pretty please...

OPENVPN.LOG (server):

Sun Mar 24 21:18:47 2013 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Mar 30 2012
Sun Mar 24 21:18:47 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sun Mar 24 21:18:47 2013 Diffie-Hellman initialized with 2048 bit key
Sun Mar 24 21:18:47 2013 Control Channel Authentication: using './keys/ta.key' as a OpenVPN static key file
Sun Mar 24 21:18:47 2013 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Mar 24 21:18:47 2013 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Mar 24 21:18:47 2013 TLS-Auth MTU parms [ L:1560 D:168 EF:68 EB:0 ET:0 EL:0 ]
Sun Mar 24 21:18:47 2013 Socket Buffers: R=[87380->131072] S=[16384->131072]
Sun Mar 24 21:18:47 2013 ROUTE default_gateway=xxx.xxx.xxx.xxx (server ip)
Sun Mar 24 21:18:47 2013 TUN/TAP device tun0 opened
Sun Mar 24 21:18:47 2013 TUN/TAP TX queue length set to 100
Sun Mar 24 21:18:47 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Mar 24 21:18:47 2013 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Sun Mar 24 21:18:47 2013 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Sun Mar 24 21:18:47 2013 Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Mar 24 21:18:47 2013 Listening for incoming TCP connection on [AF_INET]xxx.xxx.xxx.xxx:1194
Sun Mar 24 21:18:47 2013 TCPv4_SERVER link local (bound): [AF_INET]xxx.xxx.xxx.xxx:1194
Sun Mar 24 21:18:47 2013 TCPv4_SERVER link remote: [undef]
Sun Mar 24 21:18:47 2013 MULTI: multi_init called, r=256 v=256
Sun Mar 24 21:18:47 2013 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Sun Mar 24 21:18:47 2013 IFCONFIG POOL LIST
Sun Mar 24 21:18:47 2013 MULTI: TCP INIT maxclients=3 maxevents=7
Sun Mar 24 21:18:47 2013 Initialization Sequence Completed

OPENVPN.LOG (for client, well its output since this is not being logged):

Sun Mar 24 18:25:25 2013 OpenVPN 2.2.1 i686-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Mar 30 2012
Sun Mar 24 18:25:25 2013 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Enter Private Key Password:
Sun Mar 24 18:25:33 2013 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Sun Mar 24 18:25:33 2013 Control Channel Authentication: using './keys/ta.key' as a OpenVPN static key file
Sun Mar 24 18:25:33 2013 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Mar 24 18:25:33 2013 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Mar 24 18:25:33 2013 LZO compression initialized
Sun Mar 24 18:25:33 2013 Control Channel MTU parms [ L:1560 D:168 EF:68 EB:0 ET:0 EL:0 ]
Sun Mar 24 18:25:33 2013 Socket Buffers: R=[87380->131072] S=[16384->131072]
Sun Mar 24 18:25:33 2013 Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Mar 24 18:25:33 2013 Local Options hash (VER=V4): '0bdd0804'
Sun Mar 24 18:25:33 2013 Expected Remote Options hash (VER=V4): 'a642654b'
Sun Mar 24 18:25:33 2013 Attempting to establish TCP connection with [AF_INET]xxx.xxx.xxx.xxx:1194 [nonblock]
Sun Mar 24 18:25:34 2013 TCP connection established with [AF_INET]xxx.xxx.xxx.xxx:1194
Sun Mar 24 18:25:34 2013 TCPv4_CLIENT link local: [undef]
Sun Mar 24 18:25:34 2013 TCPv4_CLIENT link remote: [AF_INET]xxx.xxx.xxx.xxx:1194
Sun Mar 24 18:25:34 2013 TLS: Initial packet from [AF_INET]xxx.xxx.xxx.xxx:1194, sid=80862633 03289500
Sun Mar 24 18:25:36 2013 VERIFY OK: depth=1, /C=US/ST=CA/L=LosAngeles/O=bonzii/OU=MyOrganizationalUnit/CN=bonzii-VPN/name=EasyRSA/emailAddress=surfeity@gmail.com
Sun Mar 24 18:25:36 2013 VERIFY OK: nsCertType=SERVER
Sun Mar 24 18:25:36 2013 VERIFY OK: depth=0, /C=US/ST=CA/L=LosAngeles/O=bonzii/OU=MyOrganizationalUnit/CN=ub_server/name=EasyRSA/emailAddress=surfeity@gmail.com
Sun Mar 24 18:25:42 2013 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Mar 24 18:25:42 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Mar 24 18:25:42 2013 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Mar 24 18:25:42 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Mar 24 18:25:42 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sun Mar 24 18:25:42 2013 [ub_server] Peer Connection Initiated with [AF_INET]xxx.xxx.xxx.xxx:1194
Sun Mar 24 18:25:44 2013 SENT CONTROL [ub_server]: 'PUSH_REQUEST' (status=1)
Sun Mar 24 18:25:45 2013 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 10.8.0.1,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Sun Mar 24 18:25:45 2013 OPTIONS IMPORT: timers and/or timeouts modified
Sun Mar 24 18:25:45 2013 OPTIONS IMPORT: --ifconfig/up options modified
Sun Mar 24 18:25:45 2013 OPTIONS IMPORT: route options modified
Sun Mar 24 18:25:45 2013 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sun Mar 24 18:25:45 2013 ROUTE default_gateway=192.168.1.1
Sun Mar 24 18:25:45 2013 TUN/TAP device tun0 opened
Sun Mar 24 18:25:45 2013 TUN/TAP TX queue length set to 100
Sun Mar 24 18:25:45 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Mar 24 18:25:45 2013 /sbin/ifconfig tun0 10.8.0.6 pointopoint 10.8.0.5 mtu 1500
Sun Mar 24 18:25:45 2013 /etc/openvpn/update-resolv-conf tun0 1500 1560 10.8.0.6 10.8.0.5 init
dhcp-option DNS 10.8.0.1
Sun Mar 24 18:25:47 2013 /sbin/route add -net xxx.xxx.xxx.xxx netmask 255.255.255.255 gw 192.168.1.1
Sun Mar 24 18:25:47 2013 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 10.8.0.5
Sun Mar 24 18:25:47 2013 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 10.8.0.5
Sun Mar 24 18:25:47 2013 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.5
Sun Mar 24 18:25:47 2013 Initialization Sequence Completed

SERVER.CONF:

local xxx.xxx.xxx.xxx
port 1194
proto tcp
dev tun
ca ./keys/ca.crt
cert ./keys/ub_server.crt
key ./keys/ub_server.key 
dh ./keys/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS 10.8.0.1" [b]#extra server side scripting needed for non-window clients ?[/b]
client-to-client
keepalive 10 120
tls-auth ./keys/ta.key 0
cipher AES-128-CBC   
comp-lzo
max-clients 3
persist-key
persist-tun
status openvpn-status.log
log-append  openvpn.log
verb 3
mute 5

CLIENT.CONF:

script-security 2
client
dev tun
proto tcp
remote xxx.xxx.xxx.xxx 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/ub_client.crt
key /etc/openvpn/keys/ub_client.key
ns-cert-type server
tls-auth ./keys/ta.key 1
cipher AES-128-CBC
comp-lzo
verb 3
up /etc/openvpn/update-resolv-conf #added up/down as resolv.conf was not being modified
down /etc/openvpn/update-resolv-conf

NAT TABLE (for server):

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  10.8.0.0/24          anywhere

KERNAL ROUTING TABLE ( for client before OpenVPN connection)

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG    0      0        0 wlan0
169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 wlan0  #is the 169.254.0.0 
192.168.1.0     0.0.0.0         255.255.255.0   U     2      0        0 wlan0

KERNEL ROUTING TABLE (for client after OpenVPN connection)

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.8.0.5        128.0.0.0       UG    0      0        0 tun0
0.0.0.0         192.168.1.1     0.0.0.0         UG    0      0        0 wlan0
10.8.0.0        10.8.0.5        255.255.255.0   UG    0      0        0 tun0
10.8.0.5        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
128.0.0.0       10.8.0.5        128.0.0.0       UG    0      0        0 tun0
xxx.xxx.xxx.xxx    192.168.1.1     255.255.255.255 UGH   0      0        0 wlan0
169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 wlan0
192.168.1.0     0.0.0.0         255.255.255.0   U     2      0        0 wlan0

RESOLV.CONF (for client before OpenVPN connection):

nameserver 127.0.0.1

RESOLV.CONF (for client after OpenVPN connection)

nameserver 10.8.0.1
nameserver 127.0.0.1

mwandelaar

It appears the setup is correct.
In the past i've had some issues with firewalls on Linux-clients (i.e. firestarter) which doesn't allow traffic to and from the tun-interface.

So please check clientside iptables.

blah

Thanks for the help. Checking the firewall helped as well as adding a failover ip for ovh. Don't really understand the failover part though. My configuration for a second server is the same here, but unfortunately it is not working with all firewalls open (iptables -A INPUT -j ACCEPT, etc, with masquerading). I can connect, but not ping the outside. Perhaps it is my router, but i've checked three different routers now (not my own so i did not check configuration). Is there some tool i can check to see where my packets are getting caught up. I've used traceroute but it just gives asterisks.

blah

Closed ports on a router shouldn't be an issue if i can already connect via 1194 port and basic internet services are open correct?

blah

/proc/sys/net/ipv4/ip_forward needs to be 1 of course.

mwandelaar

blah wrote/proc/sys/net/ipv4/ip_forward needs to be 1 of course.

That's true!

Did this solve all the problems or do you still have issues with internet-traffic?