[Closed/Unresolved] dns issue

htca

I tried to search for a solution, which might be obvious, but I am not able to get my OpenVPN connection working the way I would like.

My setup is:
router which acts as DHCP in the range 192.168.1.0 255.255.255
Raspberry Pi (debian) with a fixed ipadres 192.168.1.98
I would like to connect my Ipad, Android phone and a windows 7 laptop to my network and surf abroad like I am at home, so my local IP is transferred.

At this stage I am able to connect all my devices from different networks to my VPN without a problem (explore on ip adres). But surfing external is not possible.
my server.conf

ev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
user nobody
group nogroup
server 10.8.0.0 255.255.255.0
persist-key
persist-tun
status /var/log/openvpn-status.log
verb 3
client-to-client
push "redirect-gateway def1"
#set the dns servers
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
log-append /var/log/openvpn
comp-lzo

my ovpn

dev tun
client
proto udp
remote <ex.ip.adres> 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
comp-lzo
verb 3

output of ifconfig

eth0      Link encap:Ethernet  HWaddr b8:27:eb:54:ca:99
          inet addr:192.168.1.98  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:633038 errors:0 dropped:0 overruns:0 frame:0
          TX packets:246113 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:160146143 (152.7 MiB)  TX bytes:61977612 (59.1 MiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:394 errors:0 dropped:0 overruns:0 frame:0
          TX packets:394 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:30496 (29.7 KiB)  TX bytes:30496 (29.7 KiB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:4123 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2215 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:335455 (327.5 KiB)  TX bytes:377143 (368.3 KiB)

rc.local

iptables -t nat -A INPUT -i eth0 -p udp -m udp --dport 1194 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.1.98

statuslog

OpenVPN CLIENT LIST
Updated,Wed Feb  5 12:35:43 2014
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
client1,<public ip networkadres>:35539,12588,11774,Wed Feb  5 12:35:25 2014
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
10.8.0.6,<public ip networkadres>:35539,Wed Feb  5 12:35:42 2014
GLOBAL STATS
Max bcast/mcast queue length,0
END

logfile (startup openvpn, connect client and disconnect client)

Wed Feb  5 12:38:09 2014 OpenVPN 2.2.1 arm-linux-gnueabihf [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Oct 12 2013
Wed Feb  5 12:38:09 2014 WARNING: --keepalive option is missing from server config
Wed Feb  5 12:38:09 2014 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Wed Feb  5 12:38:09 2014 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Feb  5 12:38:09 2014 Diffie-Hellman initialized with 1024 bit key
Wed Feb  5 12:38:09 2014 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Feb  5 12:38:09 2014 Socket Buffers: R=[163840->131072] S=[163840->131072]
Wed Feb  5 12:38:09 2014 ROUTE default_gateway=192.168.1.1
Wed Feb  5 12:38:09 2014 TUN/TAP device tun0 opened
Wed Feb  5 12:38:09 2014 TUN/TAP TX queue length set to 100
Wed Feb  5 12:38:09 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Feb  5 12:38:09 2014 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Wed Feb  5 12:38:09 2014 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Wed Feb  5 12:38:09 2014 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Feb  5 12:38:09 2014 GID set to nogroup
Wed Feb  5 12:38:09 2014 UID set to nobody
Wed Feb  5 12:38:09 2014 UDPv4 link local (bound): [undef]
Wed Feb  5 12:38:09 2014 UDPv4 link remote: [undef]
Wed Feb  5 12:38:09 2014 MULTI: multi_init called, r=256 v=256
Wed Feb  5 12:38:09 2014 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Wed Feb  5 12:38:09 2014 Initialization Sequence Completed
Wed Feb  5 12:38:12 2014 MULTI: multi_create_instance called
Wed Feb  5 12:38:12 2014 <remote IP adres public network>:36136 Re-using SSL/TLS context
Wed Feb  5 12:38:12 2014 <remote IP adres public network>:36136 LZO compression initialized
Wed Feb  5 12:38:12 2014 <remote IP adres public network>:36136 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Feb  5 12:38:12 2014 <remote IP adres public network>:36136 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Feb  5 12:38:12 2014 <remote IP adres public network>:36136 Local Options hash (VER=V4): '530fdded'
Wed Feb  5 12:38:12 2014 <remote IP adres public network>:36136 Expected Remote Options hash (VER=V4): '41690919'
Wed Feb  5 12:38:12 2014 <remote IP adres public network>:36136 TLS: Initial packet from [AF_INET]<remote IP adres public network>:36136, sid=e8d4ba09 0630d6ce
Wed Feb  5 12:38:12 2014 <remote IP adres public network>:36136 VERIFY OK: depth=1, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/OU=changeme/CN=changeme/name=changeme/emailAddress=mail@host.domain
Wed Feb  5 12:38:12 2014 <remote IP adres public network>:36136 VERIFY OK: depth=0, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/OU=changeme/CN=client1/name=changeme/emailAddress=mail@host.domain
Wed Feb  5 12:38:12 2014 <remote IP adres public network>:36136 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Feb  5 12:38:12 2014 <remote IP adres public network>:36136 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Feb  5 12:38:12 2014 <remote IP adres public network>:36136 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Feb  5 12:38:12 2014 <remote IP adres public network>:36136 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Feb  5 12:38:12 2014 <remote IP adres public network>:36136 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Feb  5 12:38:12 2014 <remote IP adres public network>:36136 [client1] Peer Connection Initiated with [AF_INET]<remote IP adres public network>:36136
Wed Feb  5 12:38:12 2014 client1/<remote IP adres public network>:36136 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=bccd:800:8ced:200:14c2:700:bc64:c001
Wed Feb  5 12:38:12 2014 client1/<remote IP adres public network>:36136 MULTI: Learn: 10.8.0.6 -> client1/<remote IP adres public network>:36136
Wed Feb  5 12:38:12 2014 client1/<public ip adres network>:36136 MULTI: primary virtual IP for client1/<remote IP adres public network>:36136: 10.8.0.6
Wed Feb  5 12:38:13 2014 client1/<public ip adres network>:36136 PUSH: Received control message: 'PUSH_REQUEST'
Wed Feb  5 12:38:13 2014 client1/<public ip adres network>:36136 send_push_reply(): safe_cap=960
Wed Feb  5 12:38:13 2014 client1/<public ip adres network>:36136 SENT CONTROL [client1]: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.0 255.255.255.0,topology net30,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Wed Feb  5 12:38:57 2014 client1/<public ip adres network>:36136 SIGTERM[soft,remote-exit] received, client-instance exiting

Hopefully, somebody can give me hint in the correct direction. I played around with several option for the iptables, but without success. The different masks in the output of ifconfig might be the issue, but I have no clue which I need to change to make it work.

htca

I added to server.conf:

push "route 192.168.1.0 255.255.255.0"

push "route 192.168.0.0 255.255.255.0"

did not help

added to rc.local:
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
which looks like now:

iptables -t nat -A INPUT -i eth0 -p udp -m udp --dport 1194 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.1.98
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

The redirect is already enabled (did not mention it in the first post)
Any clues?

htca

Ping sequence client:

C:\Users\902588>ping 10.8.0.1

Pinging 10.8.0.1 with 32 bytes of data:
Reply from 10.8.0.1: bytes=32 time=205ms TTL=64
Reply from 10.8.0.1: bytes=32 time=149ms TTL=64

Ping statistics for 10.8.0.1:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 149ms, Maximum = 205ms, Average = 177ms
Control-C
^C
C:\Users\902588>ping 192.168.1.98

Pinging 192.168.1.98 with 32 bytes of data:
Reply from 192.168.1.87: Destination host unreachable.
Reply from 192.168.1.98: bytes=32 time=95ms TTL=64
Reply from 192.168.1.98: bytes=32 time=157ms TTL=64
Reply from 192.168.1.98: bytes=32 time=178ms TTL=64

Ping statistics for 192.168.1.98:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 95ms, Maximum = 178ms, Average = 143ms

C:\Users\902588>ping 192.168.1.1

Pinging 192.168.1.1 with 32 bytes of data:
Reply from 192.168.1.1: bytes=32 time=22ms TTL=64
Reply from 192.168.1.1: bytes=32 time=21ms TTL=64
Reply from 192.168.1.1: bytes=32 time=86ms TTL=64

Ping statistics for 192.168.1.1:
    Packets: Sent = 3, Received = 3, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 21ms, Maximum = 86ms, Average = 43ms
Control-C
^C
C:\Users\902588>ping 8.8.8.8

Pinging 8.8.8.8 with 32 bytes of data:
Reply from 8.8.8.8: bytes=32 time=221ms TTL=48
Reply from 8.8.8.8: bytes=32 time=311ms TTL=48
Reply from 8.8.8.8: bytes=32 time=145ms TTL=48

Ping statistics for 8.8.8.8:
    Packets: Sent = 3, Received = 3, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 145ms, Maximum = 311ms, Average = 225ms

-> strange behaviour on pinging 192.168.1.98

route server:

root@raspbianwebserver:/home/pi# route -e
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
default         sitecomwlr4000. 0.0.0.0         UG        0 0          0 eth0
10.8.0.0        10.8.0.2        255.255.255.0   UG        0 0          0 tun0
10.8.0.2        *               255.255.255.255 UH        0 0          0 tun0
192.168.1.0     *               255.255.255.0   U         0 0          0 eth0

route client (wan IP-adres of VPN is replaced by xx.xx.xx.xx):

===========================================================================
Interface List
 28...00 ff ba 7e 2c b6 ......TAP-Win32 Adapter OAS
 14...58 94 6b 38 4a b1 ......Microsoft Virtual WiFi Miniport Adapter
 13...58 94 6b 38 4a b0 ......Intel(R) Centrino(R) Advanced-N 6200 AGN
 12...8c 73 6e 7d d3 90 ......Intel(R) 82577LM Gigabit Network Connection
  1...........................Software Loopback Interface 1
 17...00 00 00 00 00 00 00 e0 iphttpsinterface
 23...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
 25...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
 24...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #6
 27...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #7
 30...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #9
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1     192.168.1.87     25
          0.0.0.0        128.0.0.0         10.8.0.5         10.8.0.6     30
         10.8.0.0    255.255.255.0         10.8.0.5         10.8.0.6     30
         10.8.0.4  255.255.255.252         On-link          10.8.0.6    286
         10.8.0.6  255.255.255.255         On-link          10.8.0.6    286
         10.8.0.7  255.255.255.255         On-link          10.8.0.6    286
   xx.xx.xx.xx  255.255.255.255      192.168.1.1     192.168.1.87     25
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        128.0.0.0        128.0.0.0         10.8.0.5         10.8.0.6     30
      192.168.0.0    255.255.255.0         10.8.0.5         10.8.0.6     30
      192.168.1.0    255.255.255.0         On-link      192.168.1.87    281
     192.168.1.87  255.255.255.255         On-link      192.168.1.87    281
    192.168.1.255  255.255.255.255         On-link      192.168.1.87    281
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link          10.8.0.6    286
        224.0.0.0        240.0.0.0         On-link      192.168.1.87    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link          10.8.0.6    286
  255.255.255.255  255.255.255.255         On-link      192.168.1.87    281
===========================================================================
Persistent Routes:
  None

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
 17   4146 ::/0                     fe80::acc6:cdd3:603b:b9ac
  1    306 ::1/128                  On-link
 17   4146 2002::/16                fe80::acc6:cdd3:603b:b9ac
 17    306 2002:c268:c2c5::/64      fe80::acc6:cdd3:603b:b9ac
 17    306 2002:c268:c2c5:8000::/49 fe80::acc6:cdd3:603b:b9ac
 17    306 2002:c268:c2c5:8000::/64 fe80::acc6:cdd3:603b:b9ac
 17     58 2002:c268:c2c5:8100::/64 On-link
 17    306 2002:c268:c2c5:8100:edad:54a2:9fea:76d8/128
                                    On-link
 17    306 2002:c268:c2c5:8100:f949:5076:5295:2a55/128
                                    On-link
 17    306 2002:c268:c2c6::/64      fe80::acc6:cdd3:603b:b9ac
 28    286 fe80::/64                On-link
 13    281 fe80::/64                On-link
 17    306 fe80::/64                On-link
 28    286 fe80::41ef:ae2a:921:8a2b/128
                                    On-link
 13    281 fe80::5d3e:3c18:f8e0:caf6/128
                                    On-link
 17    306 fe80::f949:5076:5295:2a55/128
                                    On-link
  1    306 ff00::/8                 On-link
 17    306 ff00::/8                 On-link
 28    286 ff00::/8                 On-link
 13    281 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None

htca

Pinging forums.openvpn.net [54.215.179.55] with 32 bytes of data:
Reply from 54.215.179.55: bytes=32 time=262ms TTL=54
Reply from 54.215.179.55: bytes=32 time=248ms TTL=54
Reply from 54.215.179.55: bytes=32 time=242ms TTL=54
Reply from 54.215.179.55: bytes=32 time=269ms TTL=54

Ping statistics for 54.215.179.55:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 242ms, Maximum = 269ms, Average = 255ms

seems ok, surfing ok. I might have something in my setup. For the ping sessions (als in the posts before, I used a different connection than before, the neighbours wifi network). I am actually connected to the VPN right now, writing this post.

However on my mobile phone and Ipad; it is still the same behaviour as mentioned in the first post. it takes ages to resolve and in the end I got a time out in the browser.
It seems that the ISP of the mobile phone and Ipad (2 different isp's) is blocking something. I will try the same thing on my desk at the office using the guest network of us. I will report on it.
Thank you very much so far!

htca

the following sequence works:
laptop connect to VPN via phone as hotspot

The following sequences do connect but can only access the internal IP adresses:
laptop - guest network at the office
phone - via 3G network
phone - via guest-wifi

In all cases I use the same ovpn
in case laptop connects on the guest network; the client ping sequence:

C:\Users\902588>ping 10.8.0.1

Pinging 10.8.0.1 with 32 bytes of data:
Reply from 10.8.0.1: bytes=32 time=796ms TTL=64
Reply from 10.8.0.1: bytes=32 time=121ms TTL=64
Reply from 10.8.0.1: bytes=32 time=32ms TTL=64

Ping statistics for 10.8.0.1:
    Packets: Sent = 3, Received = 3, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 32ms, Maximum = 796ms, Average = 316ms
Control-C
^C
C:\Users\902588>ping 192.168.1.98

Pinging 192.168.1.98 with 32 bytes of data:
Reply from 192.168.1.98: bytes=32 time=41ms TTL=64
Reply from 192.168.1.98: bytes=32 time=34ms TTL=64

Ping statistics for 192.168.1.98:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 34ms, Maximum = 41ms, Average = 37ms
Control-C
^C
C:\Users\902588>ping 192.168.1.1

Pinging 192.168.1.1 with 32 bytes of data:
Reply from 192.168.1.1: bytes=32 time=40ms TTL=63
Reply from 192.168.1.1: bytes=32 time=32ms TTL=63
Reply from 192.168.1.1: bytes=32 time=37ms TTL=63
Reply from 192.168.1.1: bytes=32 time=46ms TTL=63

Ping statistics for 192.168.1.1:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 32ms, Maximum = 46ms, Average = 38ms

C:\Users\902588>
C:\Users\902588>ping 8.8.8.8

Pinging 8.8.8.8 with 32 bytes of data:
Reply from 8.8.8.8: bytes=32 time=38ms TTL=48
Reply from 8.8.8.8: bytes=32 time=39ms TTL=48
Reply from 8.8.8.8: bytes=32 time=40ms TTL=48

Ping statistics for 8.8.8.8:
    Packets: Sent = 3, Received = 3, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 38ms, Maximum = 40ms, Average = 39ms
Control-C
^C
C:\Users\902588>

route:

C:\Users\902588>route print
===========================================================================
Interface List
 28...00 ff ba 7e 2c b6 ......TAP-Win32 Adapter OAS
 14...58 94 6b 38 4a b1 ......Microsoft Virtual WiFi Miniport Adapter
 13...58 94 6b 38 4a b0 ......Intel(R) Centrino(R) Advanced-N 6200 AGN
 12...8c 73 6e 7d d3 90 ......Intel(R) 82577LM Gigabit Network Connection
  1...........................Software Loopback Interface 1
 17...00 00 00 00 00 00 00 e0 iphttpsinterface
 23...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
 25...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
 27...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #7
 29...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #8
 30...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #9
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      10.7.64.251       10.7.64.92     25
          0.0.0.0        128.0.0.0         10.8.0.5         10.8.0.6     30
        10.7.64.0    255.255.252.0         On-link        10.7.64.92    281
       10.7.64.92  255.255.255.255         On-link        10.7.64.92    281
      10.7.67.255  255.255.255.255         On-link        10.7.64.92    281
         10.8.0.0    255.255.255.0         10.8.0.5         10.8.0.6     30
         10.8.0.4  255.255.255.252         On-link          10.8.0.6    286
         10.8.0.6  255.255.255.255         On-link          10.8.0.6    286
         10.8.0.7  255.255.255.255         On-link          10.8.0.6    286
      xx.xx.xx.xx  255.255.255.255      10.7.64.251       10.7.64.92     25
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        128.0.0.0        128.0.0.0         10.8.0.5         10.8.0.6     30
      192.168.0.0    255.255.255.0         10.8.0.5         10.8.0.6     30
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link          10.8.0.6    286
        224.0.0.0        240.0.0.0         On-link        10.7.64.92    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link          10.8.0.6    286
  255.255.255.255  255.255.255.255         On-link        10.7.64.92    281
===========================================================================
Persistent Routes:
  None

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
 17   4146 ::/0                     fe80::acc6:cdd3:603b:b9ac
  1    306 ::1/128                  On-link
 17   4146 2002::/16                fe80::acc6:cdd3:603b:b9ac
 17    306 2002:c268:c2c5::/64      fe80::acc6:cdd3:603b:b9ac
 17    306 2002:c268:c2c5:8000::/49 fe80::acc6:cdd3:603b:b9ac
 17    306 2002:c268:c2c5:8000::/64 fe80::acc6:cdd3:603b:b9ac
 17     58 2002:c268:c2c5:8100::/64 On-link
 17    306 2002:c268:c2c5:8100:bc45:e93f:73c3:2637/128
                                    On-link
 17    306 2002:c268:c2c5:8100:f949:5076:5295:2a55/128
                                    On-link
 17    306 2002:c268:c2c6::/64      fe80::acc6:cdd3:603b:b9ac
 28    286 fe80::/64                On-link
 13    281 fe80::/64                On-link
 17    306 fe80::/64                On-link
 28    286 fe80::41ef:ae2a:921:8a2b/128
                                    On-link
 13    281 fe80::5d3e:3c18:f8e0:caf6/128
                                    On-link
 17    306 fe80::f949:5076:5295:2a55/128
                                    On-link
  1    306 ff00::/8                 On-link
 17    306 ff00::/8                 On-link
 28    286 ff00::/8                 On-link
 13    281 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None

ipconfig


C:\Users\902588>ipconfig

Windows IP Configuration


Ethernet adapter Local Area Connection 2:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::41ef:ae2a:921:8a2b%28
   IPv4 Address. . . . . . . . . . . : 10.8.0.6
   Subnet Mask . . . . . . . . . . . : 255.255.255.252
   Default Gateway . . . . . . . . . :

Wireless LAN adapter Wireless Network Connection 2:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Wireless LAN adapter Wireless Network Connection:

   Connection-specific DNS Suffix  . : corporateroot.net
   Link-local IPv6 Address . . . . . : fe80::5d3e:3c18:f8e0:caf6%13
   IPv4 Address. . . . . . . . . . . : 10.7.64.92
   Subnet Mask . . . . . . . . . . . : 255.255.252.0
   Default Gateway . . . . . . . . . : 10.7.64.251

htca

It is still strange....

I use the same OVPN file;
smartphone using 3G network -> connects to openvpn, but is not able to resolve the host (timeout)
laptop using phone as hotspot which is connected to same 3G network -> connects to vpn and is working as supposed
laptop using wifi network -> connects to openvpn, but is not able to resolve (timeout)

I don't think that is related to the ISP of the phone, otherwise the smartphone using 3g would connect and work correctly the same as laptop-phonehotspot using 3g

Can there be a setting in the OVPN file;

dev tun
client
proto udp
remote 83.128.156.202 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
comp-lzo
verb 3
redirect-gateway

htca

current serverside conf

ev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
user nobody
group nogroup
server 10.8.0.0 255.255.255.0
persist-key
persist-tun
status /var/log/openvpn-status.log
verb 9
client-to-client
push "redirect-gateway def1 bypass-dhcp"
push "route 192.168.0.0 255.255.255.0"
#set the dns servers
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
log-append /var/log/openvpn
comp-lzo

ROUTE on client

===========================================================================
Interface List
 28...00 ff ba 7e 2c b6 ......TAP-Win32 Adapter OAS
 14...58 94 6b 38 4a b1 ......Microsoft Virtual WiFi Miniport Adapter
 13...58 94 6b 38 4a b0 ......Intel(R) Centrino(R) Advanced-N 6200 AGN
 12...8c 73 6e 7d d3 90 ......Intel(R) 82577LM Gigabit Network Connection
  1...........................Software Loopback Interface 1
 17...00 00 00 00 00 00 00 e0 iphttpsinterface
 23...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
 25...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
 24...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #6
 27...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #7
 30...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #9
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0    10.204.21.251     10.204.21.27     20
          0.0.0.0          0.0.0.0    10.204.31.251     10.204.30.85     25
          0.0.0.0        128.0.0.0         10.8.0.5         10.8.0.6     30
         10.8.0.0    255.255.255.0         10.8.0.5         10.8.0.6     30
         10.8.0.4  255.255.255.252         On-link          10.8.0.6    286
         10.8.0.6  255.255.255.255         On-link          10.8.0.6    286
         10.8.0.7  255.255.255.255         On-link          10.8.0.6    286
      10.204.17.5  255.255.255.255    10.204.21.251     10.204.21.27     20
      10.204.21.0    255.255.255.0         On-link      10.204.21.27    276
     10.204.21.27  255.255.255.255         On-link      10.204.21.27    276
    10.204.21.255  255.255.255.255         On-link      10.204.21.27    276
      10.204.30.0    255.255.254.0         On-link      10.204.30.85    281
     10.204.30.85  255.255.255.255         On-link      10.204.30.85    281
    10.204.31.255  255.255.255.255         On-link      10.204.30.85    281
      xx.xx.xx.xx  255.255.255.255    10.204.21.251     10.204.21.27     20
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        128.0.0.0        128.0.0.0         10.8.0.5         10.8.0.6     30
      192.168.0.0    255.255.255.0         10.8.0.5         10.8.0.6     30
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link      10.204.21.27    276
        224.0.0.0        240.0.0.0         On-link          10.8.0.6    286
        224.0.0.0        240.0.0.0         On-link      10.204.30.85    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link      10.204.21.27    276
  255.255.255.255  255.255.255.255         On-link          10.8.0.6    286
  255.255.255.255  255.255.255.255         On-link      10.204.30.85    281
===========================================================================
Persistent Routes:
  None

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
  1    306 ::1/128                  On-link
 12    276 fe80::/64                On-link
 28    286 fe80::/64                On-link
 13    281 fe80::/64                On-link
 28    286 fe80::41ef:ae2a:921:8a2b/128
                                    On-link
 13    281 fe80::5d3e:3c18:f8e0:caf6/128
                                    On-link
 12    276 fe80::d032:6977:276a:db06/128
                                    On-link
  1    306 ff00::/8                 On-link
 12    276 ff00::/8                 On-link
 28    286 ff00::/8                 On-link
 13    281 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None

Ping sequence client

C:\Users\902588>ping 10.8.0.1

Pinging 10.8.0.1 with 32 bytes of data:
Reply from 10.8.0.1: bytes=32 time=24ms TTL=64
Reply from 10.8.0.1: bytes=32 time=374ms TTL=64
Reply from 10.8.0.1: bytes=32 time=21ms TTL=64
Reply from 10.8.0.1: bytes=32 time=21ms TTL=64

Ping statistics for 10.8.0.1:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 21ms, Maximum = 374ms, Average = 110ms

C:\Users\902588>ping 192.168.1.98

Pinging 192.168.1.98 with 32 bytes of data:
Reply from 192.168.1.98: bytes=32 time=29ms TTL=64
Reply from 192.168.1.98: bytes=32 time=93ms TTL=64
Reply from 192.168.1.98: bytes=32 time=68ms TTL=64
Reply from 192.168.1.98: bytes=32 time=21ms TTL=64

Ping statistics for 192.168.1.98:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 21ms, Maximum = 93ms, Average = 52ms

C:\Users\902588>ping 192.168.1.1

Pinging 192.168.1.1 with 32 bytes of data:
Reply from 192.168.1.1: bytes=32 time=22ms TTL=63
Reply from 192.168.1.1: bytes=32 time=22ms TTL=63
Reply from 192.168.1.1: bytes=32 time=24ms TTL=63
Reply from 192.168.1.1: bytes=32 time=22ms TTL=63

Ping statistics for 192.168.1.1:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 22ms, Maximum = 24ms, Average = 22ms

C:\Users\902588>ping 8.8.8.8

Pinging 8.8.8.8 with 32 bytes of data:
Reply from 8.8.8.8: bytes=32 time=28ms TTL=48
Reply from 8.8.8.8: bytes=32 time=27ms TTL=48
Reply from 8.8.8.8: bytes=32 time=28ms TTL=48
Reply from 8.8.8.8: bytes=32 time=27ms TTL=48

Ping statistics for 8.8.8.8:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 27ms, Maximum = 28ms, Average = 27ms

C:\Users\902588>ping www.google.com

Pinging www.google.com [74.125.136.103] with 32 bytes of data:
Reply from 74.125.136.103: bytes=32 time=371ms TTL=48
Reply from 74.125.136.103: bytes=32 time=32ms TTL=48
Reply from 74.125.136.103: bytes=32 time=31ms TTL=48
Reply from 74.125.136.103: bytes=32 time=32ms TTL=48

Ping statistics for 74.125.136.103:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 31ms, Maximum = 371ms, Average = 116ms

C:\Users\902588>ping forums.openvpn.net
Ping request could not find host forums.openvpn.net. Please check the name and t
ry again.

C:\Users\902588>ping www.nu.nl
Ping request could not find host www.nu.nl. Please check the name and try again.

ping sequence server

root@raspbianwebserver:/home/pi# ping www.nu.nl
PING www-nu-nl.gl.sanomaservices.nl (62.69.174.78) 56(84) bytes of data.
64 bytes from 62-69-174-78.ptr.as24646.net (62.69.174.78): icmp_req=1 ttl=249 time=3.59 ms
64 bytes from 62-69-174-78.ptr.as24646.net (62.69.174.78): icmp_req=2 ttl=249 time=3.67 ms
64 bytes from 62-69-174-78.ptr.as24646.net (62.69.174.78): icmp_req=3 ttl=249 time=4.40 ms
64 bytes from 62-69-174-78.ptr.as24646.net (62.69.174.78): icmp_req=4 ttl=249 time=3.74 ms
64 bytes from 62-69-174-78.ptr.as24646.net (62.69.174.78): icmp_req=5 ttl=249 time=3.46 ms
^C
--- www-nu-nl.gl.sanomaservices.nl ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4006ms
rtt min/avg/max/mdev = 3.464/3.776/4.402/0.326 ms
root@raspbianwebserver:/home/pi# ping forums.openvpn.net
PING forums.openvpn.net (54.215.179.55) 56(84) bytes of data.
64 bytes from ec2-54-215-179-55.us-west-1.compute.amazonaws.com (54.215.179.55): icmp_req=1 ttl=55 time=151 ms
64 bytes from ec2-54-215-179-55.us-west-1.compute.amazonaws.com (54.215.179.55): icmp_req=2 ttl=55 time=150 ms
^X64 bytes from ec2-54-215-179-55.us-west-1.compute.amazonaws.com (54.215.179.55): icmp_req=3 ttl=55 time=150 ms
64 bytes from ec2-54-215-179-55.us-west-1.compute.amazonaws.com (54.215.179.55): icmp_req=4 ttl=55 time=150 ms
64 bytes from ec2-54-215-179-55.us-west-1.compute.amazonaws.com (54.215.179.55): icmp_req=5 ttl=55 time=150 ms

I am lost.... I think that pinging on the client to www.google.com reference to a dns entry in the cache.

htca

It did not help;
pinging still ok
dns resolve times out.
I might do something wrong on the iptables:

root@raspbianwebserver:/home/pi# iptables -F
root@raspbianwebserver:/home/pi# iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
root@raspbianwebserver:/home/pi# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

I think I should see something in the IPtable (right?)

htca

Cliënt info

--- 8 feb. 2014 20:14:01

Network interfaces and IPs:

rmnet_usb0 - 10.133.7.165
tun0 - 10.8.0.6
lo - ::1%1
lo - 127.0.0.1

MAC address: 40:F3:08:66:DE:58

Current connection type: mobile
Mobile type: UMTS

DNS #1: 10.8.0.1

Traceroute to 8.8.8.8 gives me a clue. Should I open/forward port 53?

--- 8 feb. 2014 20:16:27
--- IP (rmnet_usb0) 10.133.7.165
--- IP (tun0) 10.8.0.6

Trace to 8.8.8.8

1 - 10.8.0.1
2 - 192.168.1.1
3 - 62.45.112.2
4 - 62.45.30.229
5 - 62.45.254.17
6 - 62.45.254.17
7 - 72.14.219.174
8 - 209.85.254.95
9 - 72.14.238.69
10 - 209.85.255.85
11 - 216.239.49.28
12 - 
failed to connect to /10.8.0.1 (port 53): isConnected failed: ECONNREFUSED (Connection refused)

htca

It's me again (forget the previous post, I messed around with my dns server settings)), I do not whether somebody reads this, but I found out the following. I changed back the dns setting server side: now the traceroute to 8.8.8.8 is going well. Unfortuneatly the redirect is very slow; it will arrive in the end, but it takes ages.... meanwhile the same traceroute on the server is withou problems.
Main findings:
- dns is found but times out
- traceroute is succesfull, but very very very slow

something seams to bounce within the vpn server.
push "redirect-gateway def1 bypass-dhcp"
does not help....

anyone suggestions? I will be happy to supply config files if needed.

htca

Kick topic.
Anyone suggestions?

htca

my problem is solved!

on the server the following command is executed (adding a forward)
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to 192.168.1.98

On rc.local the following commands are added:
iptables -t nat -A INPUT -i eth0 -p udp -m udp --dport 1194 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.1.98

And now it works!!!!!

htca

I still have issues, I give up. I do not understand why a connection on a certain network works correctly and the same device on another network do not work.
Some devices work on a certain network, while others do not. On an other network it can be reverse. There is no clue what so ever.
I have allways an OpenVPN connection; no mater which network I am in and no matter which device I use.
- Internal browsing is always ok
- browsing to external sites through the tunnel, is way to unpredictable

From my opinion I tried every thing, DNS, Iptables, redirection etc.

In my opinion, if a tunnel is established, it should work on any device. It might be that you need a different client configuration or even a different network configuration to connect. But after all the openvpn connection is established, it should simply work, without interference of ISP's. If an ISP block this traffic; a tunnel should not be possible. I do not know whether it is an instability in OpenVPN or whether it is something on the ISP side or even a internal network issue. Feel free to put up any suggestions....

htca

I should put that in rc.local?

htca

put it in the ovpn file on the client... does not work.
M.

htca

yes everything is executable

htca

I started a new topic

https://forums.openvpn.net/topic15042.html