vpn connected to server, but no internet

lainiwaku

Hi , some month ago i have tried to install vpn server, but it doesn't work

I try again , with clean server, news tutorial but . . . openvpn still sucks ><

How should we make this thing work on server ?

My server is : ubuntu server (latest x64)
My client is : windows 8 x64

serveur conf.

  GNU nano 2.2.6                                      Fichier : openvpn.conf

#Serveur UDP/1194
dev tun
proto udp
port 1194

#Clés et certificats
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem

#Sécurité
user nobody
group nogroup
chroot /etc/openvpn/jail
persist-key
persist-tun
comp-lzo
client-to-client

#Réseau
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1"


topology subnet
keepalive 10 120

#Logs
status /var/log/openvpn-status.log
log-append /var/log/openvpn
verb 5

#les dns
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

client conf.

client
dev tun
proto udp
remote 176.31.***.*** 1194
nobind
persist-key
persist-tun
ca ca.crt
cert [me].crt
key [me].key
comp-lzo
verb 6
route-method exe
route-delay 2

When i try to connect to openVPN server,
client log

Tue Aug 13 12:05:28 2013 us=156076 UDPv4 WRITE [109] to [AF_INET]176.31.***.***:1194: P_DATA_V1 kid=0 DATA len=108

Tue Aug 13 12:05:28 2013 us=907619 UDPv4 WRITE [109] to [AF_INET]176.31.***.***:1194: P_DATA_V1 kid=0 DATA len=108
Tue Aug 13 12:05:29 2013 us=322510 TEST ROUTES: 1/1 succeeded len=0 ret=1 a=0 u/d=up
Tue Aug 13 12:05:29 2013 us=322510 C:\WINDOWS\system32\route.exe ADD 176.31.***.*** MASK 255.255.255.255 192.168.1.1
Tue Aug 13 12:05:29 2013 us=322510 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Tue Aug 13 12:05:29 2013 us=340522 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.1
Tue Aug 13 12:05:29 2013 us=340522 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Tue Aug 13 12:05:29 2013 us=354532 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.1
Tue Aug 13 12:05:29 2013 us=354532 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Tue Aug 13 12:05:29 2013 us=368541 Initialization Sequence Completed
Tue Aug 13 12:05:29 2013 us=368541 MANAGEMENT: >STATE:1376388329,CONNECTED,SUCCESS,10.8.0.2,176.31.***.***

ip assigned is 10.8.0.2 and vpn server log show my Internet provider IP

So openVPN succefully connected to server, and because i can't access to internet when i'm connected, trafic are routed to server

iptables -L

Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
DROP       tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG
DROP       tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/NONE
DROP       tcp  --  anywhere             anywhere             tcpflags: SYN,RST/SYN,RST
DROP       all  --  anywhere             anywhere             PKTTYPE = broadcast
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
LOG        all  --  anywhere             anywhere             LOG level warning
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:1576
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
ACCEPT     icmp --  ping.ovh.net         anywhere
ACCEPT     icmp --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             anywhere             tcp dpts:6700:6999
ACCEPT     tcp  --  anywhere             anywhere             tcp dpts:5000:x11
ACCEPT     udp  --  anywhere             anywhere             udp dpt:6880
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https
ACCEPT     udp  --  anywhere             anywhere             udp dpt:http
ACCEPT     udp  --  anywhere             anywhere             udp dpt:openvpn
ACCEPT     esp  --  10.8.0.0/24          anywhere
ACCEPT     udp  --  10.8.0.0/24          anywhere             multiport sports isakmp,10000
ACCEPT     all  --  anywhere             anywhere

Chain FORWARD (policy DROP)
target     prot opt source               destination
LOG        all  --  anywhere             anywhere             LOG level warning

Chain OUTPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             state NEW,RELATED,ESTABLISHED,UNTRACKED

iptables -L -t nat -v

Chain PREROUTING (policy ACCEPT 1145K packets, 138M bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain INPUT (policy ACCEPT 1103K packets, 135M bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 210K packets, 18M bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 210K packets, 18M bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 MASQUERADE  all  --  any    eth0    10.8.0.0/24          anywhere

echo "1" > /proc/sys/net/ipv4/ip_forward and push "redirect-gateway def1 bypass-dhcp" done

From my computer, connected to openvpn i can ping 10.8.0.2 and my server IP, i can't ping anything else
i have exactely do what said in tutorial, i don't understand !

brendan

Tue Aug 13 12:05:29 2013 us=322510 C:\WINDOWS\system32\route.exe ADD 176.31.***.*** MASK 255.255.255.255 192.168.1.1
Tue Aug 13 12:05:29 2013 us=340522 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.1
Tue Aug 13 12:05:29 2013 us=354532 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.1

not sure what this is wrong, as that looks ok. what does the route table look like on the client? if the client is not running the openvpn client as an administrator, the route additions might not be done.

there are a few caveats to running in a chroot jail, and you may need to explore what they are, and if you need to adjust your configs for the jailed environment.

maikcat

general rule...

keep in simple

meaning,test your setup with firewalling rules OFF FIRST!!! 🙂

i believe that droping all traffic on your forward rule creates the problem..

but do leave the NAT rule on though...

also check your clients routing table if he recieves the default gateway routes.

Michael.

lostintranslation

Hi guy!

Your config?

server on wan through internet? or local?

firewall or dns problem...