Using the internet and Openvpn tunnel simultaneously?

jimford

I can connect remotely to my home router from a public AP, and hence to machines on my LAN, but can't connect to the the internet unless I disconnect the tunnel.

I guess this is a routing problem, but as I know next to nothing about routing and the online resources explaining routing are quite opaque to me, I'd appreciate a bit of advice, please.

Jim

maikcat

hi there,

but as I know next to nothing about routing

is like i say "hey i want to fix my engine but i have no clue of how it works..."

vpn's require routing knowledge,so maybe its time to start reading... 🙂

anyway, if your server setup has a directive like:

push redirect-gateway def1

remove it , restart the openvpn server and try again...

regards

Michael.

jimford

Thanks for the reply Michael, I'll have a look. I'm using DD-WRT with the web interface and the line doesn't look familiar.

With over 70 'summers on my back' I obviously have limited time to start mugging-up on new subjects, which is why I asked in the first place. I want to be able to 'cut to the chase' and get back to my rocking chair!

;^)

Jim

maikcat

hello jim,

can you please post a screenshot of your openvpn settings menu?

With over 70 'summers on my back' I obviously have limited time to start mugging-up on new subjects, which is why I asked in the first place

never its too late... 😉

Michael.

jimford

Thanks for the replies, Michael.

This is the /var/openvpn/openvpn.conf file that the DD-WRT web interface creates (except for the asterisks):

dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
keepalive 10 120
verb 4
mute 5
log-append /var/log/openvpn
writepid /var/log/openvpnd.pid
management 127.0.0.1 5002
management-log-cache 50
mtu-disc yes
topology subnet
client-config-dir /tmp/openvpn/ccd
script-security 2
port 1194
proto udp
cipher bf-cbc
auth sha256
tls-server
ifconfig-pool-persist /tmp/openvpn/ip-pool 86400
client-to-client
fast-io
tun-mtu 1500
server **.**.*.* 255.255.255.0
dev tun0
passtos
comp-lzo
keepalive 10 60
persist-tun
push "route 192.168.1.0 255.255.255.0 ****.*******.org"

Jim

maikcat

thats strange because your setup posted does not redirects ALL traffic
via vpn tunnel...

one last question though...

when you are trying to connect from your client,
is your cilent has an ip address from 192.168.1.x range?

Michael.

jimford

maikcat wrote one last question though...

when you are trying to connect from your client,
is your cilent has an ip address from 192.168.1.x range?

No, I get a dynamic IP address from the public AP I use, or from the 3G network provider, if I'm using a 'dongle'.
I've got a feeling that I don't really need the line, but I put it in in an attempt to get rid of " MULTI: bad source address from client [10.50.198.207] packet dropped" errors in the Openvpn log (it didn't work!).

Jim

maikcat

can you please post the output of

netstat -nr

on your client while connected on vpn?

also can you post the output of

tracert 8.8.8.8

while you are connected?

Michael.

jimford

maikcat wrotecan you please post the output of
netstat -nr
on your client while connected on vpn?

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         10.19.39.1      0.0.0.0         UG        0 0          0 tun0
10.19.39.0      0.0.0.0         255.255.255.0   U         0 0          0 tun0
10.64.64.64     0.0.0.0         255.255.255.255 UH        0 0          0 ppp0
86.5.224.16     10.64.64.64     255.255.255.255 UGH       0 0          0 ppp0
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 ppp0

also can you post the output of
tracert 8.8.8.8
while you are connected?

traceroute to 8.8.8.8 (8.8.8.8), 64 hops max
 1   10.19.39.1 (10.19.39.1) 170.879ms 138.916ms 140.327ms 
 2   *  *  * 
 3   *  *  * 
Last line repeated until 44 at which point I gave up!

Thanks again for your continued help, Michael.

Jim

maikcat

can you post your client config also?

if there is a route line inside it please remove it...

your default gateway it is indeed via vpn tunnel :shock:

post your client config please...

Michael.

jimford

maikcat wrotecan you post your client config also?

Here it is, Michael (exported from the Xubuntu gui):

client
remote jimford.darktech.org
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/client1.crt
key /etc/openvpn/easy-rsa/keys/client1.key
cipher BF-CBC
comp-lzo yes
dev tun
proto udp
nobind
auth-nocache
script-security 2
persist-key
persist-tun
user openvpn
group openvpn

(I guess it's OK to leave the remote hostname in clear text - nobody can do anything with it anyway, can they?)

Jim

maikcat

can you post:

client log
output of netstat -nr before connecting to vpn...

the weird thing is that your config is not using any routing table manupilating directives... :?

Michael.

jimford

maikcat wrotecan you post:

client log
output of netstat -nr before connecting to vpn...

the weird thing is that your config is not using any routing table manupilating directives... :?

Here's the netstat -nr output:

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG        0 0          0 wlan1
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 wlan1
192.168.1.0     0.0.0.0         255.255.255.0   U         0 0          0 wlan1
netstat.txt (END)

Thanks again for your help, Michael.

Jim

maikcat

courious though...

how exactly are you firing up your vpn?

if you are using network manager or any other tool check if it
has any settings related to default gateway....

Michael.

jimford

maikcat wrote how exactly are you firing up your vpn?

With the Xubuntu/Ubuntu Network Manager gui.

if you are using network manager or any other tool check if it
has any settings related to default gateway....

I couldn't see anything in the network manager gui. I also did a 'grep -r ateway' in the /etc directory, but nothing interesting came up.

Jim

dentalan

Just a hint. I had a similar problem, and what I had wrong was the name of the client in ccd folder. The client's name was 'client4' and I had typed 'clieny4'.
I post it just in case