Hello. I have some trouble with routing traffic trough the VPN connection.
The connection is successfully created but the routing only works sometimes. I uses the same configuration as earlier just this time with tun device instead of tap. And the earlier configuration, with the tap devices has worked perfectly for about a year. But we are going to use OpenVPN on android also, so we need to use tun devices from now.
Server Configuration
mode server
tls-server
port 1194
proto tcp-server
dev tun
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/xxxxxxxx.crt
key /etc/openvpn/certs/xxxxxxxxt.key
dh /etc/openvpn/certs/dh2048.pem
tls-auth /etc/openvpn/certs/ta.key 0
server 10.8.0.224 255.255.255.224
push "redirect-gateway"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
push "route 10.8.0.224 255.255.255.224"
keepalive 60 120
auth SHA512
cipher AES-256-CBC
client-to-client
max-clients 16
user nobody
group nogroup
ifconfig-pool-persist ipp.txt
persist-key
persist-tun
log openvpn.log
status openvpn_status.log
verb 5
mute 20
Client Configuration
client
tls-client
remote vpn.example.com 1194
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/yyyyyyyy.crt
key /etc/openvpn/certs/yyyyyyyy.key
tls-auth /etc/openvpn/certs/ta.key 1
cipher AES-256-CBC
dev tun
proto tcp-client
nobind
resolv-retry infinite
auth SHA512
auth-nocache
persist-key
persist-tun
user nobody
group nogroup
verb 5
log openvpn.log
Ifconfig - Client
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.230 P-t-P:10.8.0.229 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:52864 errors:0 dropped:0 overruns:0 frame:0
TX packets:49826 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:35026475 (33.4 MiB) TX bytes:9378702 (8.9 MiB)
Routing Table - Client
Destination Gateway Genmask Flags Metric Ref Use Iface
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 10.8.0.229 0.0.0.0 UG 0 0 0 tun0
10.8.0.224 10.8.0.229 255.255.255.224 UG 0 0 0 tun0
10.8.0.229 * 255.255.255.255 UH 0 0 0 tun0
example.com. xxx.xxx.xxx.254 255.255.255.255 UGH 0 0 0 eth0
xxx.xxx.xxx.0 * 255.255.255.0 U 0 0 0 eth0
- example.com = My ISP domain
- xxx.xxx.xxx.254 = address of my gateway
- xxx.xxx.xxx.0 = Address of my network ( subnet /24 )
My OpenVPN server is on 10.8.0.225 but default route is to 10.8.0.229? And netmask on the client is 255.255.255.255?
This works
only sometimes when my firewall is set to allow everything, but when I turn on my firewall on the client the network traffic stops, but I'm still able to connect to the openvpn server.
IP Table Script - Client
#!/bin/sh
IPT=/sbin/iptables
IP_LOCAL=10.8.0.224/27
$IPT -P FORWARD DROP
$IPT -P INPUT DROP
$IPT -P OUTPUT DROP
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT
$IPT -A INPUT -p tcp -i eth0 --sport 53 -s 8.8.8.8 -m state --state ESTABLISHED -j ACCEPT
$IPT -A INPUT -p tcp -i eth0 --sport 53 -s 8.8.4.4 -m state --state ESTABLISHED -j ACCEPT
$IPT -A INPUT -p udp -i eth0 --sport 53 -s 8.8.8.8 -m state --state ESTABLISHED -j ACCEPT
$IPT -A INPUT -p udp -i eth0 --sport 53 -s 8.8.4.4 -m state --state ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p tcp -o eth0 --dport 53 -d 8.8.8.8 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p tcp -o eth0 --dport 53 -d 8.8.4.4 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p udp -o eth0 --dport 53 -d 8.8.8.8 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p udp -o eth0 --dport 53 -d 8.8.4.4 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPT -A INPUT -p udp -i eth0 --dport 67:68 --sport 67:68 -m state --state ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p udp -o eth0 --dport 67:68 --sport 67:68 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPT -A INPUT -p tcp -m tcp -i eth0 --sport 1194 -s xxx.xxx.xxx.xxx-m state --state ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p tcp -m tcp -o eth0 --dport 1194 -d xxx.xxx.xxx.xxx -m state --state NEW,ESTABLISHED -j ACCEPT
$IPT -A INPUT -p icmp --icmp-type echo-reply -m state --state ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p icmp --icmp-type echo-request -m state --state NEW,ESTABLISHED -j ACCEPT
$IPT -A INPUT -p tcp -i tun0 --sport 53 -s 8.8.8.8 -m state --state ESTABLISHED -j ACCEPT
$IPT -A INPUT -p tcp -i tun0 --sport 53 -s 8.8.4.4 -m state --state ESTABLISHED -j ACCEPT
$IPT -A INPUT -p udp -i tun0 --sport 53 -s 8.8.8.8 -m state --state ESTABLISHED -j ACCEPT
$IPT -A INPUT -p udp -i tun0 --sport 53 -s 8.8.4.4 -m state --state ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p tcp -o tun0 --dport 53 -d 8.8.8.8 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p tcp -o tun0 --dport 53 -d 8.8.4.4 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p udp -o tun0 --dport 53 -d 8.8.8.8 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p udp -o tun0 --dport 53 -d 8.8.4.4 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPT -A INPUT -p udp -i tun0 --dport 67:68 --sport 67:68 -m state --state ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p udp -o tun0 --dport 67:68 --sport 67:68 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPT -A INPUT -p tcp -i tun0 --sport 80 -m state --state ESTABLISHED -j ACCEPT
$IPT -A INPUT -p tcp -i tun0 --sport 443 -m state --state ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p tcp -o tun0 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -p tcp -o tun0 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPT -A FORWARD -j DROP
$IPT -A INPUT -j DROP
$IPT -A OUTPUT -j DROP
- xxx.xxx.xxx.xxx = IP-address to my OpenVPN server
I know it's a little "strictly" configured firewall, but it's to prevent the users of the network to do anything stupid. The openvpn server has also a firewall configured, but i doubt there's some error, because the configuration works perfectly on android devices.
The configuration has to work on Android, Linux, OSX and Windows.
Thanks for all help.
