Hi all,
First of all, sorry if this is not the correct forum to post my question.
I am trying to stablish a VPN connection with OpenVPN but keep having some troubles, I hope you can help me to solve them.
fisrt, the Server is not mine, but managed by a third party. I have the configuration file, that should be employed with openVPN to connect.
I have succesfully connected with a Mac OS X with tunnelbridge and the same config file, so I am pretty sure that it is correct. this is the config file:
#OpenVPN Server conf
tls-client
client
dev tun
proto udp
tun-mtu 1400
remote 193.206.208.169 5000
pkcs12 myCert.p12
cipher AES-256-CBC
comp-lzo
verb 3
ns-cert-type server
the problem is that when I try to connect with Fedora it does not work. I think there is a problem with my DNS.
this is what appears when I run openVPN
[b]sudo openvpn --config config.ovpn [/b]
Fri Nov 29 11:08:41 2013 OpenVPN 2.3.2 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Sep 12 2013
Fri Nov 29 11:08:41 2013 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1400)
Fri Nov 29 11:08:41 2013 Socket Buffers: R=[212992->131072] S=[212992->131072]
Fri Nov 29 11:08:41 2013 UDPv4 link local (bound): [undef]
Fri Nov 29 11:08:41 2013 UDPv4 link remote: [AF_INET]193.206.208.169:5000
Fri Nov 29 11:08:41 2013 TLS: Initial packet from [AF_INET]193.206.208.169:5000, sid=4e2ced3d bf63fa58
Fri Nov 29 11:08:41 2013 VERIFY OK: depth=1, personal_stuff
Fri Nov 29 11:08:41 2013 VERIFY OK: nsCertType=SERVER
Fri Nov 29 11:08:41 2013 VERIFY OK: depth=0, personal_stuff T, CN=193.206.208.169
Fri Nov 29 11:08:42 2013 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Nov 29 11:08:42 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Nov 29 11:08:42 2013 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Nov 29 11:08:42 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Nov 29 11:08:42 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Fri Nov 29 11:08:42 2013 [193.206.208.169] Peer Connection Initiated with [AF_INET]193.206.208.169:5000
Fri Nov 29 11:08:45 2013 SENT CONTROL [193.206.208.169]: 'PUSH_REQUEST' (status=1)
Fri Nov 29 11:08:45 2013 PUSH: Received control message: 'PUSH_REPLY,route 10.88.0.0 255.255.255.0,redirect-gateway def1,dhcp-option DOMAIN correct_domain, dhcp-option DNS 193.206.219.5,dhcp-option DNS 192.84.150.104,dhcp-option NTP 193.206.144.10,route 10.149.107.1,topology net30,ping 10,ping-restart 60,ifconfig 10.149.107.26 10.149.107.25'
Fri Nov 29 11:08:45 2013 OPTIONS IMPORT: timers and/or timeouts modified
Fri Nov 29 11:08:45 2013 OPTIONS IMPORT: --ifconfig/up options modified
Fri Nov 29 11:08:45 2013 OPTIONS IMPORT: route options modified
Fri Nov 29 11:08:45 2013 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Fri Nov 29 11:08:45 2013 ROUTE_GATEWAY 172.17.7.254/255.255.248.0 IFACE=em1 HWADDR=fc:4d:d4:4b:27:62
Fri Nov 29 11:08:45 2013 TUN/TAP device tun0 opened
Fri Nov 29 11:08:45 2013 TUN/TAP TX queue length set to 100
Fri Nov 29 11:08:45 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Nov 29 11:08:45 2013 /usr/sbin/ip link set dev tun0 up mtu 1400
Fri Nov 29 11:08:45 2013 /usr/sbin/ip addr add dev tun0 local 10.149.107.26 peer 10.149.107.25
Fri Nov 29 11:08:45 2013 /usr/sbin/ip route add 193.206.208.169/32 via 172.17.7.254
Fri Nov 29 11:08:45 2013 /usr/sbin/ip route add 0.0.0.0/1 via 10.149.107.25
Fri Nov 29 11:08:45 2013 /usr/sbin/ip route add 128.0.0.0/1 via 10.149.107.25
Fri Nov 29 11:08:45 2013 /usr/sbin/ip route add 10.88.0.0/24 via 10.149.107.25
Fri Nov 29 11:08:45 2013 /usr/sbin/ip route add 10.149.107.1/32 via 10.149.107.25
Fri Nov 29 11:08:45 2013 Initialization Sequence Completed
It looks corret, doesn't it?
My configuration also looks correct (although I'm not 100% sure it is)
before VPN
[b]route -n[/b]
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 172.17.7.254 0.0.0.0 UG 0 0 0 em1
172.17.0.0 0.0.0.0 255.255.248.0 U 1 0 0 em1
and after VPN
[b]route -n[/b]
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 10.149.107.25 128.0.0.0 UG 0 0 0 tun0
0.0.0.0 172.17.7.254 0.0.0.0 UG 0 0 0 em1
10.88.0.0 10.149.107.25 255.255.255.0 UG 0 0 0 tun0
10.149.107.1 10.149.107.25 255.255.255.255 UGH 0 0 0 tun0
10.149.107.25 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
128.0.0.0 10.149.107.25 128.0.0.0 UG 0 0 0 tun0
172.17.0.0 0.0.0.0 255.255.248.0 U 1 0 0 em1
193.206.208.169 172.17.7.254 255.255.255.255 UGH 0 0 0 em1
[b]ifconfig[/b]
em1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 172.17.0.183 netmask 255.255.248.0 broadcast 172.17.7.255
inet6 fe80::fe4d:d4ff:fe4b:2762 prefixlen 64 scopeid 0x20<link>
ether fc:4d:d4:4b:27:62 txqueuelen 1000 (Ethernet)
RX packets 205927 bytes 205196941 (195.6 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 110011 bytes 16510710 (15.7 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
device interrupt 20 memory 0xf7f00000-f7f20000
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 0 (Local Loopback)
RX packets 700 bytes 54372 (53.0 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 700 bytes 54372 (53.0 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1400
inet 10.149.107.26 netmask 255.255.255.255 destination 10.149.107.25
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 100 (UNSPEC)
RX packets 552 bytes 38764 (37.8 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 576 bytes 41140 (40.1 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
the thing is that ping works when pointing to IPs, but not to names. So I guess DNS is broken or missconfigured on some way.
for example:
[b]ping google.es[/b]
PING google.es (130.206.193.59) 56(84) bytes of data.
64 bytes from 130.206.193.59: icmp_seq=1 ttl=59 time=2.62 ms
(opoen VPN connection)
[b]ping 130.206.193.59[/b]
PING 130.206.193.59 (130.206.193.59) 56(84) bytes of data.
64 bytes from 130.206.193.59: icmp_seq=1 ttl=53 time=116 ms
[b]ping google.es[/b]
ping: unknown host google.es
As you can see, the connection is weel stablished and fully functional, but the DNS does not resolve so there is obviously some kind of problem.
Can you give me any hint on the problem or what am I doing wrong?
Thanks for your help,
Manuel
