Client can connect, but not access internet

MPQC

So, basically I have an android device running 4.0.4. Using the OpenVPN app, I imported my profile and it connects fine. The server is running on Windows 2008 R2. So here's some configs:

server.opvn

local 74.91.115.98
port 1194
proto udp
dev tun
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\server.crt"
key "C:\\Program Files\\OpenVPN\\config\\server.key"
dh "C:\\Program Files\\OpenVPN\\config\\dh1024.pem"
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

(inappropriately named) mpqc-laptop.opvn

client
dev tun
proto udp
remote 74.91.115.98 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca "ca.crt"
cert "mpqc-laptop.crt"
key "mpqc-laptop.key"
ns-cert-type server
comp-lzo
verb 3

(From the server) ipconfig /all

Windows IP Configuration

   Host Name . . . . . . . . . . . . : mpqc5
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection 3:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : TAP-Windows Adapter V9
   Physical Address. . . . . . . . . : 00-FF-73-D4-E4-BA
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::1996:133c:6ec0:d490%26(Preferred)
   IPv4 Address. . . . . . . . . . . : 10.8.0.1(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.252
   Lease Obtained. . . . . . . . . . : Tuesday, March 04, 2014 9:17:27 PM
   Lease Expires . . . . . . . . . . : Wednesday, March 04, 2015 9:17:27 PM
   Default Gateway . . . . . . . . . :
   DHCP Server . . . . . . . . . . . : 10.8.0.2
   DHCPv6 IAID . . . . . . . . . . . : 436273011
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-18-D8-8D-EA-52-54-00-F3-49-1D

   DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
                                       fec0:0:0:ffff::2%1
                                       fec0:0:0:ffff::3%1
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Xen Network Adapter:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Xen Net Device Driver
   Physical Address. . . . . . . . . : 00-16-3E-A1-6D-56
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::7527:466e:8d8a:5b3a%16(Preferred)
   IPv4 Address. . . . . . . . . . . : 74.91.115.98(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 74.91.115.254
   DHCPv6 IAID . . . . . . . . . . . : 374494208
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-18-D8-8D-EA-52-54-00-F3-49-1D

   DNS Servers . . . . . . . . . . . : 8.8.8.8
                                       8.8.4.4
   NetBIOS over Tcpip. . . . . . . . : Enabled

Note that I did stop copying midway through the output - the rest are VMWare adapters, and ISATAP adapters (if you want me to paste those as well I can).

Server logs (can't really get the client ones easily...)

Tue Mar 04 21:53:10 2014 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Tue Mar 04 21:53:10 2014 Need hold release from management interface, waiting...
Tue Mar 04 21:53:10 2014 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Tue Mar 04 21:53:10 2014 MANAGEMENT: CMD 'state on'
Tue Mar 04 21:53:11 2014 MANAGEMENT: CMD 'log all on'
Tue Mar 04 21:53:11 2014 MANAGEMENT: CMD 'hold off'
Tue Mar 04 21:53:11 2014 MANAGEMENT: CMD 'hold release'
Tue Mar 04 21:53:11 2014 Diffie-Hellman initialized with 1024 bit key
Tue Mar 04 21:53:11 2014 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Mar 04 21:53:11 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Mar 04 21:53:11 2014 MANAGEMENT: >STATE:1393991591,ASSIGN_IP,,10.8.0.1,
Tue Mar 04 21:53:11 2014 open_tun, tt->ipv6=0
Tue Mar 04 21:53:11 2014 TAP-WIN32 device [Local Area Connection 3] opened: \\.\Global\{73D4E4BA-A330-45E9-86B6-ADBFA01B7BE9}.tap
Tue Mar 04 21:53:11 2014 TAP-Windows Driver Version 9.9 
Tue Mar 04 21:53:11 2014 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.1/255.255.255.252 on interface {73D4E4BA-A330-45E9-86B6-ADBFA01B7BE9} [DHCP-serv: 10.8.0.2, lease-time: 31536000]
Tue Mar 04 21:53:11 2014 Sleeping for 10 seconds...
Tue Mar 04 21:53:21 2014 Successful ARP Flush on interface [26] {73D4E4BA-A330-45E9-86B6-ADBFA01B7BE9}
Tue Mar 04 21:53:21 2014 MANAGEMENT: >STATE:1393991601,ADD_ROUTES,,,
Tue Mar 04 21:53:21 2014 C:\Windows\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.2
Tue Mar 04 21:53:21 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue Mar 04 21:53:21 2014 Route addition via IPAPI succeeded [adaptive]
Tue Mar 04 21:53:21 2014 UDPv4 link local (bound): [AF_INET]74.91.115.98:1194
Tue Mar 04 21:53:21 2014 UDPv4 link remote: [undef]
Tue Mar 04 21:53:21 2014 MULTI: multi_init called, r=256 v=256
Tue Mar 04 21:53:21 2014 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Tue Mar 04 21:53:21 2014 ifconfig_pool_read(), in='mpqc-laptop,10.8.0.4', TODO: IPv6
Tue Mar 04 21:53:21 2014 succeeded -> ifconfig_pool_set()
Tue Mar 04 21:53:21 2014 IFCONFIG POOL LIST
Tue Mar 04 21:53:21 2014 mpqc-laptop,10.8.0.4
Tue Mar 04 21:53:21 2014 Initialization Sequence Completed
Tue Mar 04 21:53:21 2014 MANAGEMENT: >STATE:1393991601,CONNECTED,SUCCESS,10.8.0.1,
Tue Mar 04 21:55:51 2014 174.xxx.xxx.xxx:50856 TLS: Initial packet from [AF_INET]174.xxx.xxx.xxx:50856, sid=c07eac42 eec11774
Tue Mar 04 21:55:52 2014 174.xxx.xxx.xxx:50856 VERIFY OK: depth=1, C=US, ST=IL, L=Chicago, O=censored, OU=censored, CN=censored, name=censored, emailAddress=email@here.ca
Tue Mar 04 21:55:52 2014 174.xxx.xxx.xxx:50856 VERIFY OK: depth=0, C=US, ST=IL, L=Chicago, O=censored, OU=censored, CN=censored, name=censored, emailAddress=email@here.ca
Tue Mar 04 21:55:52 2014 174.xxx.xxx.xxx:50856 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Mar 04 21:55:52 2014 174.xxx.xxx.xxx:50856 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 04 21:55:52 2014 174.xxx.xxx.xxx:50856 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Mar 04 21:55:52 2014 174.xxx.xxx.xxx:50856 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 04 21:55:52 2014 174.xxx.xxx.xxx:50856 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Mar 04 21:55:52 2014 174.xxx.xxx.xxx:50856 [mpqc-laptop] Peer Connection Initiated with [AF_INET]174.xxx.xxx.xxx:50856
Tue Mar 04 21:55:52 2014 mpqc-laptop/174.xxx.xxx.xxx:50856 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Tue Mar 04 21:55:52 2014 mpqc-laptop/174.xxx.xxx.xxx:50856 MULTI: Learn: 10.8.0.6 -> mpqc-laptop/174.xxx.xxx.xxx:50856
Tue Mar 04 21:55:52 2014 mpqc-laptop/174.xxx.xxx.xxx:50856 MULTI: primary virtual IP for mpqc-laptop/174.xxx.xxx.xxx:50856: 10.8.0.6
Tue Mar 04 21:55:53 2014 mpqc-laptop/174.xxx.xxx.xxx:50856 PUSH: Received control message: 'PUSH_REQUEST'
Tue Mar 04 21:55:53 2014 mpqc-laptop/174.xxx.xxx.xxx:50856 send_push_reply(): safe_cap=940
Tue Mar 04 21:55:53 2014 mpqc-laptop/174.xxx.xxx.xxx:50856 SENT CONTROL [mpqc-laptop]: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 8.8.8.8,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)

I censored a few things in there. The device connecting to the VPN is 174.xxx.xxx.xxx.

So currently, I run the server, my android device connects fine, but no internet right now. I've been messing around with the settings, and can get it to connect to the internet, but it will be using my local IP, and not the VPN's. So I figure somethings setup wrong with the server config, but it's not directly obvious to me.

maikcat

did you configured your openvpn server to perform NAT on packets
coming from vpn tunnel?

Michael.

MPQC

I haven't. Are you referring to

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

that command from the HOWTO? I didn't run it since I'm on Windows and not sure how to do that. I googled it and see a somewhat equivalent with the netsh firewall commands. Do you know of a guide that I could follow (or know how to do it yourself)?

maikcat

yes i am refering to this command...

unfortunately win2008 is not my strong point...

i am aware though that in win 2003 RAS can achieve what you want..

Michael.

MPQC

Ah. I googled for that and came across this page (for Windows Server 2008):

http://technet.microsoft.com/en-us/library/cc770798%28v=ws.10%29.aspx

Seems to be what I want. If it's anything like the 2003 version (found a guide here), then I think I might be able to set it up. Can't do it right now however, will try to do it tonight.

(If someone in the know could say if I'm on the right track that'd be awesome)

MPQC

I setup the NAT, worked instantly. Your answer was spot on.

Thanks.

maikcat

Glad i ve helped you out 🙂

Regards,

Michael.