OpenVPN on CentOS VPS - can't get to internet

danyboy

Hey everyone,
I'm fairly new at this, with very limited unix experience. I've been reading a few tutorials on how to get OpenVPN set up on CentOS on a VPS. I am able to get the server up and running and can connect to the OpenVPN server with a Windows client properly. I am able to ping the server from the client (10.8.0.1 is the server, 10.8.0.2 is the client), but not vice-versa. I am also unable to connect to the internet from the client while connected. I am essentially just trying to get the VPN set up so I can have a U.S. ip address, there are no other devices on the VPN LAN.

Here is my server.conf file:

local 198.23.227.209
proto udp
dev tap
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key  # This file should be kept secret
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
duplicate-cn
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
plugin /usr/lib/openvpn/plugin/lib/openvpn-auth-pam.so /etc/pam.d/login
client-cert-not-required
username-as-common-name
keepalive 10 120
tls-auth ta.key 0 # This file is secret
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log-append         openvpn.log
verb 3
mute 20

Here is the output of ifconfig on my server

tap0      Link encap:Ethernet  HWaddr 02:9C:BA:51:61:73  
          inet addr:10.8.0.1  Bcast:10.8.0.255  Mask:255.255.255.0
          inet6 addr: fe80::9c:baff:fe51:6173/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:704 errors:0 dropped:0 overruns:0 frame:0
          TX packets:12 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:60672 (59.2 KiB)  TX bytes:720 (720.0 b)

venet0    Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:127.0.0.1  P-t-P:127.0.0.1  Bcast:0.0.0.0  Mask:255.255.255.255
          UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1
          RX packets:63796 errors:0 dropped:0 overruns:0 frame:0
          TX packets:46691 errors:0 dropped:1915 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:54772660 (52.2 MiB)  TX bytes:6772422 (6.4 MiB)

venet0:0  Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:198.23.227.209 P-t-P:198.23.227.209  Bcast:198.23.227.209  Mask:255.255.255.255
          UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1

Here is the openvpn.log:

Thu Jan 16 03:19:12 2014 OpenVPN 2.3.2 i686-redhat-linux-gnu [SSL (OpenSSL)] [LZ                                                         O] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Sep 12 2013
Thu Jan 16 03:19:12 2014 WARNING: --ifconfig-pool-persist will not work with --d                                                         uplicate-cn
Thu Jan 16 03:19:12 2014 PLUGIN_INIT: POST /usr/lib/openvpn/plugin/lib/openvpn-a                                                         uth-pam.so '[/usr/lib/openvpn/plugin/lib/openvpn-auth-pam.so] [/etc/pam.d/login]                                                         ' intercepted=PLUGIN_AUTH_USER_PASS_VERIFY
Thu Jan 16 03:19:12 2014 Diffie-Hellman initialized with 1024 bit key
Thu Jan 16 03:19:12 2014 WARNING: POTENTIALLY DANGEROUS OPTION --client-cert-not                                                         -required may accept clients which do not present a certificate
Thu Jan 16 03:19:12 2014 Control Channel Authentication: using 'ta.key' as a Ope                                                         nVPN static key file
Thu Jan 16 03:19:12 2014 Outgoing Control Channel Authentication: Using 160 bit                                                          message hash 'SHA1' for HMAC authentication
Thu Jan 16 03:19:12 2014 Incoming Control Channel Authentication: Using 160 bit                                                          message hash 'SHA1' for HMAC authentication
Thu Jan 16 03:19:12 2014 Socket Buffers: R=[245760->131072] S=[245760->131072]
Thu Jan 16 03:19:12 2014 TUN/TAP device tap0 opened
Thu Jan 16 03:19:12 2014 TUN/TAP TX queue length set to 100
Thu Jan 16 03:19:12 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Jan 16 03:19:12 2014 /sbin/ip link set dev tap0 up mtu 1500
Thu Jan 16 03:19:12 2014 /sbin/ip addr add dev tap0 10.8.0.1/24 broadcast 10.8.0                                                         .255
Thu Jan 16 03:19:12 2014 GID set to nobody
Thu Jan 16 03:19:12 2014 UID set to nobody
Thu Jan 16 03:19:12 2014 UDPv4 link local (bound): [AF_INET]198.23.227.209:1194
Thu Jan 16 03:19:12 2014 UDPv4 link remote: [undef]
Thu Jan 16 03:19:12 2014 MULTI: multi_init called, r=256 v=256
Thu Jan 16 03:19:12 2014 IFCONFIG POOL: base=10.8.0.2 size=253, ipv6=0
Thu Jan 16 03:19:12 2014 IFCONFIG POOL LIST
Thu Jan 16 03:19:12 2014 Initialization Sequence Completed
Thu Jan 16 03:23:37 2014 210.8.93.34:55440 TLS: Initial packet from [AF_INET]210                                                         .8.93.34:55440, sid=abbd3a10 b0da759b
Thu Jan 16 03:23:39 2014 210.8.93.34:55440 PLUGIN_CALL: POST /usr/lib/openvpn/pl                                                         ugin/lib/openvpn-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Thu Jan 16 03:23:39 2014 210.8.93.34:55440 TLS: Username/Password authentication                                                          succeeded for username 'dan' [CN SET]
Thu Jan 16 03:23:39 2014 210.8.93.34:55440 Data Channel Encrypt: Cipher 'BF-CBC'                                                          initialized with 128 bit key
Thu Jan 16 03:23:39 2014 210.8.93.34:55440 Data Channel Encrypt: Using 160 bit m                                                         essage hash 'SHA1' for HMAC authentication
Thu Jan 16 03:23:39 2014 210.8.93.34:55440 Data Channel Decrypt: Cipher 'BF-CBC'                                                          initialized with 128 bit key
Thu Jan 16 03:23:39 2014 210.8.93.34:55440 Data Channel Decrypt: Using 160 bit m                                                         essage hash 'SHA1' for HMAC authentication
Thu Jan 16 03:23:39 2014 210.8.93.34:55440 Control Channel: TLSv1, cipher TLSv1/                                                         SSLv3 DHE-RSA-AES256-SHA
Thu Jan 16 03:23:39 2014 210.8.93.34:55440 [dan] Peer Connection Initiated with                                                          [AF_INET]210.8.93.34:55440
Thu Jan 16 03:23:39 2014 dan/210.8.93.34:55440 MULTI_sva: pool returned IPv4=10.                                                         8.0.2, IPv6=(Not enabled)
Thu Jan 16 03:23:41 2014 dan/210.8.93.34:55440 PUSH: Received control message: '                                                         PUSH_REQUEST'
Thu Jan 16 03:23:41 2014 dan/210.8.93.34:55440 send_push_reply(): safe_cap=940
Thu Jan 16 03:23:41 2014 dan/210.8.93.34:55440 SENT CONTROL [dan]: 'PUSH_REPLY,r                                                         edirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4                                                         ,route-gateway 10.8.0.1,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0                                                         ' (status=1)
Thu Jan 16 03:23:42 2014 dan/210.8.93.34:55440 MULTI: Learn: 00:ff:f9:30:31:ea -                                                         > dan/210.8.93.34:55440

The username I'm connecting with is "dan" from the client.

I suspect there is a problem with my iptables, although I've tried every single combination I've found on forums and guides. I think my client is able to resolve host names while connected (if I try and tracert www.google.com and www.ebay.com, it finds the IP address and performs the first hop to 10.8.0.1)

Please help me out, I feel like I'm so close

Danyboy

maikcat

hello there,

10.8.0.2 is the client

are you sure?
can you verify it using ipconfig on your client? (windows right?)
i think it should be 10.8.0.6...

I am also unable to connect to the internet from the client while connected.

post the output of iptables -L -t nat on your openvpn server
btw your VPS uses openVZ containers or kvm hypervisor?(or similar to kvm)

ps: if you want routing mode better switch to tun...

Michael.

danyboy

Hi Michael,

Thank you for your prompt response.
I've switched to tun instead of tap. Now my client's ip address is 10.8.0.6. Same problem as with tap

Here are my latest iptables according to the command you posted:

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  10.8.0.0/24          anywhere            
SNAT       all  --  10.8.0.0/24          anywhere            to:0.0.0.0 
SNAT       all  --  10.8.0.0/24          anywhere            to:198.23.227.209 
SNAT       all  --  10.8.0.0/24          anywhere            to:198.23.227.209 
MASQUERADE  all  --  anywhere             anywhere            
MASQUERADE  all  --  anywhere             anywhere            
MASQUERADE  all  --  anywhere             anywhere            
SNAT       all  --  anywhere             anywhere            to:198.23.227.209 
MASQUERADE  all  --  anywhere             anywhere            
SNAT       all  --  anywhere             anywhere            to:198.23.227.209 
SNAT       all  --  anywhere             anywhere            to:198.23.227.209 
SNAT       all  --  anywhere             anywhere            to:198.23.227.209 
SNAT       all  --  anywhere             anywhere            to:198.23.227.209 
SNAT       all  --  10.8.0.0/24          anywhere            to:198.23.227.209 
MASQUERADE  all  --  10.8.0.0/24          anywhere            
MASQUERADE  all  --  10.8.0.0/24          anywhere            
MASQUERADE  all  --  10.8.0.0/24          anywhere            
SNAT       all  --  anywhere             anywhere            to:198.23.227.209 
SNAT       all  --  anywhere             anywhere            to:198.23.227.209 
SNAT       all  --  anywhere             anywhere            to:198.23.227.209 
SNAT       all  --  10.8.0.0/24          anywhere            to:198.23.227.209 
MASQUERADE  all  --  10.8.0.0/24          anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

That would have been after running

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o venet0 -j MASQUERADE

Thanks,

Dan

danyboy

Ok, flushed the iptables rules and tried:

iptables -t nat -A POSTROUTING -o venet0 -j SNAT --to 198.23.227.209
iptables -A FORWARD -i venet0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i tun0 -o venet0 -j ACCEPT

That seemed to work 🙂

So sorry for wasting your time. I guess maybe switching to tun did some good - wouldn't have tried it if you hadn't mentioned it, so thanks a million!!