[Resolved] Openvpn not working anymore

jargot

Hi,

My VPN has been working perfectly fine for 1 or 2 years but I stopped using it for a while.. And now it doesn't work anymore. I suspect it might be due to an apt-get upgrade I ran server-side, but this is just a wild guess.

What happens: when I connect my client (windows 7), as a service or through the OpenVPN GUI, the connection seems to work (icon turns green, "client is now connected"), but I don't have access to the internet.
I can ping my VPN server IP, but I can't ping google.com.

Here is the log from a single connection on the server side:

Sat Feb 8 01:45:38 2014 MULTI: multi_create_instance called
Sat Feb 8 01:45:38 2014 Re-using SSL/TLS context
Sat Feb 8 01:45:38 2014 LZO compression initialized
Sat Feb 8 01:45:38 2014 Control Channel MTU parms [ L:1560 D:168 EF:68 EB:0 ET:0 EL:0 ]
Sat Feb 8 01:45:38 2014 Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:135 ET:0 EL:0 AF:3/1 ]
Sat Feb 8 01:45:38 2014 Local Options hash (VER=V4): '9915e4a2'
Sat Feb 8 01:45:38 2014 Expected Remote Options hash (VER=V4): '2f2c6498'
Sat Feb 8 01:45:38 2014 TCP connection established with [AF_INET]82.237.***.***:58350
Sat Feb 8 01:45:38 2014 TCPv4_SERVER link local: [undef]
Sat Feb 8 01:45:38 2014 TCPv4_SERVER link remote: [AF_INET]82.237.***.***:58350
Sat Feb 8 01:45:38 2014 82.237.***.***:58350 TLS: Initial packet from [AF_INET]82.237.***.***:58350, sid=344c36b0 f470ded4
Sat Feb 8 01:45:39 2014 82.237.***.***:58350 VERIFY OK: depth=1, /C=FR/ST=95/L=location/O=Kimsufi/OU=Default/CN=Default/name=Default/emailAddress=aze@net.com
Sat Feb 8 01:45:39 2014 82.237.***.***:58350 VERIFY OK: depth=0, /C=FR/ST=95/L=location/O=Kimsufi/OU=Default/CN=computer1/name=computer1/emailAddress=aze@net.com
Sat Feb 8 01:45:40 2014 82.237.***.***:58350 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sat Feb 8 01:45:40 2014 82.237.***.***:58350 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Feb 8 01:45:40 2014 82.237.***.***:58350 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sat Feb 8 01:45:40 2014 82.237.***.***:58350 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Feb 8 01:45:40 2014 82.237.***.***:58350 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sat Feb 8 01:45:40 2014 82.237.***.***:58350 [computer1] Peer Connection Initiated with [AF_INET]82.237.***.***:58350
Sat Feb 8 01:45:40 2014 computer1/82.237.***.***:58350 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=1::1c00:0:c97f:0
Sat Feb 8 01:45:40 2014 computer1/82.237.***.***:58350 MULTI: Learn: 10.8.0.6 -> computer1/82.237.***.***:58350
Sat Feb 8 01:45:40 2014 computer1/82.237.***.***:58350 MULTI: primary virtual IP for computer1/82.237.***.***:58350: 10.8.0.6
Sat Feb 8 01:45:43 2014 computer1/82.237.***.***:58350 PUSH: Received control message: 'PUSH_REQUEST'
Sat Feb 8 01:45:43 2014 computer1/82.237.***.***:58350 send_push_reply(): safe_cap=960
Sat Feb 8 01:45:43 2014 computer1/82.237.***.***:58350 SENT CONTROL [computer1]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Sat Feb 8 01:46:00 2014 computer1/82.237.***.***:58350 Connection reset, restarting [-1]
Sat Feb 8 01:46:00 2014 computer1/82.237.***.***:58350 SIGUSR1[soft,connection-reset] received, client-instance restarting
Sat Feb 8 01:46:00 2014 TCP/UDP: Closing socket

And here is the one on the client side:

Sat Feb 08 02:58:29 2014 OpenVPN 2.1_rc22 i686-pc-mingw32 [SSL] [LZO2] [PKCS11] built on Nov 20 2009
Sat Feb 08 02:58:29 2014 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Sat Feb 08 02:58:29 2014 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sat Feb 08 02:58:29 2014 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Sat Feb 08 02:58:29 2014 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Feb 08 02:58:29 2014 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Feb 08 02:58:29 2014 LZO compression initialized
Sat Feb 08 02:58:29 2014 Control Channel MTU parms [ L:1560 D:168 EF:68 EB:0 ET:0 EL:0 ]
Sat Feb 08 02:58:29 2014 Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:135 ET:0 EL:0 AF:3/1 ]
Sat Feb 08 02:58:29 2014 Local Options hash (VER=V4): '2f2c6498'
Sat Feb 08 02:58:29 2014 Expected Remote Options hash (VER=V4): '9915e4a2'
Sat Feb 08 02:58:29 2014 Attempting to establish TCP connection with 5.135.***.***:31196
Sat Feb 08 02:58:30 2014 TCP connection established with 5.135.***.***:31196
Sat Feb 08 02:58:30 2014 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sat Feb 08 02:58:30 2014 TCPv4_CLIENT link local: [undef]
Sat Feb 08 02:58:30 2014 TCPv4_CLIENT link remote: 5.135.***.***:31196
Sat Feb 08 02:58:30 2014 TLS: Initial packet from 5.135.***.***:31196, sid=32ee92fe a0ac530e
Sat Feb 08 02:58:31 2014 VERIFY OK: depth=1, /C=FR/ST=95/L=location/O=Kimsufi/OU=Default/CN=Default/name=Default/emailAddress=aze@net.com
Sat Feb 08 02:58:31 2014 VERIFY OK: depth=0, /C=FR/ST=95/L=location/O=Kimsufi/OU=Default/CN=Default/name=Default/emailAddress=aze@net.com
Sat Feb 08 02:58:33 2014 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sat Feb 08 02:58:33 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Feb 08 02:58:33 2014 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sat Feb 08 02:58:33 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Feb 08 02:58:33 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sat Feb 08 02:58:33 2014 [Default] Peer Connection Initiated with 5.135.***.***:31196
Sat Feb 08 02:58:35 2014 SENT CONTROL [Default]: 'PUSH_REQUEST' (status=1)
Sat Feb 08 02:58:36 2014 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Sat Feb 08 02:58:36 2014 OPTIONS IMPORT: timers and/or timeouts modified
Sat Feb 08 02:58:36 2014 OPTIONS IMPORT: --ifconfig/up options modified
Sat Feb 08 02:58:36 2014 OPTIONS IMPORT: route options modified
Sat Feb 08 02:58:36 2014 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sat Feb 08 02:58:36 2014 ROUTE default_gateway=192.168.0.1
Sat Feb 08 02:58:36 2014 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{67DEF20D-4DAF-48E1-9EC3-5C0CD71774BD}.tap
Sat Feb 08 02:58:36 2014 TAP-Win32 Driver Version 9.6
Sat Feb 08 02:58:36 2014 TAP-Win32 MTU=1500
Sat Feb 08 02:58:36 2014 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {67DEF20D-4DAF-48E1-9EC3-5C0CD71774BD} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Sat Feb 08 02:58:36 2014 Successful ARP Flush on interface [16] {67DEF20D-4DAF-48E1-9EC3-5C0CD71774BD}
Sat Feb 08 02:58:41 2014 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Sat Feb 08 02:58:41 2014 C:\WINDOWS\system32\route.exe ADD 5.135.***.*** MASK 255.255.255.255 192.168.0.1
Sat Feb 08 02:58:41 2014 Warning: route gateway is ambiguous: 192.168.0.1 (2 matches)
Sat Feb 08 02:58:41 2014 Route addition via IPAPI failed [adaptive]
Sat Feb 08 02:58:41 2014 Route addition fallback to route.exe
Sat Feb 08 02:58:41 2014 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5
Sat Feb 08 02:58:41 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sat Feb 08 02:58:41 2014 Route addition via IPAPI succeeded [adaptive]
Sat Feb 08 02:58:41 2014 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.5
Sat Feb 08 02:58:41 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sat Feb 08 02:58:41 2014 Route addition via IPAPI succeeded [adaptive]
Sat Feb 08 02:58:41 2014 C:\WINDOWS\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Sat Feb 08 02:58:41 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sat Feb 08 02:58:41 2014 Route addition via IPAPI succeeded [adaptive]
Sat Feb 08 02:58:41 2014 Initialization Sequence Completed

Server conf file:

# Serveur TCP/443
mode server
proto tcp
port 31196
dev tun
# Cles et certificats
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
tls-auth ta.key 0
cipher AES-256-CBC
# Reseau
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
# Securite
user nobody
group nogroup
chroot /etc/openvpn/jail
persist-key
persist-tun
comp-lzo
# Log
verb 3
mute 20
status openvpn-status.log
log-append /var/log/openvpn.log

and client:

# Client
client
dev tun
proto tcp-client
remote 5.135.***.*** 31196
resolv-retry infinite
cipher AES-256-CBC
# Cles
ca ca.crt
cert computer1.crt
key computer1.key
tls-auth ta.key 1
# Securite
nobind
persist-key
persist-tun
comp-lzo
verb 3

Thanks for the help 🙂

jargot

Thank you 🙂

Iptables were off, I was able to fix them by re-following some steps from my installation tutorial. It was probably because I had to restart the server and the rules didn't stick. They still probably won't but the fix is easy, so that works for me since I hardly ever restart the server anyway 😉