Cannot connect to sites on same public IP as OpenVPN server

truwebpro

Hello,

Well it seems I've learned just enough now to be dangerous. I have a connection up and running quite well overall, but there is a problem remaining that has me stuck.

General Setup: I have OpenVPN set up on a CentOS dedicated server. The dedicated server, among other things, is host to many websites that share the same public IP. I am connecting remotely from a client Windows 7 x64 laptop that accesses the net via a wireless access point, which in turn is cabled to my ISP's DSL modem that utilizes PPPoE.

Problem: I can ping the server. I can ping the server's primary domain name. I can ping google or anyone else and can surf the net with relatively good speed over the VPN. The problem is as the subject line says: I am unable to connect to websites hosted on the same server as the VPN. Even though I can ping them, they are inaccessible from any web browser on my client (I usually use Firefox).

I have considered the information offered here: https://forums.openvpn.net/topic7175.html. Unfortunately the solutions offered such as setting up another static route on the client didn't help; possibly because every configuration is a little different, and the users in that thread are using TAP, I'm configured for TUN. I also tried adding 'push "redirect-gateway"' to the client configuration, to no avail. I feel like I was getting closer when I went here: http://serverfault.com/questions/485933/specifying-gateway-for-vpn-connection, after which I configured the TAP adapter's IPv4 settings to set a default gateway matching the endpoint of my VPN tunnel (10.11.0.5). Doing so allows Windows to properly identify the network connection now (it is no longer 'unidentified'), and seems to have also improved speed a bit. But I still cannot access the sites on my server. I suspect one of you wizards may be able to spot the source of the problem easily below. Thank you for taking a look in any case.

Where XXX.X.XX.77 is the public IP of my OpenVPN server as well as the sites I cannot access...

Server conf:

local XXX.X.XX.77
port 1191
proto udp
dev tun
tun-mtu 1500
mssfix 1432
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
server 10.11.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 90
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 3
mute 20

Client conf:

client
dev tun
proto udp
remote XXX.X.XX.77 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
remote-cert-tls server
comp-lzo
verb 3
mute 20

Start OpenVPN on server, including routing commands:

root@XXXXXXX [/]# echo 1 > /proc/sys/net/ipv4/ip_forward
root@XXXXXXX [/]# iptables -t nat -A POSTROUTING -s 10.11.0.0/24 -o eth0 -j MASQUERADE
root@XXXXXXX [/]# openvpn /etc/openvpn/XXXXXXXVPN.conf &
[1] 10784
root@XXXXXXX [/]# Sat Nov  9 08:23:35 2013 OpenVPN 2.2.2 i686-redhat-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] built on Apr  5 2012
Sat Nov  9 08:23:35 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sat Nov  9 08:23:35 2013 Diffie-Hellman initialized with 1024 bit key
Sat Nov  9 08:23:35 2013 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sat Nov  9 08:23:35 2013 Socket Buffers: R=[110592->131072] S=[110592->131072]
Sat Nov  9 08:23:35 2013 ROUTE default_gateway=XXX.X.0.1
Sat Nov  9 08:23:35 2013 TUN/TAP device tun0 opened
Sat Nov  9 08:23:35 2013 TUN/TAP TX queue length set to 100
Sat Nov  9 08:23:35 2013 /sbin/ip link set dev tun0 up mtu 1500
Sat Nov  9 08:23:35 2013 /sbin/ip addr add dev tun0 local 10.11.0.1 peer 10.11.0.2
Sat Nov  9 08:23:35 2013 /sbin/ip route add 10.11.0.0/24 via 10.11.0.2
Sat Nov  9 08:23:35 2013 Data Channel MTU parms [ L:1542 D:1432 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sat Nov  9 08:23:35 2013 GID set to nobody
Sat Nov  9 08:23:35 2013 UID set to nobody
Sat Nov  9 08:23:35 2013 UDPv4 link local (bound): XXX.X.XX.77:1194
Sat Nov  9 08:23:35 2013 UDPv4 link remote: [undef]
Sat Nov  9 08:23:35 2013 MULTI: multi_init called, r=256 v=256
Sat Nov  9 08:23:35 2013 IFCONFIG POOL: base=10.11.0.4 size=62
Sat Nov  9 08:23:35 2013 IFCONFIG POOL LIST
Sat Nov  9 08:23:35 2013 client1,10.11.0.4
Sat Nov  9 08:23:35 2013 Initialization Sequence Completed

Client route table, before connect:

C:\>route print -4
===========================================================================
Interface List
 13...00 ff d6 c5 ee a5 ......TAP-Windows Adapter V9
 12...38 60 77 08 8d 1e ......Realtek PCIe FE Family Controller
 11...e0 ca 94 17 84 9a ......Realtek RTL8188CE Wireless LAN 802.11n PCI-E NIC
  1...........................Software Loopback Interface 1
 15...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
 16...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1     192.168.1.11     30
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      192.168.1.0    255.255.255.0         On-link      192.168.1.11    286
     192.168.1.11  255.255.255.255         On-link      192.168.1.11    286
    192.168.1.255  255.255.255.255         On-link      192.168.1.11    286
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link      192.168.1.11    286
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link      192.168.1.11    286
===========================================================================
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric
          0.0.0.0          0.0.0.0        10.11.0.5      20
===========================================================================

Client route table, post-connect:

C:\>route print -4
===========================================================================
Interface List
 13...00 ff d6 c5 ee a5 ......TAP-Windows Adapter V9
 12...38 60 77 08 8d 1e ......Realtek PCIe FE Family Controller
 11...e0 ca 94 17 84 9a ......Realtek RTL8188CE Wireless LAN 802.11n PCI-E NIC
  1...........................Software Loopback Interface 1
 15...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
 16...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1     192.168.1.11     30
          0.0.0.0          0.0.0.0        10.11.0.5        10.11.0.6     40
          0.0.0.0        128.0.0.0        10.11.0.5        10.11.0.6     30
        10.11.0.1  255.255.255.255        10.11.0.5        10.11.0.6     30
        10.11.0.4  255.255.255.252         On-link         10.11.0.6    286
        10.11.0.6  255.255.255.255         On-link         10.11.0.6    286
        10.11.0.7  255.255.255.255         On-link         10.11.0.6    286
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        128.0.0.0        128.0.0.0        10.11.0.5        10.11.0.6     30
      XXX.X.XX.77  255.255.255.255      192.168.1.1     192.168.1.11     30
      192.168.1.0    255.255.255.0         On-link      192.168.1.11    286
     192.168.1.11  255.255.255.255         On-link      192.168.1.11    286
    192.168.1.255  255.255.255.255         On-link      192.168.1.11    286
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link         10.11.0.6    286
        224.0.0.0        240.0.0.0         On-link      192.168.1.11    286
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link         10.11.0.6    286
  255.255.255.255  255.255.255.255         On-link      192.168.1.11    286
===========================================================================
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric
          0.0.0.0          0.0.0.0        10.11.0.5      10
===========================================================================

By the way, ifconfig on the server tells me the connection is healthy overall, but I am still losing on average of 0.1% of my transmit packets over the VPN. Nowhere else, just TX packets dropped. Don't know if that is related or even significant enough to be a problem:

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.11.0.1  P-t-P:10.11.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:35948 errors:0 dropped:0 overruns:0 frame:0
          TX packets:63530 errors:0 dropped:605 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:7207109 (6.8 MiB)  TX bytes:76328370 (72.7 MiB)

truwebpro

UPDATE:

It's certainly a steep learning curve, but I'm making progress. By using traceroute, I was able to determine that my client is automatically bypassing the VPN whenever I try to access a site on the same public IP as the server. Since I had a firewall rule set up on my web browser specifically to block access if the VPN were disconnected, that is what was preventing the sites from loading. :roll:

However, I still consider this a problem. Even though I can resolve the connection to these sites by bypassing the VPN, I still want them to resolve through the VPN (if possible), and am hoping one of you reading this thread might be able to tell me why that isn't happening. Anyone?

GreenLED

I am having a similar issue. I don't know if it's exactly the same. I successfully setup an OpenVPN server and was able to successfully connect to it using another machine in the same physical location (different public IP, but same Cable modem). I cannot get the client to use the VPN for its Internet traffic. Did you ever resolve this? I tried IE vs Chrome (my normal browser) to check if the configuration of the browser was causing it to bypass, negative. ANy thoughts?

rsenger

I had this problem once years ago, when I was jailed behind a firewall allowing only 80,443 and tried to connect to services (smtp,imap,ssh,ldap) running on the same ip as the openvpn server itself. Those connections bypass the tunnel and are blocked by the firewall.

My solution was to change the DNS resolution for the vpn clients. Assume you have a public ip 100.200.10.20 (e.g. ppp0), and private ip 192.168.0.1 (e.g. eth0), make your services listen on both addresses/interfaces, and set up the DNS pushed to the vpn clients to answer with 192.168.0.1 for name lookups of your domain, rather than 100.200.10.20 like outside DNS servers do. Then you can access all your services through the tunnel. You may also achieve this by setting "mydomain.com 192.168.0.1" in the client's hosts file manually for the time needed.

Robert

GreenLED

I understand most of what you're saying. What do you mean by "make your services listen on both addresses"? Explain that in configuration terms. Thank you for your reply, it feels like a ghost town sometimes around here.