[Resolved] Trouble using redirect-gateway

haxle

server conf:

dev tun
proto udp 
port <server port>
mode server
tls-server 
float 
dh /etc/openvpn/ssl/keys/dh2048.pem
ca /etc/openvpn/ssl/keys/ca.crt
cert /etc/openvpn/ssl/keys/server.crt
key /etc/openvpn/ssl/keys/server.key
tls-auth /etc/openvpn/ssl/keys/ta.key 0
user nobody
group nogroup
status /var/log/openvpn/vpn-status.log
log /var/log/openvpn/vpnlog
comp-lzo
verb 3
keepalive 10 120
fragment 1300
mssfix
hand-window 300
tcp-nodelay
push "redirect-gateway def1"
push "dhcp-option DNS <server dns from resolv.conf on vps>"

client conf:

client
dev tun
proto udp
remote <server ip> <server port>
resolv-retry infinite
nobind
user nobody
group nobody
persist-key
persist-tun
mute-replay-warnings
ca /home/haxle/vpnkeys/ca.crt
cert /home/haxle/vpnkeys/client1.crt
key /home/haxle/vpnkeys/client1.key
tls-auth /home/haxle/vpnkeys/ta.key 1
comp-lzo
verb 3
remote-cert-tls server
pull
fragment 1300
mssfix
route-gateway <server ip>

this configuration is working so far as to get "initialization sequence complete" on my client but specifically I'm getting these
messages that I'm assuming are creating my problem with redirect-gateway:

Sun Oct 13 09:33:20 2013 /usr/bin/ip route add <server ip>/32 via 192.168.1.1
Sun Oct 13 09:33:20 2013 /usr/bin/ip route add 0.0.0.0/1 via <server ip>
RTNETLINK answers: Network is unreachable
Sun Oct 13 09:33:20 2013 ERROR: Linux route add command failed: external program exited with error status: 2
Sun Oct 13 09:33:20 2013 /usr/bin/ip route add 128.0.0.0/1 via <server ip>
RTNETLINK answers: Network is unreachable
Sun Oct 13 09:33:20 2013 ERROR: Linux route add command failed: external program exited with error status: 2
Sun Oct 13 09:33:20 2013 GID set to nobody
Sun Oct 13 09:33:20 2013 UID set to nobody
Sun Oct 13 09:33:20 2013 Initialization Sequence Completed

My goal is to have all of my traffic routed through the openvpn server, I was getting another error on my display before this that
stated:

NOTE: unable to redirect default gateway -- VPN gateway parameter (--route-gateway or --ifconfig) is missing

which prompted me to add the last line in my client config to mitigate the problem.. aparently I don't know what I'm doing and I don't really know what to put there to make this work, so I apoligize if this is obvious somewhere in the how to or on the internet but I'm having trouble finding it. Any help would be apriciated, thank you!

P.S.
I'm not sure if it matters but the vps is on a public ip that is exposed to the internet so i don't know how that would affect the dns and dhcp portions of this solution. thanks

haxle

From my original post and my server.conf:

The last three lines of my server.conf:

tcp-nodelay
push "redirect-gateway def1"
push "dhcp-option DNS <server dns from resolv.conf on vps>"

also, I thought that because it was saying:

  Sun Oct 13 09:33:20 2013 Initialization Sequence Completed

that meant that it was starting successfully?

and when I add

server <ip address of server> <netmask of server>

I get the following:

Options error: --server directive network/netmask combination is invalid
Use --help for more information.

and the server no longer starts. Am I supposed to be indicating a 24 subnet for the server? if so how would I determine that considering the server is exposed to the internet and doesn't have an internal ip address?

haxle

ok so, I'm dumb and I have since tried adding:

server 10.8.0.0 255.255.255.0

to the server conf and I'm getting a better connection so thank you debbie! I am now however having an issue where I am unable to contact anything other than 10.8.0.1 soooo I'm gonna keep plugging at this and see what I can figure out from here!

haxle

Ok, so, I don't really know what else to do at this point..

I've got

push "redirect-gateway def1"

set in my server conf, I've executed

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

on the sever to nat all traffic from the vpn subnet to be routed out through the ethernet adapter and i've also set

push "dhcp-option DNS 10.8.0.1"

to have the client use the vpn server for dns requests.. still nothing. I can only contact the vpn server. help? The only thing I think I need help with is this:

(or non-Windows clients with some extra server-side scripting) to use 10.8.0.1 as their DNS server.

where would I need to look to find this information? Do I need to setup bind on my vpn server? if that were the case why is it I still can't ping 8.8.8.8?

haxle

so.. Debbie, thank you so much for your gentle hints in the right direction, I am now successfully logging into forums.openvpn.net through my vpn server. Ip forwarding was exactly the problem! I did a few simple tweaks and now Its working!

I didn't really know what that was so I did a little googling on how to do this with my linux distro, gentoo, and this is what I found:

ENABLE_FORWARDING_IPv4="yes"

in /etc/conf.d/iptables

and/or

echo 1 > /proc/sys/net/ipv4/conf/all/forwarding

sets ip forwarding to on in gentoo linux. I did find some instances of problems coming from this setting not being implemented on a restart so we just put the previous code line into the start function of /etc/init.d/local to avoid that problem.

At this point I could then ping 8.8.8.8 and from there i was able to edit my /etc/resolv.conf to show nameserver 8.8.8.8 and thus regaining my connectivity, It's not as fast as I would like but I'm assuming if I were to setup bind or maybe squid on my gateway it would improve throughput. Thanks again Debbie I'm airborn!!!!