I try to connect to a public vpn provider but it does not work.
my xubuntu :
Distributor ID: Ubuntu
Description: Ubuntu 14.04 LTS
Release: 14.04
Codename: trusty
vpn configuration on the client:
client
dev tun1
proto tcp
remote 93.115.83.250 443
resolv-retry infinite
nobind
persist-key
persist-tun
auth-user-pass
comp-lzo
verb 3
cipher AES-128-CBC
fast-io
pull
route-delay 2
redirect-gateway
root@xubuntu:/etc/openvpn# openvpn --verb 6 --config "filename.ovpn"
Thu May 29 14:02:36 2014 OpenVPN 2.3.2 i686-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Feb 4 2014
Enter Auth Username:<login>
Enter Auth Password:
Thu May 29 14:02:48 2014 WARNING: No server certificate verification method has been enabled. See
http://openvpn.net/howto.html#mitm for more info.
Thu May 29 14:02:48 2014 NOTE: --fast-io is disabled since we are not using UDP
Thu May 29 14:02:48 2014 Socket Buffers: R=[87380->131072] S=[16384->131072]
Thu May 29 14:02:48 2014 Attempting to establish TCP connection with [AF_INET]93.115.83.250:443 [nonblock]
Thu May 29 14:02:49 2014 TCP connection established with [AF_INET]93.115.83.250:443
Thu May 29 14:02:49 2014 TCPv4_CLIENT link local: [undef]
Thu May 29 14:02:49 2014 TCPv4_CLIENT link remote: [AF_INET]93.115.83.250:443
Thu May 29 14:02:50 2014 TLS: Initial packet from [AF_INET]93.115.83.250:443, sid=e5821108 cd4967fc
Thu May 29 14:02:50 2014 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu May 29 14:02:51 2014 VERIFY OK: depth=1, C=MT, ST=MLT, L=Valletta, O=FreeVPN.me, OU=FreeVPN.me, CN=FreeVPN.me CA, name=<>, emailAddress=<>
Thu May 29 14:02:51 2014 VERIFY OK: depth=0, C=MT, ST=MLT, L=Valletta, O=FreeVPN.me, OU=FreeVPN.me, CN=FreeVPN.me, name=<>, emailAddress=<>
Thu May 29 14:02:52 2014 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Thu May 29 14:02:52 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu May 29 14:02:52 2014 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Thu May 29 14:02:52 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu May 29 14:02:52 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Thu May 29 14:02:52 2014 [FreeVPN.me] Peer Connection Initiated with [AF_INET]93.115.83.250:443
Thu May 29 14:02:55 2014 SENT CONTROL [FreeVPN.me]: 'PUSH_REQUEST' (status=1)
Thu May 29 14:02:55 2014 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.13.0.1,topology net30,ping 15,ping-restart 120,ifconfig 10.13.2.206 10.13.2.205'
Thu May 29 14:02:55 2014 OPTIONS IMPORT: timers and/or timeouts modified
Thu May 29 14:02:55 2014 OPTIONS IMPORT: --ifconfig/up options modified
Thu May 29 14:02:55 2014 OPTIONS IMPORT: route options modified
Thu May 29 14:02:55 2014 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu May 29 14:02:55 2014 ROUTE_GATEWAY 192.168.0.22/255.255.255.248 IFACE=eth1 HWADDR=00:08:54:6a:e8:ff
Thu May 29 14:02:55 2014 TUN/TAP device tun1 opened
Thu May 29 14:02:55 2014 TUN/TAP TX queue length set to 100
Thu May 29 14:02:55 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu May 29 14:02:55 2014 /sbin/ip link set dev tun1 up mtu 1500
Thu May 29 14:02:55 2014 /sbin/ip addr add dev tun1 local 10.13.2.206 peer 10.13.2.205
Thu May 29 14:02:57 2014 /sbin/ip route add 93.115.83.250/32 via 192.168.0.22
Thu May 29 14:02:57 2014 /sbin/ip route add 0.0.0.0/1 via 10.13.2.205
Thu May 29 14:02:57 2014 /sbin/ip route add 128.0.0.0/1 via 10.13.2.205
Thu May 29 14:02:57 2014 /sbin/ip route add 10.13.0.1/32 via 10.13.2.205
Thu May 29 14:02:57 2014 Initialization Sequence Completed
My vpn looks to be set up:
tun1 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.13.2.206 P-t-P:10.13.2.205 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:11 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 B) TX bytes:1438 (1.4 KB)
Here is my routing table:
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 10.13.2.205 128.0.0.0 UG 0 0 0 tun1
0.0.0.0 192.168.0.22 0.0.0.0 UG 0 0 0 eth1 (1)
10.13.0.1 10.13.2.205 255.255.255.255 UGH 0 0 0 tun1
10.13.2.205 0.0.0.0 255.255.255.255 UH 0 0 0 tun1
93.115.83.250 192.168.0.22 255.255.255.255 UGH 0 0 0 eth1 (2)
128.0.0.0 10.13.2.205 128.0.0.0 UG 0 0 0 tun1
192.168.0.16 0.0.0.0 255.255.255.248 U 1 0 0 eth1
(1).In the routing table, I still have my last gw
(2). to get to my vpn server real ip, it looks like we route through my last gw
can ping the stack:
root@xubuntu:/etc/openvpn# ping 10.13.2.206
PING 10.13.2.206 (10.13.2.206) 56(84) bytes of data.
64 bytes from 10.13.2.206: icmp_seq=1 ttl=64 time=0.025 ms
64 bytes from 10.13.2.206: icmp_seq=2 ttl=64 time=0.044 ms
^C
but not the end host:
root@xubuntu:/etc/openvpn# ping 10.13.2.205
PING 10.13.2.205 (10.13.2.205) 56(84) bytes of data.
From 10.13.0.1 icmp_seq=1 Destination Host Prohibited
From 10.13.0.1 icmp_seq=2 Destination Host Prohibited
From 10.13.0.1 icmp_seq=3 Destination Host Prohibited
^C
here is what we get in syslog:
May 29 14:02:55 xubuntu NetworkManager[1420]: SCPlugin-Ifupdown: devices added (path: /sys/devices/virtual/net/tun1, iface: tun1)
May 29 14:02:55 xubuntu NetworkManager[1420]: SCPlugin-Ifupdown: device added (path: /sys/devices/virtual/net/tun1, iface: tun1): no ifupdown configuration found.
May 29 14:02:55 xubuntu NetworkManager[1420]: <warn> /sys/devices/virtual/net/tun1: couldn't determine device driver; ignoring...
Apart from that, by default, it's not secured at all as there is no server certificate verification method
and dns leaks (my tunnel lookup with my original dns/212.27.40.240 ). Anyway, I will solve these 2 last issues later.
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes
14:20:16.540711 IP 192.168.0.20.38840 > 93.115.83.250.443: Flags [P.], seq 2421929429:2421929500, ack 4024463070, win 22104, options [nop,nop,TS val 899457 ecr 1715669722], length 71
14:20:16.623987 IP 93.115.83.250.443 > 192.168.0.20.38840: Flags [.], ack 71, win 256, options [nop,nop,TS val 1715673042 ecr 899457], length 0
14:20:18.303180 ARP, Request who-has 192.168.0.20 tell 192.168.0.22, length 48
14:20:18.303219 ARP, Reply 192.168.0.20 is-at 00:08:54:6a:e8:ff, length 28
14:20:26.474043 IP 10.13.2.206.33789 > 81.92.80.55.80: Flags [S], seq 1014263937, win 29200, options [mss 1460,sackOK,TS val 901941 ecr 0,nop,wscale 7], length 0
14:20:26.474119 IP 192.168.0.20.38840 > 93.115.83.250.443: Flags [P.], seq 71:190, ack 1, win 22104, options [nop,nop,TS val 901941 ecr 1715673042], length 119
14:20:26.556591 IP 93.115.83.250.443 > 192.168.0.20.38840: Flags [.], ack 190, win 256, options [nop,nop,TS val 1715682974 ecr 901941], length 0
14:20:26.604379 IP 93.115.83.250.443 > 192.168.0.20.38840: Flags [P.], seq 1:104, ack 190, win 256, options [nop,nop,TS val 1715683022 ecr 901941], length 103
14:20:26.604422 IP 192.168.0.20.38840 > 93.115.83.250.443: Flags [.], ack 104, win 22104, options [nop,nop,TS val 901973 ecr 1715683022], length 0
14:20:26.604554 IP 81.92.80.55.80 > 10.13.2.206.33789: Flags [S.], seq 2985475276, ack 1014263938, win 29200, options [mss 1350,nop,nop,sackOK], length 0
14:20:26.604635 IP 10.13.2.206.33789 > 81.92.80.55.80: Flags [.], ack 1, win 29200, length 0
14:20:26.604706 IP 192.168.0.20.38840 > 93.115.83.250.443: Flags [P.], seq 190:277, ack 104, win 22104, options [nop,nop,TS val 901973 ecr 1715683022], length 87
14:20:26.604884 IP 10.13.2.206.33789 > 81.92.80.55.80: Flags [P.], seq 1:290, ack 1, win 29200, length 289
14:20:26.687864 IP 93.115.83.250.443 > 192.168.0.20.38840: Flags [.], ack 277, win 256, options [nop,nop,TS val 1715683105 ecr 901973], length 0
14:20:26.687916 IP 192.168.0.20.38840 > 93.115.83.250.443: Flags [P.], seq 277:652, ack 104, win 22104, options [nop,nop,TS val 901994 ecr 1715683105], length 375
14:20:26.771157 IP 93.115.83.250.443 > 192.168.0.20.38840: Flags [.], ack 652, win 264, options [nop,nop,TS val 1715683191 ecr 901994], length 0
14:20:26.815984 IP 93.115.83.250.443 > 192.168.0.20.38840: Flags [P.], seq 104:191, ack 652, win 264, options [nop,nop,TS val 1715683236 ecr 901994], length 87
14:20:26.816138 IP 81.92.80.55.80 > 10.13.2.206.33789: Flags [.], ack 290, win 30016, length 0
14:20:26.853386 IP 192.168.0.20.38840 > 93.115.83.250.443: Flags [.], ack 191, win 22104, options [nop,nop,TS val 902036 ecr 1715683236], length 0
14:20:26.933122 IP 93.115.83.250.443 > 192.168.0.20.38840: Flags [P.], seq 191:742, ack 652, win 264, options [nop,nop,TS val 1715683352 ecr 902036], length 551
14:20:26.933182 IP 192.168.0.20.38840 > 93.115.83.250.443: Flags [.], ack 742, win 23552, options [nop,nop,TS val 902055 ecr 1715683352], length 0
14:20:26.933307 IP 81.92.80.55.80 > 10.13.2.206.33789: Flags [P.], seq 1:489, ack 290, win 30016, length 488
14:20:26.933383 IP 10.13.2.206.33789 > 81.92.80.55.80: Flags [.], ack 489, win 30016, length 0
14:20:26.933480 IP 192.168.0.20.38840 > 93.115.83.250.443: Flags [P.], seq 652:739, ack 742, win 23552, options [nop,nop,TS val 902056 ecr 1715683352], length 87
14:20:26.936723 IP 127.0.0.1.44497 > 127.0.1.1.53: 27101+ A?
www.franceinfo.fr. (35)
14:20:26.936903 IP 10.13.2.206.9652 > 212.27.40.240.53: 32112+ A?
www.franceinfo.fr. (35)
Thanx for your help folks!
