Standard road-warrior setup as I want all traffic to be routed through to the VPS. Linode VPS running Ubuntu 12.04.4 kernel 3.11.0-18-generic.
Symptom: OpenVPN linux client connects just fine but when anything more than ping request goes through the connection dies. The client can no longer ping the server and vice versa. This only happens on the linux client. My OpenVPN windows client is unaffected and works flawlessly. I've played around with OpenVPN for years and have never come across this problem.
Symptoms happens on Vmware guest of Ubuntu 12.04.4 kernel 3.11.0-18-generic and on a standard PC of Ubuntu 14.04 and what ever kernel it uses. Again the windows client is unaffected and works flawlessly.
Example: Lets say I use wget to get a 100MB file, the connection is made, the file starts to download, with in a few seconds the transfer rate starts to drop and soon stops transferring. Ctrl-C and try to ping the OpenVPN server and no reply. Restarting the client OpenVPN will allow the connection to be made again but the same thing happens. Even an apt-get update causes the connection to die.
server.conf
local ***.***.***.***
port 56324
proto tcp
dev tun0
persist-key
persist-tun
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 10.8.0.1"
client-to-client
ca /etc/openvpn/ca.crt
cert /etc/openvpn/shakuras.crt
key /etc/openvpn/shakuras.key
dh /etc/openvpn/dh4096.pem
comp-lzo
user nobody
group nogroup
keepalive 10 120
status openvpn-status.log
log-append /etc/openvpn/shakuras.log
verb 3
client-linux.conf
client
dev tun
proto tcp
remote ***.***.***.*** 56324
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert korhal.crt
key korhal.key
ns-cert-type server
comp-lzo
status openvpn-status.log
log-append /etc/openvpn/korhal.log
verb 3
iptables script <-- feel free to critique as I know this is where I've done something wrong... I think...
#!/bin/sh
# Flushing all rules
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
# Default filter policy
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
iptables -N LOGGING_I
iptables -N LOGGING_F
# LOOPBACK
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# SSH
iptables -A INPUT -p tcp --dport ***** -j ACCEPT
# Ping
iptables -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
# OpenVPN
iptables -A INPUT -p tcp --dport 56324 -j ACCEPT
iptables -A INPUT -i tun+ -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -o tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -j ACCEPT
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
# Logging
iptables -A INPUT -j LOGGING_I
iptables -A FORWARD -j LOGGING_F
iptables -A LOGGING_I -m limit --limit 1/min -j LOG --log-prefix "IN-Dropped: " --log-level 4
iptables -A LOGGING_I -j DROP
iptables -A LOGGING_F -m limit --limit 1/min -j LOG --log-prefix "FWRD-Dropped: " --log-level 4
iptables -A LOGGING_F -j DROP
