traffic problems with my vpn

assu

Hi,

I installed openvpn in a vps that i have in uk and worked fine.

For a few days ago i loose internet connection by web browser or other apllications that i have.

the weird is that i have ping to several websites, but by web browser... nothing.

Can somebody help me with some idea to solve this issue?

maikcat

please post configs used & logs.

Michael.

assu

hi. thank you very much for your availability with your help, below the log and client.conf

Thu Aug 22 20:04:36 2013 OpenVPN 2.3.2 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Jun 3 2013
Enter Management Password:
Thu Aug 22 20:04:36 2013 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Thu Aug 22 20:04:36 2013 Need hold release from management interface, waiting...
Thu Aug 22 20:04:36 2013 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Thu Aug 22 20:04:36 2013 MANAGEMENT: CMD 'state on'
Thu Aug 22 20:04:36 2013 MANAGEMENT: CMD 'log all on'
Thu Aug 22 20:04:36 2013 MANAGEMENT: CMD 'hold off'
Thu Aug 22 20:04:36 2013 MANAGEMENT: CMD 'hold release'
Thu Aug 22 20:04:36 2013 Socket Buffers: R=[8192->8192] S=[8192->8192]
Thu Aug 22 20:04:36 2013 UDPv4 link local: [undef]
Thu Aug 22 20:04:36 2013 UDPv4 link remote: [AF_INET]x.x.x.x:1194
Thu Aug 22 20:04:36 2013 MANAGEMENT: >STATE:1377194676,WAIT,,,
Thu Aug 22 20:04:37 2013 MANAGEMENT: >STATE:1377194677,AUTH,,,
Thu Aug 22 20:04:37 2013 TLS: Initial packet from [AF_INET]x.x.x.x:1194, sid=d6dbcf12 32d41b79
Thu Aug 22 20:04:37 2013 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=changeme, CN=changeme, name=changeme, emailAddress=mail@host.domain
Thu Aug 22 20:04:37 2013 VERIFY OK: nsCertType=SERVER
Thu Aug 22 20:04:37 2013 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=changeme, CN=server, name=changeme, emailAddress=mail@host.domain
Thu Aug 22 20:04:37 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Aug 22 20:04:37 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Aug 22 20:04:37 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Aug 22 20:04:37 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Aug 22 20:04:37 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu Aug 22 20:04:37 2013 [server] Peer Connection Initiated with [AF_INET]x.x.x.x:1194
Thu Aug 22 20:04:38 2013 MANAGEMENT: >STATE:1377194678,GET_CONFIG,,,
Thu Aug 22 20:04:40 2013 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Aug 22 20:04:40 2013 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 10.8.0.1,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Thu Aug 22 20:04:40 2013 OPTIONS IMPORT: timers and/or timeouts modified
Thu Aug 22 20:04:40 2013 OPTIONS IMPORT: --ifconfig/up options modified
Thu Aug 22 20:04:40 2013 OPTIONS IMPORT: route options modified
Thu Aug 22 20:04:40 2013 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu Aug 22 20:04:40 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Aug 22 20:04:40 2013 MANAGEMENT: >STATE:1377194680,ASSIGN_IP,,10.8.0.6,
Thu Aug 22 20:04:40 2013 open_tun, tt->ipv6=0
Thu Aug 22 20:04:40 2013 TAP-WIN32 device [Local Area Connection 10] opened: \\.\Global\{2DF7770B-13F5-40A4-B51C-CCD03A64A4D8}.tap
Thu Aug 22 20:04:40 2013 TAP-Windows Driver Version 9.9
Thu Aug 22 20:04:40 2013 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {2DF7770B-13F5-40A4-B51C-CCD03A64A4D8} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Thu Aug 22 20:04:40 2013 Successful ARP Flush on interface [3] {2DF7770B-13F5-40A4-B51C-CCD03A64A4D8}
Thu Aug 22 20:04:45 2013 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Thu Aug 22 20:04:45 2013 C:\WINDOWS\system32\route.exe ADD x.x.x.x MASK 255.255.255.255 192.168.1.1
Thu Aug 22 20:04:45 2013 Route addition via IPAPI succeeded [adaptive]
Thu Aug 22 20:04:45 2013 C:\WINDOWS\system32\route.exe ADD 192.168.1.1 MASK 255.255.255.255 192.168.1.1 IF 2
Thu Aug 22 20:04:45 2013 Route addition via IPAPI succeeded [adaptive]
Thu Aug 22 20:04:45 2013 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5
Thu Aug 22 20:04:45 2013 Route addition via IPAPI succeeded [adaptive]
Thu Aug 22 20:04:45 2013 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.5
Thu Aug 22 20:04:45 2013 Route addition via IPAPI succeeded [adaptive]
Thu Aug 22 20:04:45 2013 MANAGEMENT: >STATE:1377194685,ADD_ROUTES,,,
Thu Aug 22 20:04:45 2013 C:\WINDOWS\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Thu Aug 22 20:04:45 2013 Route addition via IPAPI succeeded [adaptive]
Thu Aug 22 20:04:45 2013 Initialization Sequence Completed
Thu Aug 22 20:04:45 2013 MANAGEMENT: >STATE:1377194685,CONNECTED,SUCCESS,10.8.0.6,x.x.x.x
Thu Aug 22 21:04:38 2013 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=changeme, CN=changeme, name=changeme, emailAddress=mail@host.domain
Thu Aug 22 21:04:38 2013 VERIFY OK: nsCertType=SERVER
Thu Aug 22 21:04:38 2013 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=changeme, CN=server, name=changeme, emailAddress=mail@host.domain
Thu Aug 22 21:04:38 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Aug 22 21:04:38 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Aug 22 21:04:38 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Aug 22 21:04:38 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Aug 22 21:04:38 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu Aug 22 23:35:14 2013 [server] Inactivity timeout (--ping-restart), restarting
Thu Aug 22 23:35:14 2013 SIGUSR1[soft,ping-restart] received, process restarting
Thu Aug 22 23:35:14 2013 MANAGEMENT: >STATE:1377207314,RECONNECTING,ping-restart,,
Thu Aug 22 23:35:14 2013 Restart pause, 2 second(s)
Thu Aug 22 23:35:16 2013 Socket Buffers: R=[8192->8192] S=[8192->8192]
Thu Aug 22 23:35:16 2013 UDPv4 link local: [undef]
Thu Aug 22 23:35:16 2013 UDPv4 link remote: [AF_INET]x.x.x.x:1194
Thu Aug 22 23:35:16 2013 MANAGEMENT: >STATE:1377207316,WAIT,,,
Thu Aug 22 23:35:16 2013 MANAGEMENT: >STATE:1377207316,AUTH,,,
Thu Aug 22 23:35:16 2013 TLS: Initial packet from [AF_INET]x.x.x.x:1194, sid=c481ea16 6ad154c2
Thu Aug 22 23:35:16 2013 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=changeme, CN=changeme, name=changeme, emailAddress=mail@host.domain
Thu Aug 22 23:35:16 2013 VERIFY OK: nsCertType=SERVER
Thu Aug 22 23:35:16 2013 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=changeme, CN=server, name=changeme, emailAddress=mail@host.domain
Thu Aug 22 23:35:17 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Aug 22 23:35:17 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Aug 22 23:35:17 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Aug 22 23:35:17 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Aug 22 23:35:17 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu Aug 22 23:35:17 2013 [server] Peer Connection Initiated with [AF_INET]x.x.x.x:1194
Thu Aug 22 23:35:18 2013 MANAGEMENT: >STATE:1377207318,GET_CONFIG,,,
Thu Aug 22 23:35:19 2013 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Aug 22 23:35:19 2013 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 10.8.0.1,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Thu Aug 22 23:35:19 2013 OPTIONS IMPORT: timers and/or timeouts modified
Thu Aug 22 23:35:19 2013 OPTIONS IMPORT: --ifconfig/up options modified
Thu Aug 22 23:35:19 2013 OPTIONS IMPORT: route options modified
Thu Aug 22 23:35:19 2013 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu Aug 22 23:35:19 2013 Preserving previous TUN/TAP instance: Local Area Connection 10
Thu Aug 22 23:35:19 2013 Initialization Sequence Completed
Thu Aug 22 23:35:19 2013 MANAGEMENT: >STATE:1377207319,CONNECTED,SUCCESS,10.8.0.6,x.x.x.x

xxxxxxxxxxxxxxxxxxxxxxxxx------xxxxxxxxxx-----xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

client
dev tun
proto udp
remote x.x.x.x 1194
resolv-retry infinite
nobind

persist-key
persist-tun

ca ca.crt
cert client1.crt

ns-cert-type server

comp-lzo

verb 3

key client1.key

maikcat

please also post:

server config used
server logs
output of iptables -t nat -L -v (from your openvpn server)
output of iptables -L -v (from your openvpn server)
output of netstat -nr (on vpn client after vpn connects)
output of tracert 8.8.8.8 (on vpn client after vpn connects)

Michael.

assu

C:\Documents and Settings\Administrator>netstat -nr

Route Table
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 0c 29 6f 9a f8 ...... AMD PCNET Family PCI Ethernet Adapter - Packet
cheduler Miniport
0x3 ...00 ff 2d f7 77 0b ...... TAP-Windows Adapter V9 - Packet Scheduler Minip
rt
0x10006 ...7c c3 a1 52 c2 ab ...... Bluetooth Device (Personal Area Network)
0x60005 ...02 50 f2 00 00 01 ...... Citrix Virtual Adapter - Packet Scheduler M
niport
===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 128.0.0.0 10.8.0.5 10.8.0.6 1
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.35 10
10.8.0.1 255.255.255.255 10.8.0.5 10.8.0.6 1
10.8.0.4 255.255.255.252 10.8.0.6 10.8.0.6 30
10.8.0.6 255.255.255.255 127.0.0.1 127.0.0.1 30
10.255.255.255 255.255.255.255 10.8.0.6 10.8.0.6 30
31.3.x.x 255.255.255.255 192.168.1.1 192.168.1.35 1
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
128.0.0.0 128.0.0.0 10.8.0.5 10.8.0.6 1
192.168.1.0 255.255.255.0 192.168.1.35 192.168.1.35 10
192.168.1.1 255.255.255.255 192.168.1.35 192.168.1.35 1
192.168.1.35 255.255.255.255 127.0.0.1 127.0.0.1 10
192.168.1.255 255.255.255.255 192.168.1.35 192.168.1.35 10
224.0.0.0 240.0.0.0 10.8.0.6 10.8.0.6 30
224.0.0.0 240.0.0.0 192.168.1.35 192.168.1.35 10
255.255.255.255 255.255.255.255 10.8.0.6 60005 1
255.255.255.255 255.255.255.255 10.8.0.6 10006 1
255.255.255.255 255.255.255.255 10.8.0.6 10.8.0.6 1
255.255.255.255 255.255.255.255 192.168.1.35 192.168.1.35 1
Default Gateway: 10.8.0.5
===========================================================================
Persistent Routes:
None

C:\Documents and Settings\Administrator>tracert 8.8.4.4

Tracing route to 8.8.4.4 over a maximum of 30 hops

1 36 ms 39 ms 39 ms 10.8.0.1
2 170 ms 223 ms 43 ms 109.200.19.113
3 59 ms 48 ms 51 ms 109.200.16.245
4 * * * Request timed out.
5 42 ms 39 ms 39 ms 109.200.17.194
6 35 ms 39 ms 39 ms 5.57.80.136
7 36 ms 38 ms 39 ms 209.85.255.76
8 36 ms 39 ms 39 ms 209.85.253.196
9 44 ms 53 ms 49 ms 209.85.240.28
10 48 ms 49 ms 49 ms 216.239.49.36
11 * * * Request timed out.
12 52 ms 48 ms 48 ms 8.8.4.4

Trace complete.

C:\Documents and Settings\Administrator>ping 8.8.4.4

Pinging 8.8.4.4 with 32 bytes of data:

Reply from 8.8.4.4: bytes=32 time=48ms TTL=50
Reply from 8.8.4.4: bytes=32 time=51ms TTL=50
Reply from 8.8.4.4: bytes=32 time=45ms TTL=50
Reply from 8.8.4.4: bytes=32 time=48ms TTL=50

Ping statistics for 8.8.4.4:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 45ms, Maximum = 51ms, Average = 48ms

oot@localhost:~# iptables -t nat -L -v
Chain PREROUTING (policy ACCEPT 15278 packets, 950K bytes)
pkts bytes target prot opt in out source destination

Chain INPUT (policy ACCEPT 15112 packets, 942K bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 9568 packets, 695K bytes)
pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 9568 packets, 695K bytes)
pkts bytes target prot opt in out source destination
160 8048 SNAT all -- any any 10.8.0.0/24 anywhere to:31.3.x.x

oot@localhost:~# iptables -L -v
Chain INPUT (policy ACCEPT 295K packets, 159M bytes)
pkts bytes target prot opt in out source destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
13946 5725K ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
239 14972 ACCEPT all -- any any 10.8.0.0/24 anywhere
0 0 REJECT all -- any any anywhere anywhere reject-with icmp-port-unreachable

Chain OUTPUT (policy ACCEPT 211K packets, 234M bytes)
pkts bytes target prot opt in out source destination

maikcat

can you check if name resolving works?
also can you check if you do have mtu problems by transfering a file via ssh
from/to your openvpn server?

Michael.

assu

Yes it working nice now after you talking me about name resolving

i just change in server.conf file
from push "dhcp-option DNS 10.8.0.1"
to push "dhcp-option DNS 74.82.x.x"

I mean i change for the nameserver configured in resolv.conf .

The weird thing is that it was working before with 10.8.0.1, but maybe the VPS provider change something

Before
C:\Documents and Settings\Administrator>nslookup hostname
*** Can't find server name for address 10.8.0.1: No response from server
DNS request timed out.
timeout was 2 seconds.
*** Can't find server name for address 80.58.x.x: Timed out
DNS request timed out.
timeout was 2 seconds.
*** Can't find server name for address 80.58.x.x: Timed out
*** Default servers are not available
Server: UnKnown
Address: 10.8.0.1

*** UnKnown can't find hostname: No response from server

after
C:\Documents and Settings\Administrator>nslookup hostname
Server: ordns.x.x
Address: 74.82.x.x

*** ordns.x.x can't find hostname: Non-existent domain

C:\Documents and Settings\Administrator>

Thanks very much Michel for your availability in helping me and i let here the solution for this issue for somebody who can have it too

REGARDS