Hello Forum! Iran blocks sites like facebook and youtube. It also blocks OpenVPN connections. So I'm using Stunnel to prevent this. Im able to connect to my OpenVPN server which is located in Sweden from Iran without any problems by "tunneling" the OpenVPN traffic through Stunnel. However here is where the problem begins, No Internet access. In order to get around the censorship, I need to redirect all Internet traffic to OpenVPN, using [code]push "redirect-gateway def1 bypass-dhcp"[/code] Im using DD-WRT as a router, but my OpenVPN server is hosted on a FreeBSD "distro" called Nas4Free. Quick summary [code]Internet -> Router(192.168.2.1) -> Nas4Free(192.168.2.10) -> OpenVPN(10.5.4.1)[/code] When accessing the router via telnet, I'm able to ping the OpenVPN IP-pool, Also when connected to the OpenVPN server I'm able to ping my router, So the 192.168.2.x net can see the 10.5.4.x net, But I cannot access the Internet when I'm connected to the OpenVPN server. I've enabled [code]gateway_enable="YES"[/code] and [code]net.inet.ip.forwarding=1[/code] On my Nas4Free machine. I've also tried putting this firewall rule in my DD-WRT router without success. [code]iptables -t nat -A POSTROUTING -s 10.5.4.0/24 -o eth0 -j MASQUERADE[/code] Nas4Free does not support NAT in the kernel, unlike FreeBSD that does have the support for it. But it has IPFW but it is turned off. My OpenVPN server config [code]port 6521 mode server tls-server proto tcp-server dev tun client-cert-not-required ca /usr/local/etc/openvpn/ca.crt cert /usr/local/etc/openvpn/server.crt key /usr/local/etc/openvpn/server.key dh /usr/local/etc/openvpn/dh1024.pem plugin /usr/local/lib/openvpn-auth-pam.so login server 10.5.4.0 255.255.255.0 push "route 192.168.2.0 255.255.255.0" push "dhcp-option DNS 192.168.2.1" push "redirect-gateway def1 bypass-dhcp" keepalive 10 120 cipher AES-128-CBC comp-lzo user root group wheel persist-key persist-tun verb 3 script-security 2[/code] I appreciate any help I could get. Thanks for reading.

Connected to OpenVPN server, no Internet, routing issue?

kreddy

Hello Forum!

Iran blocks sites like facebook and youtube. It also blocks OpenVPN connections. So I'm using Stunnel to prevent this. Im able to connect to my OpenVPN server which is located in Sweden from Iran without any problems by "tunneling" the OpenVPN traffic through Stunnel. However here is where the problem begins, No Internet access.

In order to get around the censorship, I need to redirect all Internet traffic to OpenVPN, using

push "redirect-gateway def1 bypass-dhcp"

Im using DD-WRT as a router, but my OpenVPN server is hosted on a FreeBSD "distro" called Nas4Free.

Quick summary

Internet -> Router(192.168.2.1) -> Nas4Free(192.168.2.10) -> OpenVPN(10.5.4.1)

When accessing the router via telnet, I'm able to ping the OpenVPN IP-pool, Also when connected to the OpenVPN server I'm able to ping my router, So the 192.168.2.x net can see the 10.5.4.x net, But I cannot access the Internet when I'm connected to the OpenVPN server.

I've enabled

gateway_enable="YES"

and

net.inet.ip.forwarding=1

On my Nas4Free machine.

I've also tried putting this firewall rule in my DD-WRT router without success.

iptables -t nat -A POSTROUTING -s 10.5.4.0/24 -o eth0 -j MASQUERADE

Nas4Free does not support NAT in the kernel, unlike FreeBSD that does have the support for it. But it has IPFW but it is turned off.

My OpenVPN server config

port 6521
mode server
tls-server
proto tcp-server
dev tun
client-cert-not-required
ca /usr/local/etc/openvpn/ca.crt
cert /usr/local/etc/openvpn/server.crt
key /usr/local/etc/openvpn/server.key
dh /usr/local/etc/openvpn/dh1024.pem
plugin /usr/local/lib/openvpn-auth-pam.so login
server 10.5.4.0 255.255.255.0
push "route 192.168.2.0 255.255.255.0"
push "dhcp-option DNS 192.168.2.1"
push "redirect-gateway def1 bypass-dhcp"
keepalive 10 120
cipher AES-128-CBC
comp-lzo
user root
group wheel
persist-key
persist-tun
verb 3
script-security 2

I appreciate any help I could get. Thanks for reading.

sgerami

Hi Kreddy,

I am located in Ontario\Canada. I set up an OpenVPN server at home on a Windows7 for my friend and relatives in Iran. It runs on port 443 and TCP only. I was hoping that this hides it from filtering but so far I haven't had any luck. I know that you have a different question and I don't wanna change the focus of your tread. If you are interested, I can make you a key to try to connect to my server. That might also help you troubleshoot your own server in Sweden.

Cheers

jonolumb

I had the same problem when trying to tunnel OpenVPN over SSH/Stunnel/Obfsproxy. The following should fix things for you. Add the line below to your client OpenVPN config:

route vpn.server.ip.address 255.255.255.255 net_gateway (remember to change the ip address to that of your server, you can also use a hostname instead)

This adds a specific rule to route traffic to your Stunnel client directly over your network and not through OpenVPN. This keeps the Stunnel connection alive and kicking. All other traffic is still routed through the OpenVPN tunnel to keep your communications safe.

References:
http://www.niteoweb.com/blog/openvpn-over-ssh