Server to client ping fails among all

vpnevan

here is my server config:

daemon
port                1194
proto               udp
dev                 tun
server              192.168.27.0 255.255.255.0
ca                  /etc/openvpn/keys/ca.crt
cert                /etc/openvpn/keys/server.crt
key                 /etc/openvpn/keys/server.key
dh                  /etc/openvpn/keys/dh1024.pem
crl-verify          /etc/openvpn/keys/crl.pem
client-to-client
topology            subnet

user                nobody
group               nobody

push "redirect-gateway def1"
push "explicit-exit-notify 4"
duplicate-cn
client-config-dir   /etc/openvpn/ccd
management tunnel   10023 /etc/openvpn/passwd
keepalive           10 120
comp-lzo
persist-key
persist-tun

verb                6
log-append          /var/log/openvpn.log

here is my client config:

client
dev tun
proto udp
remote a.a.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo yes
verb 3
ca ca.crt
cert client.crt
key client.key
status-version 2
status status

iptables rules on server:

# Generated by iptables-save v1.4.7 on Sat Mar 23 08:42:15 2013
*nat
:PREROUTING ACCEPT [8:424]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [2:145]
#-A POSTROUTING -j SNAT --to-source 95.211.211.8 
COMMIT
# Completed on Sat Mar 23 08:42:15 2013
# Generated by iptables-save v1.4.7 on Sat Mar 23 08:42:15 2013
*mangle
:PREROUTING ACCEPT [456:137794]
:INPUT ACCEPT [217:30530]
:FORWARD ACCEPT [239:107264]
:OUTPUT ACCEPT [289:143922]
:POSTROUTING ACCEPT [528:251186]
COMMIT
# Completed on Sat Mar 23 08:42:15 2013
# Generated by iptables-save v1.4.7 on Sat Mar 23 08:42:15 2013
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [287:143690]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 1194 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 192.168.27.0/24 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Sat Mar 23 08:42:15 2013

when i remove SNAT rule i can speak to all cients and servers thorugh the vpn but i lose internet connectivity for all clients.

vpnevan

I fixed this issue by modifying my SNAT rule to:

iptables -t nat -A POSTROUTING -j SNAT ! -d 192.168.27.0/24  --to-source 1.1.1.1

this lets local traffic not be snated and stay on it local network.

val3xiv

Hello vpnevan.
I have the same problem, tried to follow what you did and now ping is working well in any direction (Server to Client, Client to Server, Client to Client) but I still lose internet connectivity for all clients.
Any suggestion.
Thanks in advance. Regards.

VALTER

vpnevan

Hi Val3xlv,

do you have this line in your server config file?

push "redirect-gateway def1"

Please post your configs and iptables rules so i can look at your setup as a whole.

Thanks,

val3xiv

Hi vpnevan, thanks for your answer!

my server.conf

port 443
proto tcp
dev tun
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
client-to-client
keepalive 10 120
comp-lzo
max-clients 30
persist-key
persist-tun
status openvpn-status.log
log         openvpn.log
verb 3
mute 20

my iptables

*mangle
:PREROUTING ACCEPT [9367539:3551183254]
:INPUT ACCEPT [5705001:1315244915]
:FORWARD ACCEPT [3662502:2235932561]
:OUTPUT ACCEPT [6560444:3306437500]
:POSTROUTING ACCEPT [10222944:5542369893]
COMMIT
# Completed on Fri Apr 12 17:42:01 2013
# Generated by iptables-save v1.4.4 on Fri Apr 12 17:42:01 2013
*filter
:INPUT ACCEPT [5705001:1315244915]
:FORWARD ACCEPT [3662502:2235932561]
:OUTPUT ACCEPT [6560442:3306437332]
COMMIT
# Completed on Fri Apr 12 17:42:01 2013
# Generated by iptables-save v1.4.4 on Fri Apr 12 17:42:01 2013
*nat
:PREROUTING ACCEPT [196185:14887321]
:POSTROUTING ACCEPT [56424:4057716]
:OUTPUT ACCEPT [56600:4068809]
-A POSTROUTING ! -d 10.8.0.0/24 -j SNAT --to-source 10.8.0.1 
COMMIT

Thanks. Best Regards.

vpnevan

Hi val3xiv,

It seems that your iptables SNAT rule is wrong.
That should be the outside ip address of your vpn server and not the vpn nertwork ip address.

So it should read something like:

-A POSTROUTING ! -d 10.8.0.0/24 -j SNAT --to-source your.external.ip.address

Hope that helps!