[Solved] routing traffic from client to internet through vpn

beethoven

Good morning everybody.
I am pretty new to openvpn world , first activities.
I tried to search in the forum not to make duplciates but probably I do not even yet know the right words to define what I would like to do.
I followed the instruction to set up client and server. Actually it is working and I am able to connect and to reach server's LAN machines, all services from http to ssh.

Now I wanted to be able to route traffic to the internet IP address 62.97.XXX.XXX from my client connected, through the server to the destination.

I tried putting the directive: route 62.97.XXX.XXX 255.255.255.255 in both server and client configuration but it does not work.
If I look into messages log i see:

Nov 20 09:21:32 ----- openvpn[10299]: 62.97.XXX.XXX:1194 [beethoven] Peer Connection Initiated with [AF_INET]62.97.XXX.XXX:1194
Nov 20 09:21:32 ---- openvpn[10299]: beethoven/62.97.XXX.XXX:1194 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Nov 20 09:21:32 ----- openvpn[10299]: beethoven/62.97.XXX.XXX:1194 MULTI: Learn: 10.8.0.6 -> beethoven/62.97.XXX.XXX:1194
Nov 20 09:21:32 giove openvpn[10299]: beethoven/62.97.XXX.XXX:1194 MULTI: primary virtual IP for beethoven/62.97.XXX.XXX:1194: 10.8.0.6
Nov 20 09:21:35 giove openvpn[10299]: beethoven/62.97.XXX.XXX:1194 PUSH: Received control message: 'PUSH_REQUEST'
Nov 20 09:21:35 giove openvpn[10299]: beethoven/62.97.XXX.XXX:1194 send_push_reply(): safe_cap=940
Nov 20 09:21:35 giove openvpn[10299]: beethoven/62.97.XXX.XXX:1194 SENT CONTROL [beethoven]: 'PUSH_REPLY,route 10.8.0.1 255.255.255.255,route 192.168.1.0 255.255.255.0,dhcp-option DOMAIN homenet.lan,dhcp-option DNS 192.168.1.1,dhcp-option WINS 192.168.1.1,ping 10,ping-restart 60,ifconfig 10.8.0.6 10.8.0.5' (status=1)

I do not understdand but sounds like some kind of routing it is doing but the connection to external ip address goes in timeout!
What I did wrong, how can I setup it?
Many thanks for help!

beethoven

many thanks debbie10t.
First I think I mistooke the definition of access server. reading last link it sounds to me that on my fedora distribution, installing and configuring default package and downloading on windows client the client from community downloads, then I have to talk about Openvpn opensource community edition right??

Second step.
read first link, put the line
push "route 62.97.XXX.XXX 255.255.255.255"
removing on client config the route.
putting or not
route 62.97.XXX.XXX 255.255.255.255
instruction on server is not changing anything so that is not the right instruction to tell this traffic go outside.
Result is that client is routing inside openvpn server traffic to that address but still goes in timeout.
Reading second link I have doubts in enabling to route all traffic, but second part maybe is referring to me:
probably my client is routing traffic to server, server then does not know what to do with the traffic coming in from client to external address.

Now next step questions:
1) Should I move the topic on another position of forum not having to deal with AS but with community edition OpenVPN opensource?
2) Should I instruct the server machine to route the traffic to outside by iptables like the instruction for webtraffic like a gateway?

Many thanks for help ... sorry but I think I am missing the last step: going in right direction now?

beethoven

Here we go:
Client config:

port 1194
dev tun
remote xxx.dnsalias.net
tls-client
ca ca.crt
cert beethoven.crt
key beethoven.key
pull
verb3

server config:

port 1194
dev tun
tls-server
ca keys/ca.crt
cert keys/giove.crt
key keys/giove.key
dh keys/dh1024.pem
mode server
ifconfig 10.8.0.1 10.8.0.2
ifconfig-pool 10.8.0.4 10.8.0.255
push "route 10.8.0.1 255.255.255.255"
push "route 192.168.1.0 255.255.255.0"
push "route 62.97.XXX.XXX 255.255.255.255"
push "dhcp-option DOMAIN homenet.lan"
push "dhcp-option DNS 192.168.1.1"
push "dhcp-option WINS 192.168.1.1"
keepalive 10 60
inactive 600
route 10.8.0.0 255.255.255.0
user openvpn
group openvpn
persist-tun
persist-key
verb 3

client log (verb3):

Thu Nov 28 14:37:35 2013 OpenVPN 2.3.2 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug 22 2013
Enter Management Password:
Thu Nov 28 14:37:35 2013 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Thu Nov 28 14:37:35 2013 Need hold release from management interface, waiting...
Thu Nov 28 14:37:35 2013 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Thu Nov 28 14:37:35 2013 MANAGEMENT: CMD 'state on'
Thu Nov 28 14:37:35 2013 MANAGEMENT: CMD 'log all on'
Thu Nov 28 14:37:35 2013 MANAGEMENT: CMD 'hold off'
Thu Nov 28 14:37:35 2013 MANAGEMENT: CMD 'hold release'
Thu Nov 28 14:37:35 2013 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Thu Nov 28 14:37:35 2013 Socket Buffers: R=[8192->8192] S=[8192->8192]
Thu Nov 28 14:37:35 2013 MANAGEMENT: >STATE:1385645855,RESOLVE,,,
Thu Nov 28 14:37:35 2013 UDPv4 link local (bound): [undef]
Thu Nov 28 14:37:35 2013 UDPv4 link remote: [AF_INET]178.19.155.61:1194
Thu Nov 28 14:37:35 2013 MANAGEMENT: >STATE:1385645855,WAIT,,,
Thu Nov 28 14:37:35 2013 MANAGEMENT: >STATE:1385645855,AUTH,,,
Thu Nov 28 14:37:35 2013 TLS: Initial packet from [AF_INET]178.19.155.61:1194, sid=2f00600a e2d35a4d
Thu Nov 28 14:37:35 2013 VERIFY OK: depth=1, C=IT, ST=BS, L=<city>, O=Beethoven, OU=Beethoven, CN=<servername>, name=Beethoven, emailAddress=beethoven@email.it
Thu Nov 28 14:37:35 2013 VERIFY OK: depth=0, C=IT, ST=BS, L=<city>, O=Beethoven, OU=Beethoven, CN=<servername>, name=Beethoven, emailAddress=beethoven@email.it
Thu Nov 28 14:37:36 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Nov 28 14:37:36 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Nov 28 14:37:36 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Nov 28 14:37:36 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Nov 28 14:37:36 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu Nov 28 14:37:36 2013 [<servername>] Peer Connection Initiated with [AF_INET]178.19.155.61:1194
Thu Nov 28 14:37:37 2013 MANAGEMENT: >STATE:1385645857,GET_CONFIG,,,
Thu Nov 28 14:37:38 2013 SENT CONTROL [<servername>]: 'PUSH_REQUEST' (status=1)
Thu Nov 28 14:37:38 2013 PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.1 255.255.255.255,route 192.168.1.0 255.255.255.0,route 62.97.51.236 255.255.255.255,dhcp-option DOMAIN homenet.lan,dhcp-option DNS 192.168.1.1,dhcp-option WINS 192.168.1.1,ping 10,ping-restart 60,ifconfig 10.8.0.6 10.8.0.5'
Thu Nov 28 14:37:38 2013 OPTIONS IMPORT: timers and/or timeouts modified
Thu Nov 28 14:37:38 2013 OPTIONS IMPORT: --ifconfig/up options modified
Thu Nov 28 14:37:38 2013 OPTIONS IMPORT: route options modified
Thu Nov 28 14:37:38 2013 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu Nov 28 14:37:38 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Nov 28 14:37:38 2013 MANAGEMENT: >STATE:1385645858,ASSIGN_IP,,10.8.0.6,
Thu Nov 28 14:37:38 2013 open_tun, tt->ipv6=0
Thu Nov 28 14:37:38 2013 TAP-WIN32 device [Connessione alla rete locale (LAN) 2] opened: \\.\Global\{75DF3326-AC91-4AB8-84C0-C36063328959}.tap
Thu Nov 28 14:37:38 2013 TAP-Windows Driver Version 9.9 
Thu Nov 28 14:37:38 2013 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {75DF3326-AC91-4AB8-84C0-C36063328959} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Thu Nov 28 14:37:38 2013 Successful ARP Flush on interface [17] {75DF3326-AC91-4AB8-84C0-C36063328959}
Thu Nov 28 14:37:43 2013 TEST ROUTES: 3/3 succeeded len=3 ret=1 a=0 u/d=up
Thu Nov 28 14:37:43 2013 MANAGEMENT: >STATE:1385645863,ADD_ROUTES,,,
Thu Nov 28 14:37:43 2013 C:\Windows\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Thu Nov 28 14:37:43 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Nov 28 14:37:43 2013 Route addition via IPAPI succeeded [adaptive]
Thu Nov 28 14:37:43 2013 C:\Windows\system32\route.exe ADD 192.168.1.0 MASK 255.255.255.0 10.8.0.5
Thu Nov 28 14:37:43 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Nov 28 14:37:43 2013 Route addition via IPAPI succeeded [adaptive]
Thu Nov 28 14:37:43 2013 C:\Windows\system32\route.exe ADD 62.97.51.236 MASK 255.255.255.255 10.8.0.5
Thu Nov 28 14:37:43 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Nov 28 14:37:43 2013 Route addition via IPAPI succeeded [adaptive]
Thu Nov 28 14:37:43 2013 Initialization Sequence Completed
Thu Nov 28 14:37:43 2013 MANAGEMENT: >STATE:1385645863,CONNECTED,SUCCESS,10.8.0.6,178.19.155.61

server log (verb3):

Nov 28 14:37:01 giove systemd[1]: Starting OpenVPN Robust And Highly Flexible Tunneling Application On server...
Nov 28 14:37:01 giove openvpn[19834]: OpenVPN 2.3.2 i686-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Sep 12 2013
Nov 28 14:37:01 giove openvpn[19834]: NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Nov 28 14:37:01 giove openvpn[19834]: Diffie-Hellman initialized with 1024 bit key
Nov 28 14:37:01 giove openvpn[19834]: Socket Buffers: R=[163840->131072] S=[163840->131072]
Nov 28 14:37:01 giove openvpn[19834]: ROUTE_GATEWAY 192.168.1.1/255.255.255.0 IFACE=p5p1 HWADDR=08:60:6e:7a:aa:1c
Nov 28 14:37:01 giove NetworkManager[543]: <warn> /sys/devices/virtual/net/tun0: couldn't determine device driver; ignoring...
Nov 28 14:37:01 giove openvpn[19834]: TUN/TAP device tun0 opened
Nov 28 14:37:01 giove openvpn[19834]: TUN/TAP TX queue length set to 100
Nov 28 14:37:01 giove openvpn[19834]: do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Nov 28 14:37:01 giove openvpn[19834]: /usr/sbin/ip link set dev tun0 up mtu 1500
Nov 28 14:37:01 giove openvpn[19834]: /usr/sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
Nov 28 14:37:01 giove openvpn[19834]: /usr/sbin/ip route add 10.8.0.0/24 via 10.8.0.2
Nov 28 14:37:01 giove systemd[1]: Failed to read PID from file /var/run/openvpn/server.pid: Invalid argument
Nov 28 14:37:01 giove openvpn[19840]: GID set to openvpn
Nov 28 14:37:01 giove systemd[1]: Started OpenVPN Robust And Highly Flexible Tunneling Application On server.
Nov 28 14:37:01 giove openvpn[19840]: UID set to openvpn
Nov 28 14:37:01 giove openvpn[19840]: UDPv4 link local (bound): [undef]
Nov 28 14:37:01 giove openvpn[19840]: UDPv4 link remote: [undef]
Nov 28 14:37:01 giove openvpn[19840]: MULTI: multi_init called, r=256 v=256
Nov 28 14:37:01 giove openvpn[19840]: IFCONFIG POOL: base=10.8.0.4 size=63, ipv6=0
Nov 28 14:37:01 giove openvpn[19840]: Initialization Sequence Completed
Nov 28 14:37:17 giove openvpn[19840]: <my ip router>:1194 TLS: Initial packet from [AF_INET]<my ip router>:1194, sid=a68495cd 66048399
Nov 28 14:37:17 giove openvpn[19840]: <my ip router>:1194 VERIFY OK: depth=1, C=IT, ST=BS, L=Orzinuovi, O=Beethoven, OU=Beethoven, CN=beethoven.dnsalias.net, name=Beethoven, emailAddress=beethoven@email.it
Nov 28 14:37:17 giove openvpn[19840]: <my ip router>:1194 VERIFY OK: depth=0, C=IT, ST=BS, L=Orzinuovi, O=Beethoven, OU=Beethoven, CN=beethoven, name=Beethoven, emailAddress=beethoven@email.it
Nov 28 14:37:17 giove openvpn[19840]: <my ip router>:1194 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 28 14:37:17 giove openvpn[19840]: <my ip router>:1194 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 28 14:37:17 giove openvpn[19840]: <my ip router>:1194 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 28 14:37:17 giove openvpn[19840]: <my ip router>:1194 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 28 14:37:17 giove openvpn[19840]: <my ip router>:1194 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Nov 28 14:37:17 giove openvpn[19840]: <my ip router>:1194 [beethoven] Peer Connection Initiated with [AF_INET]<my ip router>:1194
Nov 28 14:37:17 giove openvpn[19840]: beethoven/<my ip router>:1194 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Nov 28 14:37:17 giove openvpn[19840]: beethoven/<my ip router>:1194 MULTI: Learn: 10.8.0.6 -> beethoven/<my ip router>:1194
Nov 28 14:37:17 giove openvpn[19840]: beethoven/<my ip router>:1194 MULTI: primary virtual IP for beethoven/<my ip router>:1194: 10.8.0.6
Nov 28 14:37:20 giove openvpn[19840]: beethoven/<my ip router>:1194 PUSH: Received control message: 'PUSH_REQUEST'
Nov 28 14:37:20 giove openvpn[19840]: beethoven/<my ip router>:1194 send_push_reply(): safe_cap=940
Nov 28 14:37:20 giove openvpn[19840]: beethoven/<my ip router>:1194 SENT CONTROL [beethoven]: 'PUSH_REPLY,route 10.8.0.1 255.255.255.255,route 192.168.1.0 255.255.255.0,route 62.97.XXX.XXX 255.255.255.255,dhcp-option DOMAIN homenet.lan,dhcp-option DNS 192.168.1.1,dhcp-option WINS 192.168.1.1,ping 10,ping-restart 60,ifconfig 10.8.0.6 10.8.0.5' (status=1)

last from windows I tried a tracert 62.97.XXX.XXX and it gives me on first hop 10.8.0.1 then all timeout request, like the traffic get trapped there.

Many thanks for helping me!

beethoven

It was not enabled.
Put the row as you suggested.
now sysctl net.ipv4.ip_forward command shows net.ipv4.ip_forward = 1
and
cat /proc/sys/net/ipv4/ip_forward shows 1
it should mean it is working.

On Fedora 19 it is not possible to disable the firewall, maybe that is blocking outside traffic?
DAMN FIREWALL:
I just enabled on Masquerade tab the option Masquerade Zone

Now it is working smoothly: tried to ping 62.97.XXX.XXX address and works, tried to tracert and shows passing through VPN server address, router, some other hops and then destination, open webpage on 62.97.XXX.XXX and working perfectly!

SOLVED.
Many thanks for your help!