OpenVPN clients unable to access the internet

Latrina

Hello people, and thanks to everyone for having put up this amazing community alongside with all the documentations available.

This is my first time setting up an OpenVPN ptp server, therefore I do apologise in advantage for all the newbees questions I might come up with.

A shot brief about my home network before I get any further. The OpenVPN Server is hosted on my OpenWrt router, which at the same time acts like a modem dialling the pppoe on the Vigor 120 modem which is set to work in MPOA (half bridge), and still on the Vigor 120 modem I have set up a DMZ on the OpenWrt router allowing all the data coming IN/OUT.

Vigor 120 modem: 192.168.0.1
OpenWrt router: 192.168.1.1
OpenVPN Server: 192.168.1.1

I can ping/access any OpenVPN clients connected from any clients connected to my local network and I can ping/access any clients connected on my local network from any OpenVPN clients connected. Basically the only problem is that the clients connected to the OpenVPN server for some reason are unable to access to the internet, unable to ping external DNS and IP.
I have spent two long sleepless days trying to figure this out, but in the end I believe this is getting beyond my pay grade.

Here is the server config.

port 1194
proto udp
dev tun
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/HomeVPN.crt
key /etc/openvpn/easy-rsa/keys/HomeVPN.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
ifconfig-pool-persist /tmp/ipp.txt
server 10.8.0.0 255.255.255.0
push "route 192.168.1.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
client-config-dir ccd
client-to-client
keepalive 10 120
persist-key
persist-tun
status /tmp/openvpn-status.log
verb 3

/etc/config/firewall

config zone
	option network 'vpn'
	option name 'vpn'
	option input 'ACCEPT'
	option forward 'REJECT'
	option output 'ACCEPT'

config forwarding
	option dest 'lan'
	option src 'vpn'

config forwarding
	option dest 'vpn'
	option src 'lan'

config forwarding
	option src 'lan'
	option dest 'wan'

/etc/firewall.user

iptables -t nat -A PREROUTING -p udp -i pppoe-wan --dport 1194 -j ACCEPT;

iptables -A INPUT -p udp -i pppoe-wan --dport 1194 -j ACCEPT;

iptables -I INPUT -i tun+ -j ACCEPT;

iptables -I FORWARD -i tun+ -j ACCEPT;

iptables -I OUTPUT -o tun+ -j ACCEPT;

iptables -I FORWARD -o tun+ -j ACCEPT;

# NAT the VPN client traffic to the internet
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o pppoe-wan -j MASQUERADE;

#
iptables -A FORWARD -i tun+ -o pppoe-wan -m state --state RELATED,ESTABLISHED -j ACCEPT;
iptables -A FORWARD -i pppoe-wan -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT;

route /on the server

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         151.6.156.72    0.0.0.0         UG    0      0        0 pppoe-wan
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.8.0.2        *               255.255.255.255 UH    0      0        0 tun0
151.6.156.72    *               255.255.255.255 UH    0      0        0 pppoe-wan
192.168.1.0     *               255.255.255.0   U     0      0        0 br-lan

Some logs when a client connects to the server

Mon Mar 17 03:58:57 2014 OpenVPN 2.3.2 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Mar 13 2014
Mon Mar 17 03:58:57 2014 Diffie-Hellman initialized with 1024 bit key
Mon Mar 17 03:58:57 2014 Socket Buffers: R=[163840->131072] S=[163840->131072]
Mon Mar 17 03:58:57 2014 TUN/TAP device tun0 opened
Mon Mar 17 03:58:57 2014 TUN/TAP TX queue length set to 100
Mon Mar 17 03:58:57 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Mar 17 03:58:57 2014 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Mon Mar 17 03:58:57 2014 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Mon Mar 17 03:58:57 2014 UDPv4 link local (bound): [undef]
Mon Mar 17 03:58:57 2014 UDPv4 link remote: [undef]
Mon Mar 17 03:58:57 2014 MULTI: multi_init called, r=256 v=256
Mon Mar 17 03:58:57 2014 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Mon Mar 17 03:58:57 2014 ifconfig_pool_read(), in='client_Pietro-pkcs,10.8.0.4', TODO: IPv6
Mon Mar 17 03:58:57 2014 succeeded -> ifconfig_pool_set()
Mon Mar 17 03:58:57 2014 IFCONFIG POOL LIST
Mon Mar 17 03:58:57 2014 client_Pietro-pkcs,10.8.0.4
Mon Mar 17 03:58:57 2014 Initialization Sequence Completed
Mon Mar 17 04:00:47 2014 192.168.1.186:55758 TLS: Initial packet from [AF_INET]192.168.1.186:55758, sid=c9673af3 53a8cc0d
Mon Mar 17 04:00:47 2014 192.168.1.186:55758 VERIFY OK: depth=1, C=IT, L=Taranto, O=OpenWrt Home Router, OU=HomeVPN, CN=Homerouter, name=HomeVPN, emailAddress=kernel.panic007@gmail.com
Mon Mar 17 04:00:47 2014 192.168.1.186:55758 VERIFY OK: depth=0, C=IT, L=Taranto, O=OpenWrt Home Router, OU=HomeVPN, CN=client_Pietro-pkcs, name=HomeVPN, emailAddress=kernel.panic007@gmail.com
Mon Mar 17 04:00:47 2014 192.168.1.186:55758 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Mar 17 04:00:47 2014 192.168.1.186:55758 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Mar 17 04:00:47 2014 192.168.1.186:55758 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Mar 17 04:00:47 2014 192.168.1.186:55758 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Mar 17 04:00:47 2014 192.168.1.186:55758 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Mon Mar 17 04:00:47 2014 192.168.1.186:55758 [client_Pietro-pkcs] Peer Connection Initiated with [AF_INET]192.168.1.186:55758
Mon Mar 17 04:00:47 2014 client_Pietro-pkcs/192.168.1.186:55758 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Mon Mar 17 04:00:47 2014 client_Pietro-pkcs/192.168.1.186:55758 MULTI: Learn: 10.8.0.6 -> client_Pietro-pkcs/192.168.1.186:55758
Mon Mar 17 04:00:47 2014 client_Pietro-pkcs/192.168.1.186:55758 MULTI: primary virtual IP for client_Pietro-pkcs/192.168.1.186:55758: 10.8.0.6
Mon Mar 17 04:00:50 2014 client_Pietro-pkcs/192.168.1.186:55758 PUSH: Received control message: 'PUSH_REQUEST'
Mon Mar 17 04:00:50 2014 client_Pietro-pkcs/192.168.1.186:55758 send_push_reply(): safe_cap=940
Mon Mar 17 04:00:50 2014 client_Pietro-pkcs/192.168.1.186:55758 SENT CONTROL [client_Pietro-pkcs]: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)

I do apologise for the extremely long post. I am going to post the client conf alongside with some logs on the following post.

Thanks

Latrina

Client configuration

##############################################
# Sample client-side OpenVPN 2.0 config file #
# for connecting to multi-client server.     #
#                                            #
# This configuration can be used by multiple #
# clients, however each client should have   #
# its own cert and key files.                #
#                                            #
# On Windows, you might want to rename this  #
# file so it has a .ovpn extension           #
##############################################

# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client

# Use the same setting as you are using on
# the server.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
;dev tap
dev tun

# Windows needs the TAP-Windows adapter name
# from the Network Connections panel
# if you have more than one.  On XP SP2,
# you may need to disable the firewall
# for the TAP adapter.
;dev-node MyTap

# Are we connecting to a TCP or
# UDP server?  Use the same setting as
# on the server.
;proto tcp
proto udp

# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote 192.168.1.1 1194
;remote my-server-2 1194

# Choose a random host from the remote
# list for load-balancing.  Otherwise
# try hosts in the order specified.
;remote-random

# Keep trying indefinitely to resolve the
# host name of the OpenVPN server.  Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite

# Most clients don't need to bind to
# a specific local port number.
nobind

# Downgrade privileges after initialization (non-Windows only)
;user nobody
;group nobody

# Try to preserve some state across restarts.
persist-key
persist-tun

# If you are connecting through an
# HTTP proxy to reach the actual OpenVPN
# server, put the proxy server/IP and
# port number here.  See the man page
# if your proxy server requires
# authentication.
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]

# Wireless networks often produce a lot
# of duplicate packets.  Set this flag
# to silence duplicate packet warnings.
;mute-replay-warnings

# SSL/TLS parms.
# See the server config file for more
# description.  It's best to use
# a separate .crt/.key file pair
# for each client.  A single ca
# file can be used for all clients.
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/client_Pietro-pkcs.crt
key /etc/openvpn/easy-rsa/keys/client_Pietro-pkcs.key

# Verify server certificate by checking
# that the certicate has the nsCertType
# field set to "server".  This is an
# important precaution to protect against
# a potential attack discussed here:
#  http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the nsCertType
# field set to "server".  The build-key-server
# script in the easy-rsa folder will do this.
;ns-cert-type server

# If a tls-auth key is used on the server
# then every client must also have the key.
;tls-auth ta.key 1

# Select a cryptographic cipher.
# If the cipher option is used on the server
# then you must also specify it here.
;cipher x

# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
;comp-lzo

# Set log file verbosity.
verb 3

# Silence repeating messages
;mute 20

Here's some log on the client side

root@ubuntubox-VirtualBox:/home/ubuntubox# grep -i vpn /var/log/syslog
Mar 14 17:16:12 ubuntubox-VirtualBox NetworkManager[753]: <info> VPN: loaded org.freedesktop.NetworkManager.pptp
Mar 14 18:28:57 ubuntubox-VirtualBox NetworkManager[756]: <info> VPN: loaded org.freedesktop.NetworkManager.pptp
Mar 16 23:30:54 ubuntubox-VirtualBox ovpn-client[3838]: OpenVPN 2.3.2 i686-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Jul 12 2013
Mar 16 23:30:54 ubuntubox-VirtualBox ovpn-client[3838]: WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Mar 16 23:30:54 ubuntubox-VirtualBox ovpn-client[3838]: Socket Buffers: R=[163840->131072] S=[163840->131072]
Mar 16 23:30:54 ubuntubox-VirtualBox ovpn-client[3839]: UDPv4 link local: [undef]
Mar 16 23:30:54 ubuntubox-VirtualBox ovpn-client[3839]: UDPv4 link remote: [AF_INET]192.168.1.1:1194
Mar 16 23:30:54 ubuntubox-VirtualBox ovpn-client[3839]: TLS: Initial packet from [AF_INET]192.168.1.1:1194, sid=44fbfcb3 bc1b5b68
Mar 16 23:30:54 ubuntubox-VirtualBox ovpn-client[3839]: VERIFY OK: depth=1, C=IT, L=Taranto, O=OpenWrt Home Router, OU=HomeVPN, CN=Homerouter, name=HomeVPN, emailAddress=kernel.panic007@gmail.com
Mar 16 23:30:54 ubuntubox-VirtualBox ovpn-client[3839]: VERIFY OK: depth=0, C=IT, L=Taranto, O=OpenWrt Home Router, OU=HomeVPN, CN=Homerouter, name=HomeVPN, emailAddress=kernel.panic007@gmail.com
Mar 16 23:30:55 ubuntubox-VirtualBox ovpn-client[3839]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mar 16 23:30:55 ubuntubox-VirtualBox ovpn-client[3839]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mar 16 23:30:55 ubuntubox-VirtualBox ovpn-client[3839]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mar 16 23:30:55 ubuntubox-VirtualBox ovpn-client[3839]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mar 16 23:30:55 ubuntubox-VirtualBox ovpn-client[3839]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Mar 16 23:30:55 ubuntubox-VirtualBox ovpn-client[3839]: [Homerouter] Peer Connection Initiated with [AF_INET]192.168.1.1:1194
Mar 16 23:30:57 ubuntubox-VirtualBox ovpn-client[3839]: SENT CONTROL [Homerouter]: 'PUSH_REQUEST' (status=1)
Mar 16 23:30:57 ubuntubox-VirtualBox ovpn-client[3839]: PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Mar 16 23:30:57 ubuntubox-VirtualBox ovpn-client[3839]: OPTIONS IMPORT: timers and/or timeouts modified
Mar 16 23:30:57 ubuntubox-VirtualBox ovpn-client[3839]: OPTIONS IMPORT: --ifconfig/up options modified
Mar 16 23:30:57 ubuntubox-VirtualBox ovpn-client[3839]: OPTIONS IMPORT: route options modified
Mar 16 23:30:57 ubuntubox-VirtualBox ovpn-client[3839]: OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Mar 16 23:30:57 ubuntubox-VirtualBox ovpn-client[3839]: ROUTE_GATEWAY 192.168.1.1/255.255.255.0 IFACE=eth0 HWADDR=08:00:27:67:7e:4e
Mar 16 23:30:57 ubuntubox-VirtualBox ovpn-client[3839]: TUN/TAP device tun0 opened
Mar 16 23:30:57 ubuntubox-VirtualBox ovpn-client[3839]: TUN/TAP TX queue length set to 100
Mar 16 23:30:57 ubuntubox-VirtualBox ovpn-client[3839]: do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mar 16 23:30:57 ubuntubox-VirtualBox ovpn-client[3839]: /sbin/ip link set dev tun0 up mtu 1500
Mar 16 23:30:57 ubuntubox-VirtualBox ovpn-client[3839]: /sbin/ip addr add dev tun0 local 10.8.0.6 peer 10.8.0.5
Mar 16 23:30:57 ubuntubox-VirtualBox ovpn-client[3839]: /sbin/ip route add 192.168.1.1/32 via 192.168.1.1
Mar 16 23:30:57 ubuntubox-VirtualBox ovpn-client[3839]: /sbin/ip route add 0.0.0.0/1 via 10.8.0.5
Mar 16 23:30:57 ubuntubox-VirtualBox ovpn-client[3839]: /sbin/ip route add 128.0.0.0/1 via 10.8.0.5
Mar 16 23:30:57 ubuntubox-VirtualBox ovpn-client[3839]: /sbin/ip route add 192.168.1.0/24 via 10.8.0.5
Mar 16 23:30:57 ubuntubox-VirtualBox ovpn-client[3839]: /sbin/ip route add 10.8.0.0/24 via 10.8.0.5
Mar 16 23:30:57 ubuntubox-VirtualBox ovpn-client[3839]: Initialization Sequence Completed
Mar 17 00:00:42 ubuntubox-VirtualBox ovpn-client[3839]: event_wait : Interrupted system call (code=4)
Mar 17 00:00:42 ubuntubox-VirtualBox ovpn-client[3839]: /sbin/ip route del 10.8.0.0/24
Mar 17 00:00:42 ubuntubox-VirtualBox ovpn-client[3839]: /sbin/ip route del 192.168.1.0/24
Mar 17 00:00:42 ubuntubox-VirtualBox ovpn-client[3839]: /sbin/ip route del 192.168.1.1/32
Mar 17 00:00:42 ubuntubox-VirtualBox ovpn-client[3839]: /sbin/ip route del 0.0.0.0/1
Mar 17 00:00:42 ubuntubox-VirtualBox ovpn-client[3839]: /sbin/ip route del 128.0.0.0/1
Mar 17 00:00:42 ubuntubox-VirtualBox ovpn-client[3839]: Closing TUN/TAP interface
Mar 17 00:00:42 ubuntubox-VirtualBox ovpn-client[3839]: /sbin/ip addr del dev tun0 local 10.8.0.6 peer 10.8.0.5
Mar 17 00:00:42 ubuntubox-VirtualBox ovpn-client[3839]: SIGTERM[hard,] received, process exiting
Mar 17 00:00:47 ubuntubox-VirtualBox ovpn-client[4179]: OpenVPN 2.3.2 i686-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Jul 12 2013
Mar 17 00:00:47 ubuntubox-VirtualBox ovpn-client[4179]: WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Mar 17 00:00:47 ubuntubox-VirtualBox ovpn-client[4179]: Socket Buffers: R=[163840->131072] S=[163840->131072]
Mar 17 00:00:47 ubuntubox-VirtualBox ovpn-client[4180]: UDPv4 link local: [undef]
Mar 17 00:00:47 ubuntubox-VirtualBox ovpn-client[4180]: UDPv4 link remote: [AF_INET]192.168.1.1:1194
Mar 17 00:00:47 ubuntubox-VirtualBox ovpn-client[4180]: TLS: Initial packet from [AF_INET]192.168.1.1:1194, sid=a1c26790 a5f682e2
Mar 17 00:00:48 ubuntubox-VirtualBox ovpn-client[4180]: VERIFY OK: depth=1, C=IT, L=Taranto, O=OpenWrt Home Router, OU=HomeVPN, CN=Homerouter, name=HomeVPN, emailAddress=kernel.panic007@gmail.com
Mar 17 00:00:48 ubuntubox-VirtualBox ovpn-client[4180]: VERIFY OK: depth=0, C=IT, L=Taranto, O=OpenWrt Home Router, OU=HomeVPN, CN=Homerouter, name=HomeVPN, emailAddress=kernel.panic007@gmail.com
Mar 17 00:00:48 ubuntubox-VirtualBox ovpn-client[4180]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mar 17 00:00:48 ubuntubox-VirtualBox ovpn-client[4180]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mar 17 00:00:48 ubuntubox-VirtualBox ovpn-client[4180]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mar 17 00:00:48 ubuntubox-VirtualBox ovpn-client[4180]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mar 17 00:00:48 ubuntubox-VirtualBox ovpn-client[4180]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Mar 17 00:00:48 ubuntubox-VirtualBox ovpn-client[4180]: [Homerouter] Peer Connection Initiated with [AF_INET]192.168.1.1:1194
Mar 17 00:00:50 ubuntubox-VirtualBox ovpn-client[4180]: SENT CONTROL [Homerouter]: 'PUSH_REQUEST' (status=1)
Mar 17 00:00:50 ubuntubox-VirtualBox ovpn-client[4180]: PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Mar 17 00:00:50 ubuntubox-VirtualBox ovpn-client[4180]: OPTIONS IMPORT: timers and/or timeouts modified
Mar 17 00:00:50 ubuntubox-VirtualBox ovpn-client[4180]: OPTIONS IMPORT: --ifconfig/up options modified
Mar 17 00:00:50 ubuntubox-VirtualBox ovpn-client[4180]: OPTIONS IMPORT: route options modified
Mar 17 00:00:50 ubuntubox-VirtualBox ovpn-client[4180]: OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Mar 17 00:00:50 ubuntubox-VirtualBox ovpn-client[4180]: ROUTE_GATEWAY 192.168.1.1/255.255.255.0 IFACE=eth0 HWADDR=08:00:27:67:7e:4e
Mar 17 00:00:50 ubuntubox-VirtualBox ovpn-client[4180]: TUN/TAP device tun0 opened
Mar 17 00:00:50 ubuntubox-VirtualBox ovpn-client[4180]: TUN/TAP TX queue length set to 100
Mar 17 00:00:50 ubuntubox-VirtualBox ovpn-client[4180]: do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mar 17 00:00:50 ubuntubox-VirtualBox ovpn-client[4180]: /sbin/ip link set dev tun0 up mtu 1500
Mar 17 00:00:50 ubuntubox-VirtualBox ovpn-client[4180]: /sbin/ip addr add dev tun0 local 10.8.0.6 peer 10.8.0.5
Mar 17 00:00:50 ubuntubox-VirtualBox ovpn-client[4180]: /sbin/ip route add 192.168.1.1/32 via 192.168.1.1
Mar 17 00:00:50 ubuntubox-VirtualBox ovpn-client[4180]: /sbin/ip route add 0.0.0.0/1 via 10.8.0.5
Mar 17 00:00:50 ubuntubox-VirtualBox ovpn-client[4180]: /sbin/ip route add 128.0.0.0/1 via 10.8.0.5
Mar 17 00:00:50 ubuntubox-VirtualBox ovpn-client[4180]: /sbin/ip route add 192.168.1.0/24 via 10.8.0.5
Mar 17 00:00:50 ubuntubox-VirtualBox ovpn-client[4180]: /sbin/ip route add 10.8.0.0/24 via 10.8.0.5
Mar 17 00:00:50 ubuntubox-VirtualBox ovpn-client[4180]: Initialization Sequence Completed

route

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface

default         10.8.0.5        128.0.0.0       UG    0      0        0 tun0
default         OpenWrt.lan     0.0.0.0         UG    0      0        0 eth0
10.8.0.0        10.8.0.5        255.255.255.0   UG    0      0        0 tun0
10.8.0.5        *               255.255.255.255 UH    0      0        0 tun0
128.0.0.0       10.8.0.5        128.0.0.0       UG    0      0        0 tun0
192.168.1.0     10.8.0.5        255.255.255.0   UG    0      0        0 tun0
192.168.1.0     *               255.255.255.0   U     1      0        0 eth0
OpenWrt.lan     OpenWrt.lan     255.255.255.255 UGH   0      0        0 eth0

netstat -nr

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         10.8.0.5        128.0.0.0       UG        0 0          0 tun0
0.0.0.0         192.168.1.1     0.0.0.0         UG        0 0          0 eth0
10.8.0.0        10.8.0.5        255.255.255.0   UG        0 0          0 tun0
10.8.0.5        0.0.0.0         255.255.255.255 UH        0 0          0 tun0
128.0.0.0       10.8.0.5        128.0.0.0       UG        0 0          0 tun0
192.168.1.0     10.8.0.5        255.255.255.0   UG        0 0          0 tun0
192.168.1.0     0.0.0.0         255.255.255.0   U         0 0          0 eth0
192.168.1.1     192.168.1.1     255.255.255.255 UGH       0 0          0 eth0

Any help will be greatly appreciated.

Thanks

Latrina

While doing some researches, I came up to two possible weird things..

If I try to trace a website from within the OpenVPN client the traceroute will resolve the IP address of the website but wont get any further

traceroute to google.com (173.194.113.225), 30 hops max, 60 byte packets
 1  10.8.0.1 (10.8.0.1)  10.789 ms  11.026 ms  11.722 ms
 2  * * *
 3  * * *
 4  * * *
 5  * * *
 6  *^C

But here it comes the interesting part when trying to resolve my DDNS which is hosted on my OpenWrt router, same router where OpenVPN server is hosted.

traceroute to disposablehome.no-ip.org (151.26.13.15), 30 hops max, 60 byte packets
 1  ppp-15-13.26-151.libero.it (151.26.13.15)  9.643 ms  9.905 ms  9.933 ms

I pretty much get the same situation when pinging a website. The ping resolves the IP of the website than doesn't go any further.

PING www.repubblica.it (213.92.16.171) 56(84) bytes of data.
^C
--- www.repubblica.it ping statistics ---
18 packets transmitted, 0 received, 100% packet loss, time 17052ms

If I ping the DDNS instead ..

PING disposablehome.no-ip.org (151.26.13.15) 56(84) bytes of data.
64 bytes from ppp-15-13.26-151.libero.it (151.26.13.15): icmp_seq=1 ttl=64 time=3.29 ms
64 bytes from ppp-15-13.26-151.libero.it (151.26.13.15): icmp_seq=2 ttl=64 time=5.34 ms
64 bytes from ppp-15-13.26-151.libero.it (151.26.13.15): icmp_seq=3 ttl=64 time=9.74 ms
64 bytes from ppp-15-13.26-151.libero.it (151.26.13.15): icmp_seq=4 ttl=64 time=3.14 ms
64 bytes from ppp-15-13.26-151.libero.it (151.26.13.15): icmp_seq=5 ttl=64 time=5.11 ms
64 bytes from ppp-15-13.26-151.libero.it (151.26.13.15): icmp_seq=6 ttl=64 time=3.38 ms
^C
--- disposablehome.no-ip.org ping statistics ---
6 packets transmitted, 6 received, 0% packet loss, time 5015ms
rtt min/avg/max/mdev = 3.145/5.003/9.741/2.296 ms

Any idea ?

Latrina

I am going to give myself an answer after days of struggle. In the end it turned out that the UCI version of iptables that OpenWrt uses was the main issue causing OpenVPN server not to work properly. In fact I also had trouble setting up my SIP proxy due to UCI iptables and therefore even in that case the solution was to go with plain iptables.

In the end I decided to disable it and use plain iptables rules for everything, and I had to follow this guide which worked wonderfully for me (beside VPN clients unable to reach local network on the server, will need to investigate further) https://community.openvpn.net/openvpn/wiki/BridgingAndRouting#Usingrouting

Hopefully this will help somebody else that is facing the same problem.

Thanks