Hello, I think I posted this in the wrong category, Yep, I know there are quite a few of these threads. I've read just about all of them. Ok, so this is my situation: [list][*]I can connect to the OpenVPN server [*]I [b]can[/b] ping the OpenVPN server [*]I [b]cannot[/b] ping 8.8.8.8 [*]I have [b]enabled[/b] port forwarding[/list] First my configs: server.conf: [code] port 1194 proto udp dev tun ca /etc/openvpn/ca.crt cert /etc/openvpn/server.crt key /etc/openvpn/server.key # This file should be kept secret dh /etc/openvpn/dh2048.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "route 10.66.0.0 255.255.255.0" push "redirect-gateway def1 bypass-dhcp" keepalive 10 120 comp-lzo persist-key persist-tun status openvpn-status.log verb 3 [/code] Client.conf: [code] client dev tun proto udp remote vpn.digigalaxy.co.uk 1194 resolv-retry infinite nobind persist-key persist-tun ca /etc/openvpn/ca.crt cert /etc/openvpn/client.crt key /etc/openvpn/client.key ns-cert-type server comp-lzo verb 3 [/code] /sbin/iptables -L: [code] Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere Chain FORWARD (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT all -- 10.8.0.0/24 anywhere REJECT all -- anywhere anywhere reject-with icmp-port-unreachable Chain OUTPUT (policy ACCEPT) target prot opt source destination [/code] iptables -L -t nat -v: [code] Chain PREROUTING (policy ACCEPT 86 packets, 4844 bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 70 packets, 4271 bytes) pkts bytes target prot opt in out source destination 0 0 MASQUERADE all -- any eth0 10.8.0.0/24 anywhere 0 0 SNAT all -- any any 192.168.88.0/24 anywhere to:192.3.54.239 Chain OUTPUT (policy ACCEPT 16 packets, 1018 bytes) pkts bytes target prot opt in out source destination [/code] Any ideas on if I'm doing something wrong, and if so, how to fix it?

[quote="debbie10t"]Have you read this ? [b][url=http://openvpn.net/index.php/open-source/documentation/howto.html#redirect]HOWTO: Routing all client traffic (including web-traffic) through the VPN[/url][/b] You need to enable NAT on the server like so:[code]iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE[/code][/quote] I already have...doesn't my "iptables -L -t nat -v" output show that already? I'll post the output of that again anyways... [code] Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 MASQUERADE all -- any eth0 10.8.0.0/24 anywhere Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination [/code] Also, I have read the link you posted.

Argh, I thought I had clicked submit this morning, turned out I hadn't! [quote="debbie10t"]Have you [b]enabled IP Forwarding [/b]?[/quote] Sorry about that, I did actually mean that in the first place :roll:

[quote="debbie10t"][quote="Moony22"]I did actually mean [i]that[/i] in the first place[/quote]"[i]that[/i]" .. is not an operational parameter ?[/quote] Oh, I see where you're coming from. I guess I made another mistake...>.> I'm tired :P [b][i][u]Yes, I have enabled IP forwarding.[/u][/i][/b]

Can connect to VPN, but not to internet

Moony22

Hello,

I think I posted this in the wrong category,

Yep, I know there are quite a few of these threads. I've read just about all of them.

Ok, so this is my situation:

I can connect to the OpenVPN server
I can ping the OpenVPN server
I cannot ping 8.8.8.8
I have enabled port forwarding

First my configs:
server.conf:

port 1194
proto udp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key  # This file should be kept secret
dh /etc/openvpn/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.66.0.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

Client.conf:

client
dev tun
proto udp
remote vpn.digigalaxy.co.uk 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/client.crt
key /etc/openvpn/client.key
ns-cert-type server
comp-lzo
verb 3

/sbin/iptables -L:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     all  --  10.8.0.0/24          anywhere            
REJECT     all  --  anywhere             anywhere             reject-with icmp-port-unreachable

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

iptables -L -t nat -v:

Chain PREROUTING (policy ACCEPT 86 packets, 4844 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 70 packets, 4271 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MASQUERADE  all  --  any    eth0    10.8.0.0/24          anywhere            
    0     0 SNAT       all  --  any    any     192.168.88.0/24      anywhere             to:192.3.54.239

Chain OUTPUT (policy ACCEPT 16 packets, 1018 bytes)
 pkts bytes target     prot opt in     out     source               destination

Any ideas on if I'm doing something wrong, and if so, how to fix it?

Moony22

debbie10t wroteHave you read this ?
HOWTO: Routing all client traffic (including web-traffic) through the VPN

You need to enable NAT on the server like so:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

I already have...doesn't my "iptables -L -t nat -v" output show that already? I'll post the output of that again anyways...

Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MASQUERADE  all  --  any    eth0    10.8.0.0/24          anywhere            

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Also, I have read the link you posted.

Moony22

Argh, I thought I had clicked submit this morning, turned out I hadn't!

debbie10t wroteHave you enabled IP Forwarding ?

Sorry about that, I did actually mean that in the first place :roll:

Moony22

debbie10t wrote
Moony22 wroteI did actually mean that in the first place
"that" .. is not an operational parameter ?

Oh, I see where you're coming from. I guess I made another mistake...>.> I'm tired 😛

Yes, I have enabled IP forwarding.