Hi all and firstly apologies for making my first post a plea for help, but I have been banging my head against this for a couple of days and really need some new eyes on the problem:
I have a home server / router / firewall running Arm Debian 6.0 which runs a dhcp server, samba, a LAMP stack, shorewall etc. I have a need now to run a vpn which will allow me to tunnel into my home network for management (thus enabling me to dispose of all those DNAT rules for accessing internal servers) but most importantly to allow secure access to the internet from wherever I am e.g. pulblic wifi etc.
So far I have followed lots of guides and been around the houses and think I have most of it right; clients connect first time every time and I can access my internal servers and clients over the VPN, but as soon as I try to access the Internet through it I basically get nothing. I think this is a routing error because I can see the firewall allowing the outbound connection, so I think that the reply is not getting to the vpn net and the client, but strangely I can ping xxx.yyy.zzz.171 & 173 from the client.
Nov 10 09:31:12 hollyhop kernel: Shorewall:vpn2net:ACCEPT:IN=tun0 OUT=eth1 SRC=10.131.133.6 DST=8.8.8.8 LEN=59 TOS=0x00 PREC=0x00 TTL=63 ID=32419 PROTO=UDP SPT=59069 DPT=53 LEN=39
(there will normally be many of these entries indicating the client is retrying, but never getting a response)
Anyways, I would be grateful for any input or suggestions that might get me working
Some details:
I have 8 internet addresses xxx.yyy.zzz.168/29 with three on my server .169 which listens for the incoming vpn, .170 which is currently DNAT'ing inbound ssh etc and .171 which is publishing a web site and is the MASQ for outbound internet traffic (173 and 174 are used for the actual router which is just working as a dumb almost bridge). My internal network is 10.131.132.0/24 with the openvpn server being at 10.131.132.2 I have assigned 10.131.133.0/24 as the vpn network.
Configuration files:
Server: (yes I am using a non standard port, but I have the same issue even on default port)
local xxx.yyy.zzz.169
port 51194
proto udp
dev tun0
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/hollyhop.crt
key /etc/openvpn/certs/hollyhop.key # This file should be kept secret
dh /etc/openvpn/certs/dh1024.pem
server 10.131.133.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.131.132.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
keepalive 10 120
comp-lzo
max-clients 10
persist-key
persist-tun
status /var/log/openvpn-status.log
log-append /var/log/openvpn.log
verb 6
mute 20
Client:
client
dev tun
proto udp
remote xxx.yyy.zzz.169 51194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert g-iphone.crt
key g-iphone.key
ns-cert-type server
comp-lzo
verb 4
mute 40
Shorewall MASQ:
###############################################################################
#INTERFACE SOURCE ADDRESS PROTO PORT(S) IPSEC MARK USER/
# GROUP
eth1 10.131.132.0/24 xxx.yyy.zzz.171
tun0 10.131.133.0/24 xxx.yyy.zzz.171
Shorewall Policies:
#SOURCE DEST POLICY LOG LIMIT: CONNLIMIT:
# LEVEL BURST MASK
loc net ACCEPT
loc $FW ACCEPT
loc vpn ACCEPT
vpn loc ACCEPT debug
vpn net ACCEPT debug
vpn $FW ACCEPT debug
$FW loc ACCEPT
$FW net ACCEPT
net all DROP info
all all REJECT info
Output of 'route' command:
root@hollyhop:~# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.131.133.2 * 255.255.255.255 UH 0 0 0 tun0
82.70.115.168 * 255.255.255.248 U 0 0 0 eth1
10.131.133.0 10.131.133.2 255.255.255.0 UG 0 0 0 tun0
10.131.132.0 * 255.255.255.0 U 0 0 0 eth0
default xxx-yyy-zzz-173.d 0.0.0.0 UG 0 0 0 eth1
Logfiles:
openvpn vebosity 4 session log:
Mon Nov 10 07:49:51 2014 us=268102 OpenVPN 2.1.3 arm-unknown-linux-gnueabi [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Jun 6 2013
Mon Nov 10 07:49:51 2014 us=269512 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Nov 10 07:49:51 2014 us=324039 Diffie-Hellman initialized with 1024 bit key
Mon Nov 10 07:49:51 2014 us=330368 /usr/bin/openssl-vulnkey -q -b 1024 -m <modulus omitted>
Mon Nov 10 07:49:52 2014 us=331519 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Nov 10 07:49:52 2014 us=331895 Socket Buffers: R=[112640->131072] S=[112640->131072]
Mon Nov 10 07:49:52 2014 us=333892 TUN/TAP device tun0 opened
Mon Nov 10 07:49:52 2014 us=334043 TUN/TAP TX queue length set to 100
Mon Nov 10 07:49:52 2014 us=334292 /sbin/ifconfig tun0 10.131.133.1 pointopoint 10.131.133.2 mtu 1500
Mon Nov 10 07:49:52 2014 us=342684 /sbin/route add -net 10.131.133.0 netmask 255.255.255.0 gw 10.131.133.2
Mon Nov 10 07:49:52 2014 us=348042 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Nov 10 07:49:52 2014 us=357482 UDPv4 link local (bound): [AF_INET]xxx.yyy.zzz.169:51194
Mon Nov 10 07:49:52 2014 us=357808 UDPv4 link remote: [undef]
Mon Nov 10 07:49:52 2014 us=357959 MULTI: multi_init called, r=256 v=256
Mon Nov 10 07:49:52 2014 us=358809 IFCONFIG POOL: base=10.131.133.4 size=62
Mon Nov 10 07:49:52 2014 us=359246 IFCONFIG POOL LIST
Mon Nov 10 07:49:52 2014 us=359360 g-iphone,10.131.133.4
Mon Nov 10 07:49:52 2014 us=359460 g-ipod,10.131.133.8
Mon Nov 10 07:49:52 2014 us=359558 g-ipad,10.131.133.12
Mon Nov 10 07:49:52 2014 us=359825 Initialization Sequence Completed
Mon Nov 10 07:51:47 2014 us=772594 MULTI: multi_create_instance called
Mon Nov 10 07:51:47 2014 us=773001 85.255.235.240:9598 Re-using SSL/TLS context
Mon Nov 10 07:51:47 2014 us=773257 85.255.235.240:9598 LZO compression initialized
Mon Nov 10 07:51:47 2014 us=774567 85.255.235.240:9598 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Nov 10 07:51:47 2014 us=774704 85.255.235.240:9598 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Nov 10 07:51:47 2014 us=775096 85.255.235.240:9598 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Mon Nov 10 07:51:47 2014 us=775191 85.255.235.240:9598 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Mon Nov 10 07:51:47 2014 us=775498 85.255.235.240:9598 Local Options hash (VER=V4): '530fdded'
Mon Nov 10 07:51:47 2014 us=775650 85.255.235.240:9598 Expected Remote Options hash (VER=V4): '41690919'
Mon Nov 10 07:51:47 2014 us=776030 85.255.235.240:9598 TLS: Initial packet from [AF_INET]85.255.235.240:9598, sid=f1793c10 6053107c
Mon Nov 10 07:51:52 2014 us=256000 85.255.235.240:9598 VERIFY OK: depth=1, /C=UK/ST=EX/L=WCMBE/O=JMC/OU=HH/CN=hollyhop/emailAddress=xxxyyyzzz@gmail.com
Mon Nov 10 07:51:52 2014 us=258430 85.255.235.240:9598 VERIFY OK: depth=0, /C=UK/ST=EX/L=WCMBE/O=JMC/CN=g-iphone/emailAddress=xxxyyyzzz@gmail.com
Mon Nov 10 07:51:53 2014 us=432054 85.255.235.240:9598 [g-iphone] Peer Connection Initiated with [AF_INET]85.255.235.240:9598
Mon Nov 10 07:51:53 2014 us=432617 g-iphone/85.255.235.240:9598 MULTI: Learn: 10.131.133.6 -> g-iphone/85.255.235.240:9598
Mon Nov 10 07:51:53 2014 us=432750 g-iphone/85.255.235.240:9598 MULTI: primary virtual IP for g-iphone/85.255.235.240:9598: 10.131.133.6
Mon Nov 10 07:51:53 2014 us=452275 g-iphone/85.255.235.240:9598 PUSH: Received control message: 'PUSH_REQUEST'
Mon Nov 10 07:51:53 2014 us=452677 g-iphone/85.255.235.240:9598 SENT CONTROL [g-iphone]: 'PUSH_REPLY,route 10.131.132.0 255.255.255.0,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,route 10.131.133.1,topology net30,ping 10,ping-restart 120,ifconfig 10.131.133.6 10.131.133.5' (status=1)
Mon Nov 10 07:52:56 2014 us=572134 g-iphone/85.255.235.240:9598 SIGTERM[soft,remote-exit] received, client-instance exiting
Mon Nov 10 07:52:57 2014 us=736485 MULTI: multi_create_instance called
Mon Nov 10 07:52:57 2014 us=736823 85.255.235.240:54288 Re-using SSL/TLS context
Mon Nov 10 07:52:57 2014 us=736975 85.255.235.240:54288 LZO compression initialized
Mon Nov 10 07:52:57 2014 us=737511 85.255.235.240:54288 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Nov 10 07:52:57 2014 us=737644 85.255.235.240:54288 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Nov 10 07:52:57 2014 us=737929 85.255.235.240:54288 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Mon Nov 10 07:52:57 2014 us=738024 85.255.235.240:54288 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Mon Nov 10 07:52:57 2014 us=738186 85.255.235.240:54288 Local Options hash (VER=V4): '530fdded'
Mon Nov 10 07:52:57 2014 us=738338 85.255.235.240:54288 Expected Remote Options hash (VER=V4): '41690919'
Mon Nov 10 07:52:57 2014 us=738564 85.255.235.240:54288 TLS: Initial packet from [AF_INET]85.255.235.240:54288, sid=b96e485e ac4d3ca5
Mon Nov 10 07:53:12 2014 us=195874 85.255.235.240:54288 VERIFY OK: depth=1, /C=UK/ST=EX/L=WCMBE/O=JMC/OU=HH/CN=hollyhop/emailAddress=xxxyyyzzz@gmail.com
Mon Nov 10 07:53:12 2014 us=197861 85.255.235.240:54288 VERIFY OK: depth=0, /C=UK/ST=EX/L=WCMBE/O=JMC/CN=g-iphone/emailAddress=xxxyyyzzz@gmail.com
Mon Nov 10 07:53:12 2014 us=993845 85.255.235.240:54288 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Nov 10 07:53:12 2014 us=994050 85.255.235.240:54288 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Nov 10 07:53:12 2014 us=994487 85.255.235.240:54288 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Nov 10 07:53:12 2014 us=994616 85.255.235.240:54288 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Nov 10 07:53:13 2014 us=652591 85.255.235.240:54288 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Mon Nov 10 07:53:13 2014 us=652874 85.255.235.240:54288 [g-iphone] Peer Connection Initiated with [AF_INET]85.255.235.240:54288
Mon Nov 10 07:53:13 2014 us=653382 g-iphone/85.255.235.240:54288 MULTI: Learn: 10.131.133.6 -> g-iphone/85.255.235.240:54288
Mon Nov 10 07:53:13 2014 us=653511 g-iphone/85.255.235.240:54288 MULTI: primary virtual IP for g-iphone/85.255.235.240:54288: 10.131.133.6
Mon Nov 10 07:53:13 2014 us=653928 g-iphone/85.255.235.240:54288 PUSH: Received control message: 'PUSH_REQUEST'
Mon Nov 10 07:53:13 2014 us=654323 g-iphone/85.255.235.240:54288 SENT CONTROL [g-iphone]: 'PUSH_REPLY,route 10.131.132.0 255.255.255.0,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,route 10.131.133.1,topology net30,ping 10,ping-restart 120,ifconfig 10.131.133.6 10.131.133.5' (status=1)
Iphone client log: for this test wifi is off and the connection is through the mobile data network
2014-11-10 09:15:11 VERIFY OK: depth=0
cert. version : 3
serial number : 01
issuer name : C=UK, ST=EX, L=WCMBE, O=JMC, OU=HH, CN=hollyhop, emailAddress=xxxyyyzzz@gmail.com
subject name : C=UK, ST=EX, L=WCMBE, O=JMC, CN=hollyhop, emailAddress=xxxyyyzzz@gmail.com
issued on : 2014-11-07 09:32:20
expires on : 2024-11-04 09:32:20
signed using : RSA with SHA1
RSA key size : 1024 bits
basic constraints : CA=false
cert. type : SSL Server
key usage : Digital Signature, Key Encipherment
ext key usage : TLS Web Server Authentication
2014-11-10 09:15:14 SSL Handshake: TLSv1.0/TLS-DHE-RSA-WITH-AES-256-CBC-SHA
2014-11-10 09:15:14 Session is ACTIVE
2014-11-10 09:15:14 EVENT: GET_CONFIG
2014-11-10 09:15:14 Sending PUSH_REQUEST to server...
2014-11-10 09:15:14 OPTIONS:
0 [route] [10.131.132.0] [255.255.255.0]
1 [redirect-gateway] [def1] [bypass-dhcp]
2 [dhcp-option] [DNS] [8.8.8.8]
3 [route] [10.131.133.1]
4 [topology] [net30]
5 [ping] [10]
6 [ping-restart] [120]
7 [ifconfig] [10.131.133.6] [10.131.133.5]
2014-11-10 09:15:14 LZO-ASYM init swap=0 asym=0
2014-11-10 09:15:14 EVENT: ASSIGN_IP
2014-11-10 09:15:14 Connected via tun
2014-11-10 09:15:14 EVENT: CONNECTED @xxx.yyy.zzz.169:51194 (xxx.yyy.zzz.169) via /UDPv4 on tun/10.131.133.6/
2014-11-10 09:15:15 NET Internet:ReachableViaWWAN/WR t----l-
2014-11-10 09:15:15 SetStatus Connected
