Hi
I have succesfully created a VPN between a Debian 8 (Server), and a Windows 7 (Client).
The connection is correctly established, but I can´t connect to the internet through the VPN.
I have added the NAT in IPTABLES and the forwarding:
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 10.8.0.0/24 anywhere
After reading many posts and manuals, i don´t have a clue what´s the issue. I suppose the routes are not creating correctly.
Server (Debian 8) ->
/etc/openvpn/server.conf:
# Which local IP address should OpenVPN
# listen on? (optional)
;local a.b.c.d
# Which TCP/UDP port should OpenVPN listen on?
# If you want to run multiple OpenVPN instances
# on the same machine, use a different port
# number for each one. You will need to
# open up this port on your firewall.
port 1194
# TCP or UDP server?
;proto tcp
proto udp
;dev tap
dev tun
# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel if you
# have more than one. On XP SP2 or higher,
# you may need to selectively disable the
# Windows firewall for the TAP adapter.
# Non-Windows systems usually don't need this.
;dev-node MyTap
ca ca.crt
cert servidor.crt
key servidor.key # This file should be kept secret
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
;server-bridge
# Push routes to the client to allow it
# to reach other private subnets behind
# the server. Remember that these
# private subnets will also need
# to know to route the OpenVPN client
# address pool (10.8.0.0/255.255.255.0)
# back to the OpenVPN server.
push "route 192.168.0.0 255.255.255.0"
;push "route 192.168.20.0 255.255.255.0"
;client-config-dir ccd
;route 192.168.40.128 255.255.255.248
;client-config-dir ccd
;route 10.9.0.0 255.255.255.252
;learn-address ./script
push "redirect-gateway def1"
# Certain Windows-specific network settings
# can be pushed to clients, such as DNS
# or WINS server addresses. CAVEAT:
# http://openvpn.net/faq.html#dhcpcaveats
# The addresses below refer to the public
# DNS servers provided by opendns.com.
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
client-to-client
#duplicate-cn
# The keepalive directive causes ping-like
# messages to be sent back and forth over
# the link so that each side knows when
# the other side has gone down.
# Ping every 10 seconds, assume that remote
# peer is down if no ping received during
# a 120 second time period.
keepalive 10 120
# For extra security beyond that provided
# by SSL/TLS, create an "HMAC firewall"
# to help block DoS attacks and UDP port flooding.
#
# Generate with:
# openvpn --genkey --secret ta.key
#
# The server and each client must have
# a copy of this key.
# The second parameter should be '0'
# on the server and '1' on the clients.
;tls-auth ta.key 0 # This file is secret
# Select a cryptographic cipher.
# This config item must be copied to
# the client config file as well.
;cipher BF-CBC # Blowfish (default)
;cipher AES-128-CBC # AES
;cipher DES-EDE3-CBC # Triple-DES
comp-lzo
# The maximum number of concurrently connected
# clients we want to allow.
;max-clients 100
;max-clients 100
group nogroup
persist-key
persist-tun
;log openvpn.log
log-append /var/log/openvpn.log
verb 3
mute 20
CLIENT (Windows 7) ->
C:\Program Files\OpenVPN\config\client.ovpn
##############################################
# Sample client-side OpenVPN 2.0 config file #
# for connecting to multi-client server. #
# #
# This configuration can be used by multiple #
# clients, however each client should have #
# its own cert and key files. #
# #
# On Windows, you might want to rename this #
# file so it has a .ovpn extension #
##############################################
# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client
# Use the same setting as you are using on
# the server.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
;dev tap
dev tun
# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel
# if you have more than one. On XP SP2,
# you may need to disable the firewall
# for the TAP adapter.
;dev-node MyTap
# Are we connecting to a TCP or
# UDP server? Use the same setting as
# on the server.
;proto tcp
proto udp
# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote mipc.dyndns.org 1194
;remote my-server-2 1194
# Choose a random host from the remote
# list for load-balancing. Otherwise
# try hosts in the order specified.
;remote-random
# Keep trying indefinitely to resolve the
# host name of the OpenVPN server. Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite
# Most clients don't need to bind to
# a specific local port number.
nobind
# Downgrade privileges after initialization (non-Windows only)
;user nobody
;group nogroup
# Try to preserve some state across restarts.
persist-key
persist-tun
# If you are connecting through an
# HTTP proxy to reach the actual OpenVPN
# server, put the proxy server/IP and
# port number here. See the man page
# if your proxy server requires
# authentication.
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]
# Wireless networks often produce a lot
# of duplicate packets. Set this flag
# to silence duplicate packet warnings.
mute-replay-warnings
# SSL/TLS parms.
# See the server config file for more
# description. It's best to use
# a separate .crt/.key file pair
# for each client. A single ca
# file can be used for all clients.
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\client.crt"
key "C:\\Program Files\\OpenVPN\\config\\client.key"
# Verify server certificate by checking
# that the certicate has the nsCertType
# field set to "server". This is an
# important precaution to protect against
# a potential attack discussed here:
# http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the nsCertType
# field set to "server". The build-key-server
# script in the easy-rsa folder will do this.
ns-cert-type server
# If a tls-auth key is used on the server
# then every client must also have the key.
;tls-auth ta.key 1
# Select a cryptographic cipher.
# If the cipher option is used on the server
# then you must also specify it here.
;cipher x
# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
comp-lzo
# Set log file verbosity.
verb 3
Connection log in the server
Sun Oct 27 09:32:24 2013 UID set to nobody
Sun Oct 27 09:32:24 2013 UDPv4 link local (bound): [undef]
Sun Oct 27 09:32:24 2013 UDPv4 link remote: [undef]
Sun Oct 27 09:32:24 2013 MULTI: multi_init called, r=256 v=256
Sun Oct 27 09:32:24 2013 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Sun Oct 27 09:32:24 2013 ifconfig_pool_read(), in='cliente,10.8.0.4', TODO: IPv6
Sun Oct 27 09:32:24 2013 succeeded -> ifconfig_pool_set()
Sun Oct 27 09:32:24 2013 IFCONFIG POOL LIST
Sun Oct 27 09:32:24 2013 cliente,10.8.0.4
Sun Oct 27 09:32:24 2013 Initialization Sequence Completed
Sun Oct 27 09:32:55 2013 MULTI: multi_create_instance called
Sun Oct 27 09:32:55 2013 85.86.134.16:58863 Re-using SSL/TLS context
Sun Oct 27 09:32:55 2013 85.86.134.16:58863 LZO compression initialized
Sun Oct 27 09:32:55 2013 85.86.134.16:58863 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Oct 27 09:32:55 2013 85.86.134.16:58863 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Oct 27 09:32:55 2013 85.86.134.16:58863 Local Options hash (VER=V4): '530fdded'
Sun Oct 27 09:32:55 2013 85.86.134.16:58863 Expected Remote Options hash (VER=V4): '41690919'
Sun Oct 27 09:32:55 2013 85.86.134.16:58863 TLS: Initial packet from [AF_INET]85.86.134.16:58863, sid=1fa71b9d 366e3841
Sun Oct 27 09:32:55 2013 85.86.134.16:58863 VERIFY OK: depth=1, /C=ES/ST=Bizkaia/L=Bilbao/O=ca/OU=ca/CN=ca/name=ca/emailAddress=adri58@gmail.com
Sun Oct 27 09:32:55 2013 85.86.134.16:58863 VERIFY OK: depth=0, /C=ES/ST=Bizkaia/L=Bilbao/O=cliente/OU=cliente/CN=cliente/name=cliente/emailAddress=adri58@gmail.com
Sun Oct 27 09:32:55 2013 85.86.134.16:58863 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Oct 27 09:32:55 2013 85.86.134.16:58863 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Oct 27 09:32:55 2013 85.86.134.16:58863 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Oct 27 09:32:55 2013 85.86.134.16:58863 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Oct 27 09:32:55 2013 85.86.134.16:58863 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sun Oct 27 09:32:55 2013 85.86.134.16:58863 [cliente] Peer Connection Initiated with [AF_INET]85.86.134.16:58863
Sun Oct 27 09:32:55 2013 cliente/85.86.134.16:58863 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=1::1a00:0:0:0
Sun Oct 27 09:32:55 2013 cliente/85.86.134.16:58863 MULTI: Learn: 10.8.0.6 -> cliente/85.86.134.16:58863
Sun Oct 27 09:32:55 2013 cliente/85.86.134.16:58863 MULTI: primary virtual IP for cliente/85.86.134.16:58863: 10.8.0.6
Sun Oct 27 09:32:58 2013 cliente/85.86.134.16:58863 PUSH: Received control message: 'PUSH_REQUEST'
Sun Oct 27 09:32:58 2013 cliente/85.86.134.16:58863 send_push_reply(): safe_cap=960
Sun Oct 27 09:32:58 2013 cliente/85.86.134.16:58863 SENT CONTROL [cliente]: 'PUSH_REPLY,route 192.168.0.0 255.255.255.0,redirect-gateway def1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
