unable to access openvpn server from outside of LAN

wkdwonka

I'm only able to access openvpn from inside the LAN and only if I use TCP... I'm guessing it's something in my iptables, I've tried everything I can think of.. here is an entire dump of my server client logs, confs, routing tables and iptables. Thanks in advance, any direction is much appreciated.

also located @ https://gist.github.com/anonymous/940ea971bb4e75d31469

Client Config = Edit: Server Config

port 1194
proto tcp
;proto udp
dev tun
 
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/neutron.crt
key /etc/openvpn/certs/neutron.key
dh /etc/openvpn/certs/dh2048.pem
tls-auth /etc/openvpn/certs/ta.key 0
 
server 192.168.88.0 255.255.255.0
#server 192.168.88.0/24
 
ifconfig-pool-persist ipp.txt
#push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
 
client-to-client
push "route 192.168.88.0 255.255.255.0"
keepalive 1800 4000
 
cipher DES-EDE3-CBC # Triple-DES
comp-lzo
 
max-clients 50
 
user nobody
group nogroup
 
persist-key
persist-tun
 
log openvpn.log
status openvpn-status.log
verb 4
mute 20

Client Config

Edit: Remove useless comments

client
dev tun
proto tcp
remote 75.46.172.54 1194
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ca ca.crt
cert client1.crt
key client1.key
tls-auth ta.key 1
cipher DES-EDE3-CBC # Triple-DES
comp-lzo
verb 3
mute 20

IPTABLES issued command
iptables --list

root@sparks:~# iptables --list
Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere             multiport dports openvpn,47,http,https,smtp,ssmtp,pop3,pop3s,imap2,imaps,submission,ssmtp,ssh,ftp,ftp-data
ACCEPT     all  --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:smtp
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:submission
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:pop3
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:pop3s
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:imap2
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:imaps
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
ACCEPT     icmp --  anywhere             anywhere             icmp echo-request
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ftp-data
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ftp
ACCEPT     udp  --  anywhere             anywhere             udp dpt:netbios-ns
ACCEPT     udp  --  anywhere             anywhere             udp dpt:netbios-dgm
ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:netbios-ssn
ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:microsoft-ds
 
Chain FORWARD (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     all  --  192.168.88.0/24      anywhere
 
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
root@sparks:~#

iptables.conf file

# Shipped within iRedMail project:
#   * http://iRedMail.googlecode.com/
#
 
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
 
# Keep state.
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
 
# http/https, smtp/smtps, pop3/pop3s, imap/imaps, ssh, ftp
-A INPUT -p tcp -m multiport --dport 1194,47,80,443,25,465,110,995,143,993,587,465,22,21,20 -j ACCEPT
# custom
#-A UDP -p udp --dport 1723,47,20,21 -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 192.168.88.0/24 -j ACCEPT
 
 
 
# Loop device.
-A INPUT -i lo -j ACCEPT
 
# http, https
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT
 
# smtp, submission
-A INPUT -p tcp --dport 25 -j ACCEPT
-A INPUT -p tcp --dport 587 -j ACCEPT
 
# pop3, pop3s
-A INPUT -p tcp --dport 110 -j ACCEPT
-A INPUT -p tcp --dport 995 -j ACCEPT
 
# imap, imaps
-A INPUT -p tcp --dport 143 -j ACCEPT
-A INPUT -p tcp --dport 993 -j ACCEPT
 
# ssh
-A INPUT -p tcp --dport 22 -j ACCEPT
 
# Allow PING from remote hosts.
-A INPUT -p icmp --icmp-type echo-request -j ACCEPT
 
# ejabberd
#-A INPUT -p tcp --dport 5222 -j ACCEPT
#-A INPUT -p tcp --dport 5223 -j ACCEPT
#-A INPUT -p tcp --dport 5280 -j ACCEPT
 
# ldap/ldaps
#-A INPUT -p tcp --dport 389 -j ACCEPT
#-A INPUT -p tcp --dport 636 -j ACCEPT
 
# ftp.
-A INPUT -p tcp --dport 20 -j ACCEPT
-A INPUT -p tcp --dport 21 -j ACCEPT
#-t nat -A POSTROUTING -o eth0 -j MASQUERADE
 
#samba
-A INPUT -p udp -m udp --dport 137 -j ACCEPT
-A INPUT -p udp -m udp --dport 138 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 139 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 445 -j ACCEPT
#openvpn
#-A INPUT -p udp -m upd --dport 1194 -j ACCEPT
#-A FORWARD -p tcp --dport 1194 -j ACCEPT
#-I FORWARD -i tun0 -o eth0 -s 192.168.88.0/24 -m conntrack --ctstate NEW -j ACCEPT
#-t nat -I POSTROUTING -o eth0 -s 192.168.88.0/24 -j MASQUERADE
 
#-A INPUT -p tcp --dport 1194 -j ACCEPT
COMMIT

Edit: Server log

Thu Nov  6 15:43:34 2014 us=156205 Current Parameter Settings:
Thu Nov  6 15:43:34 2014 us=156321   config = '/etc/openvpn/server.conf'
Thu Nov  6 15:43:34 2014 us=156344   mode = 1
Thu Nov  6 15:43:34 2014 us=156364   persist_config = DISABLED
Thu Nov  6 15:43:34 2014 us=156384   persist_mode = 1
Thu Nov  6 15:43:34 2014 us=156402   show_ciphers = DISABLED
Thu Nov  6 15:43:34 2014 us=156421   show_digests = DISABLED
Thu Nov  6 15:43:34 2014 us=156440   show_engines = DISABLED
Thu Nov  6 15:43:34 2014 us=156459   genkey = DISABLED
Thu Nov  6 15:43:34 2014 us=156478   key_pass_file = '[UNDEF]'
Thu Nov  6 15:43:34 2014 us=156498   show_tls_ciphers = DISABLED
Thu Nov  6 15:43:34 2014 us=156517 Connection profiles [default]:
Thu Nov  6 15:43:34 2014 us=156537   proto = tcp-server
Thu Nov  6 15:43:34 2014 us=156556   local = '[UNDEF]'
Thu Nov  6 15:43:34 2014 us=156575   local_port = 1194
Thu Nov  6 15:43:34 2014 us=156594   remote = '[UNDEF]'
Thu Nov  6 15:43:34 2014 us=156613   remote_port = 1194
Thu Nov  6 15:43:34 2014 us=156632   remote_float = DISABLED
Thu Nov  6 15:43:34 2014 us=156651   bind_defined = DISABLED
Thu Nov  6 15:43:34 2014 us=156670   bind_local = ENABLED
Thu Nov  6 15:43:34 2014 us=156688 NOTE: --mute triggered...
Thu Nov  6 15:43:34 2014 us=156729 261 variation(s) on previous 20 message(s) suppressed by --mute
Thu Nov  6 15:43:34 2014 us=156758 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on $
Thu Nov  6 15:43:34 2014 us=157023 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu Nov  6 15:43:34 2014 us=174496 Diffie-Hellman initialized with 2048 bit key
Thu Nov  6 15:43:34 2014 us=175460 Control Channel Authentication: using '/etc/openvpn/certs/ta.key' as a OpenVPN static key file
Thu Nov  6 15:43:34 2014 us=175486 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Nov  6 15:43:34 2014 us=175503 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Nov  6 15:43:34 2014 us=175528 TLS-Auth MTU parms [ L:1544 D:168 EF:68 EB:0 ET:0 EL:0 ]
Thu Nov  6 15:43:34 2014 us=175568 Socket Buffers: R=[87380->131072] S=[16384->131072]
Thu Nov  6 15:43:34 2014 us=175701 ROUTE default_gateway=75.46.172.54
Thu Nov  6 15:43:34 2014 us=177430 TUN/TAP device tun0 opened
Thu Nov  6 15:43:34 2014 us=177475 TUN/TAP TX queue length set to 100
Thu Nov  6 15:43:34 2014 us=177528 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Nov  6 15:43:34 2014 us=177561 /sbin/ifconfig tun0 192.168.88.1 pointopoint 192.168.88.2 mtu 1500
Thu Nov  6 15:43:34 2014 us=182502 /sbin/route add -net 192.168.88.0 netmask 255.255.255.0 gw 192.168.88.2
Thu Nov  6 15:43:34 2014 us=183514 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Nov  6 15:43:34 2014 us=184433 GID set to nogroup
Thu Nov  6 15:43:34 2014 us=184780 UID set to nobody
Thu Nov  6 15:43:34 2014 us=184817 Listening for incoming TCP connection on [undef]
Thu Nov  6 15:43:34 2014 us=184850 TCPv4_SERVER link local (bound): [undef]
Thu Nov  6 15:43:34 2014 us=184864 TCPv4_SERVER link remote: [undef]
Thu Nov  6 15:43:34 2014 us=184889 MULTI: multi_init called, r=256 v=256
Thu Nov  6 15:43:34 2014 us=184995 IFCONFIG POOL: base=192.168.88.4 size=62, ipv6=0
Thu Nov  6 15:43:34 2014 us=185017 ifconfig_pool_read(), in='client1,192.168.88.4', TODO: IPv6
Thu Nov  6 15:43:34 2014 us=185051 succeeded -> ifconfig_pool_set()
Thu Nov  6 15:43:34 2014 us=185067 ifconfig_pool_read(), in='client1,192.168.88.8', TODO: IPv6
Thu Nov  6 15:43:34 2014 us=185081 succeeded -> ifconfig_pool_set()
Thu Nov  6 15:43:34 2014 us=185096 IFCONFIG POOL LIST
Thu Nov  6 15:43:34 2014 us=185113 client1,192.168.88.4
Thu Nov  6 15:43:34 2014 us=185127 client1,192.168.88.8
Thu Nov  6 15:43:34 2014 us=185161 MULTI: TCP INIT maxclients=50 maxevents=54
Thu Nov  6 15:43:34 2014 us=185204 Initialization Sequence Completed
Thu Nov  6 15:43:37 2014 us=388361 MULTI: multi_create_instance called
Thu Nov  6 15:43:37 2014 us=388438 Re-using SSL/TLS context
Thu Nov  6 15:43:37 2014 us=388500 LZO compression initialized
Thu Nov  6 15:43:37 2014 us=388773 Control Channel MTU parms [ L:1544 D:168 EF:68 EB:0 ET:0 EL:0 ]
Thu Nov  6 15:43:37 2014 us=388810 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Nov  6 15:43:37 2014 us=388876 Local Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,keydir 0,cipher DES-EDE3-CBC,auth SHA1$
Thu Nov  6 15:43:37 2014 us=388890 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,keydir 1,cipher DES-EDE3-CBC$
Thu Nov  6 15:43:37 2014 us=388939 Local Options hash (VER=V4): '7c7a0a5e'
Thu Nov  6 15:43:37 2014 us=388959 Expected Remote Options hash (VER=V4): '2dcdad92'
Thu Nov  6 15:43:37 2014 us=389003 TCP connection established with [AF_INET]192.168.1.186:49277
Thu Nov  6 15:43:37 2014 us=389020 TCPv4_SERVER link local: [undef]
Thu Nov  6 15:43:37 2014 us=389036 TCPv4_SERVER link remote: [AF_INET]192.168.1.186:49277
Thu Nov  6 15:44:37 2014 us=71673 192.168.1.186:49277 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Thu Nov  6 15:44:37 2014 us=71714 192.168.1.186:49277 TLS Error: TLS handshake failed
Thu Nov  6 15:44:37 2014 us=71903 192.168.1.186:49277 Fatal TLS error (check_tls_errors_co), restarting
Thu Nov  6 15:44:37 2014 us=71932 192.168.1.186:49277 SIGUSR1[soft,tls-error] received, client-instance restarting
Thu Nov  6 15:44:37 2014 us=72009 TCP/UDP: Closing socket

Edit: Server
ifconfig output

root@sparks:~# ifconfig
eth0      Link encap:Ethernet  HWaddr 00:1d:09:15:d1:01
          inet addr:75.46.172.49  Bcast:75.46.172.55  Mask:255.255.255.248
          inet6 addr: fe80::21d:9ff:fe15:d101/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:10563 errors:0 dropped:0 overruns:0 frame:0
          TX packets:5402 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:1512807 (1.4 MiB)  TX bytes:1031493 (1007.3 KiB)
          Interrupt:21
 
eth0:0    Link encap:Ethernet  HWaddr 00:1d:09:15:d1:01
          inet addr:75.46.172.50  Bcast:75.46.172.55  Mask:255.255.255.248
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Interrupt:21
 
eth0:1    Link encap:Ethernet  HWaddr 00:1d:09:15:d1:01
          inet addr:75.46.172.51  Bcast:75.46.172.55  Mask:255.255.255.248
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Interrupt:21
 
lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:3130 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3130 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:1008753 (985.1 KiB)  TX bytes:1008753 (985.1 KiB)
 
tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:192.168.88.1  P-t-P:192.168.88.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:0 (0.0 B)  TX bytes:352 (352.0 B)
 
root@sparks:~#

Traffic

wkdwonka wroteThanks in advance, any direction is much appreciated

What I would do is:

iptables-save > /etc/iptables/my-iptables.rules

Followed by:

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

and try again ..

wkdwonka

Still failed after issuing those commands... I did notice in the windows client the gateway points to an unpingable destination.. here is the output from route print

=============================================================
Interface List
21...00 ff f0 af fe e4 ......TAP-Win32 Adapter OAS
18...00 ff b4 6b f0 2b ......TAP-Windows Adapter V9
15...00 ac f8 16 22 bf ......VPN Client Adapter - VPN
13...00 8c fa 47 5b a1 ......Qualcomm Atheros AR8162/8166/8168 PCI-E Fast Ethe
net Controller (NDIS 6.20)
11...c0 d9 62 72 04 13 ......Realtek RTL8188CE Wireless LAN 802.11n PCI-E NIC
1...........................Software Loopback Interface 1
20...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
14...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
16...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
17...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
19...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
22...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #5
===========================================================================

IPv4 Route Table
=============================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.157 25
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
169.254.0.0 255.255.0.0 On-link 192.168.88.6 296
169.254.255.255 255.255.255.255 On-link 192.168.88.6 276
192.168.1.0 255.255.255.0 On-link 192.168.1.157 281
192.168.1.157 255.255.255.255 On-link 192.168.1.157 281
192.168.1.255 255.255.255.255 On-link 192.168.1.157 281
192.168.88.0 255.255.255.0 192.168.88.5 192.168.88.6 20
192.168.88.4 255.255.255.252 On-link 192.168.88.6 276
192.168.88.6 255.255.255.255 On-link 192.168.88.6 276
192.168.88.7 255.255.255.255 On-link 192.168.88.6 276
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.1.157 281
224.0.0.0 240.0.0.0 On-link 192.168.88.6 276
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.1.157 281
255.255.255.255 255.255.255.255 On-link 192.168.88.6 276
===========================================================================
Persistent Routes:
None

IPv6 Route Table
=============================================================
Active Routes:
If Metric Network Destination Gateway
11 281 ::/0 fe80::ea99:c4ff:feba:83d
1 306 ::1/128 On-link
16 58 2001::/32 On-link
16 306 2001:0:9d38:6ab8:306a:3c57:3f57:fe62/128
On-link
11 33 2600:1010:b112:d48a::/64 On-link
11 281 2600:1010:b112:d48a:a8ba:fe5e:9fc5:ea61/128
On-link
11 281 2600:1010:b112:d48a:fccb:74b9:40f8:eea2/128
On-link
11 33 2600:1010:b12d:3fb9::/64 On-link
11 281 2600:1010:b12d:3fb9:a8ba:fe5e:9fc5:ea61/128
On-link
11 281 2600:1010:b12d:3fb9:fccb:74b9:40f8:eea2/128
On-link
11 281 fe80::/64 On-link
18 276 fe80::/64 On-link
16 306 fe80::/64 On-link
16 306 fe80::306a:3c57:3f57:fe62/128
On-link
11 281 fe80::a8ba:fe5e:9fc5:ea61/128
On-link
18 276 fe80::f89c:e596:6a5d:9fa6/128
On-link
1 306 ff00::/8 On-link
16 306 ff00::/8 On-link
11 281 ff00::/8 On-link
18 276 ff00::/8 On-link
=============================================================
Persistent Routes:
None

I'm guessing the gateway for 192.168.88.0 should be 192.168.88.1? But I'm really not sure, I don't know why samba shares are working while lan accessed if that is the case, maybe it's using the lan network and not the openvpn even when I put in \\192.168.88.1\username ? So lost.