Hey,
I encountered a very strange problem hoping I can get some advice here.
I have set up OpenVPN server on CentOS and everything is working fine for last 2 months. I made no changes on the server but suddenly I can connect to VPN but I cannot access internet on my PC, strange thing is everything is working fine if I connect from Android device so the server should be fine.
I can ping VPN server's internal IP address but the latency is extremely high, I CANNOT ping google DNS server 8.8.8.8 at all, and i captured network trace I found the issue should be caused by unable to resolve DNS name but I don't understand why.
Client Config:
==========
client
scramble obfuscate xxx
dev tun
proto tcp
remote xxx.cloudapp.net 443
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert undeadclient.crt
key undeadclient.key
ns-cert-type server
tls-auth ta.key 1
script-security 2
cipher AES-128-CBC
comp-lzo
verb 3
Server Config:
==========
port 443
proto tcp
dev tun
scramble obfuscate xxx
ca /etc/openvpn/ca.crt
cert /etc/openvpn/undeadserver.crt
key /etc/openvpn/undeadserver.key
tls-auth /etc/openvpn/ta.key 0
dh /etc/openvpn/dh1024.pem
server 10.8.0.0 255.255.255.0
cipher AES-128-CBC
comp-lzo
persist-key
persist-tun
status openvpntcp.log
verb 3
tun-mtu 1500
tun-mtu-extra 32
duplicate-cn
mssfix 1300
push "redirect-gateway def1"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 8.8.4.4"
keepalive 5 30
tcp-queue-limit 128
txqueuelen 15000
tcp-nodelay
sndbuf 262144
rcvbuf 262144
Log:
===
Wed Jul 09 23:54:30 2014 OpenVPN 2.3.3 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Apr 15 2014
Enter Management Password:
Wed Jul 09 23:54:30 2014 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Wed Jul 09 23:54:30 2014 Need hold release from management interface, waiting...
Wed Jul 09 23:54:30 2014 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Wed Jul 09 23:54:30 2014 MANAGEMENT: CMD 'state on'
Wed Jul 09 23:54:30 2014 MANAGEMENT: CMD 'log all on'
Wed Jul 09 23:54:31 2014 MANAGEMENT: CMD 'hold off'
Wed Jul 09 23:54:31 2014 MANAGEMENT: CMD 'hold release'
Wed Jul 09 23:54:31 2014 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Wed Jul 09 23:54:31 2014 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Jul 09 23:54:31 2014 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Jul 09 23:54:31 2014 Socket Buffers: R=[65536->65536] S=[65536->65536]
Wed Jul 09 23:54:31 2014 MANAGEMENT: >STATE:1404921271,RESOLVE,,,
Wed Jul 09 23:54:31 2014 Attempting to establish TCP connection with [AF_INET]168.63.150.147:443
Wed Jul 09 23:54:31 2014 MANAGEMENT: >STATE:1404921271,TCP_CONNECT,,,
Wed Jul 09 23:54:31 2014 TCP connection established with [AF_INET]168.63.150.147:443
Wed Jul 09 23:54:31 2014 TCPv4_CLIENT link local: [undef]
Wed Jul 09 23:54:31 2014 TCPv4_CLIENT link remote: [AF_INET]168.63.150.147:443
Wed Jul 09 23:54:31 2014 MANAGEMENT: >STATE:1404921271,WAIT,,,
Wed Jul 09 23:54:31 2014 MANAGEMENT: >STATE:1404921271,AUTH,,,
Wed Jul 09 23:54:31 2014 TLS: Initial packet from [AF_INET]168.63.150.147:443, sid=e4def534 3797b232
Wed Jul 09 23:54:32 2014 VERIFY OK: depth=1, C=US, ST=CA, L=SF, O=thor, OU=thor, CN=undeadserver, name=undeadserver, emailAddress=mail@hostm.com
Wed Jul 09 23:54:32 2014 VERIFY OK: nsCertType=SERVER
Wed Jul 09 23:54:32 2014 VERIFY OK: depth=0, C=us, ST=ca, L=sf, O=thor, OU=thor, CN=undeadserver, name=undeadserver, emailAddress=mail@host.domain
Wed Jul 09 23:54:33 2014 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1560', remote='link-mtu 1592'
Wed Jul 09 23:54:33 2014 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1500', remote='tun-mtu 1532'
Wed Jul 09 23:54:33 2014 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Wed Jul 09 23:54:33 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Jul 09 23:54:33 2014 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Wed Jul 09 23:54:33 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Jul 09 23:54:33 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Jul 09 23:54:33 2014 [undeadserver] Peer Connection Initiated with [AF_INET]168.63.150.147:443
Wed Jul 09 23:54:34 2014 MANAGEMENT: >STATE:1404921274,GET_CONFIG,,,
Wed Jul 09 23:54:36 2014 SENT CONTROL [undeadserver]: 'PUSH_REQUEST' (status=1)
Wed Jul 09 23:54:36 2014 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 208.67.222.222,dhcp-option DNS 8.8.4.4,route 10.8.0.1,topology net30,ping 5,ping-restart 30,socket-flags TCP_NODELAY,ifconfig 10.8.0.6 10.8.0.5'
Wed Jul 09 23:54:36 2014 OPTIONS IMPORT: timers and/or timeouts modified
Wed Jul 09 23:54:36 2014 OPTIONS IMPORT: --socket-flags option modified
Wed Jul 09 23:54:36 2014 OPTIONS IMPORT: --ifconfig/up options modified
Wed Jul 09 23:54:36 2014 OPTIONS IMPORT: route options modified
Wed Jul 09 23:54:36 2014 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Jul 09 23:54:36 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Jul 09 23:54:36 2014 MANAGEMENT: >STATE:1404921276,ASSIGN_IP,,10.8.0.6,
Wed Jul 09 23:54:36 2014 open_tun, tt->ipv6=0
Wed Jul 09 23:54:36 2014 TAP-WIN32 device [MyTap] opened: \\.\Global\{01408022-7F52-4A28-9301-36CEDD87E1DD}.tap
Wed Jul 09 23:54:36 2014 TAP-Windows Driver Version 9.9
Wed Jul 09 23:54:36 2014 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {01408022-7F52-4A28-9301-36CEDD87E1DD} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Wed Jul 09 23:54:36 2014 Successful ARP Flush on interface [34] {01408022-7F52-4A28-9301-36CEDD87E1DD}
Wed Jul 09 23:54:41 2014 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Wed Jul 09 23:54:41 2014 C:\WINDOWS\system32\route.exe ADD 168.63.150.147 MASK 255.255.255.255 192.168.1.1
Wed Jul 09 23:54:41 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Wed Jul 09 23:54:41 2014 Route addition via IPAPI succeeded [adaptive]
Wed Jul 09 23:54:41 2014 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5
Wed Jul 09 23:54:41 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Wed Jul 09 23:54:41 2014 Route addition via IPAPI succeeded [adaptive]
Wed Jul 09 23:54:41 2014 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.5
Wed Jul 09 23:54:41 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Wed Jul 09 23:54:41 2014 Route addition via IPAPI succeeded [adaptive]
Wed Jul 09 23:54:41 2014 MANAGEMENT: >STATE:1404921281,ADD_ROUTES,,,
Wed Jul 09 23:54:41 2014 C:\WINDOWS\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Wed Jul 09 23:54:41 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Wed Jul 09 23:54:41 2014 Route addition via IPAPI succeeded [adaptive]
Wed Jul 09 23:54:41 2014 Initialization Sequence Completed
Wed Jul 09 23:54:41 2014 MANAGEMENT: >STATE:1404921281,CONNECTED,SUCCESS,10.8.0.6,168.63.150.147
