Host can't access internet

willisdl

Hi,
I ran into an unusual issue with my host machine - I'm running a bridged OpenVPN server on Ubuntu 13.04, and my clients have no problem connecting and accessing the LAN and the internet through the host, but my host machine has no internet access at all (even though it can reach other machines on the local LAN). I'm guessing that the issue is the bridge - I think the packets are getting misdirected, since the bridged connection uses the IP address of the physical machine. Anyone have any suggestions? I hate to disable the bridge and VPN just to install additional packages...

Dave

brendan

what does the routing on the ubuntu box look like (post results from "netstat -nr")
what does the bridge look like (post results from "brctl show")
is this box behind a router like a linksys or other, or is it acting as your internet gateway?

it sounds to me like your default route is not being associated with the bridged interface, as opposed to the eth0 or whatever is the physical interface.

willisdl

Here's the output from netstat -nr:

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         192.168.2.1     0.0.0.0         UG        0 0          0 br0
192.168.2.0     0.0.0.0         255.255.255.0   U         0 0          0 br0

And here's brctl show:

bridge name     bridge id               STP enabled     interfaces
br0             8000.000c29e9001a       no              eth0
                                                        tap0

The host is behind our FiOS router, not acting as a gateway itself.

Dave

brendan

ok, so your default gateway is 192.168.2.1. what is the IP of the FiOS router? i think it is 192.168.1.1, and that might be why you are having issues. you need to have a router that will route between the 192.168.2 network and the 192.168.1 network.

willisdl

The FiOS router is the default gateway - ip is 192.168.2.1.

brendan

hmmm. your clients are able to connect to anything on the LAN, but not anything else. are you pushing a default route to the clients from your openvpn config? are you allowing split tunnels? posting your configs might help. what does the routing table from a connected client look like? what about a traceroute to www.google.com from a connected client? the symptoms still lead me to think its routing. when a client can reach all LAN destinations, but not any off-LAN IPs, its usually because routing is not there.

willisdl

Actually, my clients can reach off-LAN destinations (as mentioned in my first posting) - I have no problem browsing the internet with a client. It's only the host that can't reach outside the LAN, which is what has me puzzled.

brendan

ha, lost that detail in the shuffle. do you have a local firewall running? what does traceroute and ping show for www.google.com? can you run a tcpdump or wireshark packet capture on the host when trying to access the internet?

willisdl

When I run traceroute, I get:
http://www.google.com: System error
Cannot handle "host" cmdline arg `www.google.com' on position 1 (argc 1)

Pinging Google gives me:
ping: unknown host http://www.google.com

Unfortunately, right now I have no means to run tcpdump or wireshark (I need to install additional packages, which brings me back to the first issue).

Here's the content of my server.conf:

local 192.168.2.19

proto udp

dev tap0

up "/etc/openvpn/up.sh br0 eth0"

ca /home/david/easy-rsa/2.0/keys/ca.crt
cert /home/david/easy-rsa/2.0/keys/server.crt
key /home/david/easy-rsa/2.0/keys/server.key  # This file should be kept secret

dh /home/david/easy-rsa/2.0/keys/dh1024.pem

ifconfig-pool-persist ipp.txt

server-bridge 192.168.2.19 255.255.255.0 192.168.2.121 192.168.2.130

push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

duplicate-cn

keepalive 10 120

comp-lzo

user nobody
group nogroup

persist-key
persist-tun

status openvpn-status.log

log         openvpn.log
log-append  openvpn.log

verb 3

brendan

"cat /etc/resolv.conf" - you should have at least one nameserver directive with an IP after it.

it looks like you dont have any DNS setup. you will likely want to make sure you have DNS servers defined. your FiOS router should be proxying DNS as most gateway devices do, and setting your DNS to its internal IP (192.168.2.1) should work. you can also try 8.8.4.4 and 8.8.8.8 as your DNS servers to see if something else is wrong.

willisdl

That was it! Once I added the nameservers manually, everything started working again. I hadn't thought of that before since I had added the DNS entries in Network Manager, but apparently that didn't actually update resolv.conf for some reason. Thanks!

brendan

if your /etc/resolv.conf is not being correctly populated because you are using NetworkManager, i would venture a guess that a reboot will put you back into the same position. you might want to check your interface configuration files to make sure your DNS servers are set. i use fedora, so the file names and locations might be different.

/etc/sysconfig/network-scripts/ifcfg-br0

has the below lines for me:

DNS1=192.168.50.1
DNS2=192.168.25.1

willisdl

You're right about not being able to edit resolv.conf, but I found a workaround. On Ubuntu, there is a file called /etc/resolvconf/resolv.conf.d/head which will let you add DNS entries and retain them when you reboot. Once I updated that, it's been working like a charm!

Dave