Cannot get clients through internet (able to ping publics)

mixth

Hi everyone!
First of all, I want to introduce myself as a newbie in network matters and also about VPN but I'm learning about them. I start two OpenVPN servers in two locations for gaming from my uni's network. Only TCPs are allowed here.

At first, everything was doing well for two weeks. But today one of the servers failed to get user through internet as It was used to be. The server and clients can ping public IPs (like 8.8.8.8, 4.4.4.4, etc.) but cannot browse any websites. I thought it was about DNS which I've already used Google's. I changed for other public DNS server but didn't solve the problem.

server config:

port 443
proto tcp
dev tun
 
server 10.4.0.0 255.255.255.0
 
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh1024.pem
 
##option
persist-key
persist-tun
keepalive 1 60
reneg-sec 432000
 
user nobody
#group nogroup
client-to-client
username-as-common-name
client-cert-not-required
 
plugin /etc/openvpn/openvpn-auth-pam.so openvpn
 
max-clients 50
push "persist-key"
push "persist-tun"
push "redirect-gateway def1"
push "shaper 100000"
 
push "dhcp-option DNS 10.4.0.1"
#push "dhcp-option DNS 8.8.4.4"
 
script-security 3 system
client-connect /etc/openvpn/script/connect.sh
client-disconnect /etc/openvpn/script/disconnect.sh
 
status /etc/openvpn/log/tcp_443.log
log-append /etc/openvpn/log/openvpn-20130703.log

verb 6

client config:

client
dev tun
 
proto tcp
remote server_ip 443

persist-key
persist-tun

nobind
#comp-lzo
auth-user-pass
reneg-sec 432000
resolv-retry infinite

route-method exe
route-delay 2

ca ca03.crt
verb 6

server log:
http://pastebin.com/DSGKR1gB

client log:
http://pastebin.com/2YrMKegi

*The time might shift a bit, I forgot to change client's config to verb 6. Sorry :oops:

I tried to fix this problem for almost 5 hours and realized it's not something I can do it myself.
Thank you! 🙂
(Sorry for my bad English, I'm not a native speaker)

maikcat

can you post the output of

iptables -L -t nat -v

on your openvpn server?

Michael.

mixth

Thank you for your help @maikcat 😃

here is the result of the command:

Chain PREROUTING (policy ACCEPT 267 packets, 20923 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 50 packets, 8928 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 445 packets, 28082 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 445 packets, 28082 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  217 11995 MASQUERADE  all  --  any    eth0    10.4.0.0/24          anywhere

This morning I did change

push "dhcp-option DNS 8.8.8.8"

on the server config to

push "dhcp-option DNS xxx.xxx.xxx.xxx"

that xxx.xxx.xxx.xxx is the ip of the eth0 interface DNS.
Now clients can browse websites! but still cannot play any games. 🙁

maikcat

your setup uses routing (tun)

what games do you want to play?

is ip forwarding enabled on openvpn server?

Michael.

mixth

Online games based on others' servers, Dota 2, LoL, HoN.

I've put this line in /etc/rc.local for ip forwarding:

echo "1" > /proc/sys/net/ipv4/ip_forward
echo "1" > /proc/sys/net/ipv4/ip_dynaddr

I cat those files and can get 1s back.

The strange thing is the games can be lunched and connected to the server but when try to connect (for watching or for playing), it simply tells "cannot establish connection". This error is found in every games we've tried. My second server, which setup same configuration but place in other location, doesn't have any problem at all.

The server is running Ubuntu Server 12.04, is there any filter software or anything? Maybe I should contact VPS provider?

here is iptables -L -n:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Thank you, Michael! 🙂

maikcat

Maybe I should contact VPS provider?

yeap....

the second setup also uses NAT?

Michael.

mixth

maikcat wrote the second setup also uses NAT?

Yes. They are almost identical. The second one doesn't have 'shaper' but I did try removing it and restarted the service, no problem was solved. Also I added 'shaper' a week before this problem happened.

I will contact my VPS provider if they can help me out.

Thank you so much, Michael 😉