Default Gateway not forwarding all traffic

DrDinosaur

I'm trying to make my client forward all traffic through a VPS running OpenVPN. As you can see, it will allow pings to both domains and raw IP addresses, but it will not allow traffic like that made through curl and traceroute doesn't come up with anything. The traffic works correctly when not connected to the VPN. Please help, thanks.

Info:

Client output:
root@Kali:~/Downloads# openvpn --config client.conf

Sun Nov 30 11:59:40 2014 OpenVPN 2.2.1 i486-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Jun 19 2013
Sun Nov 30 11:59:40 2014 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sun Nov 30 11:59:40 2014 WARNING: file 'vpnclient1.key' is group or others accessible
Sun Nov 30 11:59:40 2014 LZO compression initialized
Sun Nov 30 11:59:40 2014 Control Channel MTU parms [ L:1558 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Nov 30 11:59:40 2014 Socket Buffers: R=[163840->131072] S=[163840->131072]
Sun Nov 30 11:59:40 2014 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Nov 30 11:59:40 2014 Local Options hash (VER=V4): '22188c5b'
Sun Nov 30 11:59:40 2014 Expected Remote Options hash (VER=V4): 'a8f55717'
Sun Nov 30 11:59:40 2014 UDPv4 link local: [undef]
Sun Nov 30 11:59:40 2014 UDPv4 link remote: [AF_INET]x.x.x.x:61098
Sun Nov 30 11:59:40 2014 TLS: Initial packet from [AF_INET]x.x.x.x:61098, sid=ec2af233 4431930c
Sun Nov 30 11:59:41 2014 VERIFY OK: depth=1, /C=US/ST=MD/L=Fort_Meade/O=National_Security_Agency/OU=Tailored_Access_Operations/CN=National_Security_Agency_CA/name=NSA/emailAddress=tao@nsa.gov
Sun Nov 30 11:59:41 2014 VERIFY OK: nsCertType=SERVER
Sun Nov 30 11:59:41 2014 VERIFY OK: depth=0, /C=US/ST=MD/L=Fort_Meade/O=National_Security_Agency/OU=Tailored_Access_Operations/CN=NSA_VPN_Access/name=NSA/emailAddress=tao@nsa.gov
Sun Nov 30 11:59:43 2014 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sun Nov 30 11:59:43 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Nov 30 11:59:43 2014 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sun Nov 30 11:59:43 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Nov 30 11:59:43 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 4096 bit RSA
Sun Nov 30 11:59:43 2014 [NSA_VPN_Access] Peer Connection Initiated with [AF_INET]x.x.x.x:61098
Sun Nov 30 11:59:46 2014 SENT CONTROL [NSA_VPN_Access]: 'PUSH_REQUEST' (status=1)
Sun Nov 30 11:59:46 2014 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Sun Nov 30 11:59:46 2014 OPTIONS IMPORT: timers and/or timeouts modified
Sun Nov 30 11:59:46 2014 OPTIONS IMPORT: --ifconfig/up options modified
Sun Nov 30 11:59:46 2014 OPTIONS IMPORT: route options modified
Sun Nov 30 11:59:46 2014 ROUTE default_gateway=192.168.2.1
Sun Nov 30 11:59:46 2014 TUN/TAP device tun0 opened
Sun Nov 30 11:59:46 2014 TUN/TAP TX queue length set to 100
Sun Nov 30 11:59:46 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Nov 30 11:59:46 2014 /sbin/ifconfig tun0 10.8.0.6 pointopoint 10.8.0.5 mtu 1500
Sun Nov 30 11:59:46 2014 /sbin/route add -net x.x.x.x netmask 255.255.255.255 gw 192.168.2.1
Sun Nov 30 11:59:46 2014 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 10.8.0.5
Sun Nov 30 11:59:46 2014 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 10.8.0.5
Sun Nov 30 11:59:46 2014 /sbin/route add -net 10.8.0.1 netmask 255.255.255.255 gw 10.8.0.5
Sun Nov 30 11:59:46 2014 Initialization Sequence Completed

Client config:
root@Kali:~/Downloads# cat client.conf

client
dev tun
proto udp
remote x.x.x.x 61098
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert vpnclient1.crt
key vpnclient1.key
ns-cert-type server
cipher AES-256-CBC
comp-lzo
verb 3

Client interfaces and routes:

root@Kali:~/Downloads# ifconfig
eth0      Link encap:Ethernet  HWaddr 08:00:27:d6:e5:53  
          inet addr:192.168.2.100  Bcast:192.168.2.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:730579 errors:0 dropped:0 overruns:0 frame:0
          TX packets:840542 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:948096029 (904.1 MiB)  TX bytes:244217840 (232.9 MiB)
lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:733355 errors:0 dropped:0 overruns:0 frame:0
          TX packets:733355 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:54276427 (51.7 MiB)  TX bytes:54276427 (51.7 MiB)
tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.6  P-t-P:10.8.0.5  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:14 errors:0 dropped:0 overruns:0 frame:0
          TX packets:159 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:1200 (1.1 KiB)  TX bytes:10710 (10.4 KiB)

root@Kali:~/Downloads# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 10.8.0.5 128.0.0.0 UG 0 0 0 tun0
0.0.0.0 192.168.2.1 0.0.0.0 UG 0 0 0 eth0
10.8.0.1 10.8.0.5 255.255.255.255 UGH 0 0 0 tun0
10.8.0.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
128.0.0.0 10.8.0.5 128.0.0.0 UG 0 0 0 tun0
x.x.x.x 192.168.2.1 255.255.255.255 UGH 0 0 0 eth0
192.168.2.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0

Server routes and interfaces:
root@MainServer:/etc/openvpn# cat /proc/sys/net/ipv4/ip_forward
1
root@MainServer:/etc/openvpn# iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

root@MainServer:/etc/openvpn# ifconfig

eth0      Link encap:Ethernet  HWaddr 04:01:28:ce:fd:01
          inet addr:x.x.x.x  Bcast:162.243.150.255  Mask:255.255.255.0
          inet6 addr: fe80::601:28ff:fece:fd01/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:15420801 errors:0 dropped:0 overruns:0 frame:0
          TX packets:13965057 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:16312837213 (16.3 GB)  TX bytes:17273432904 (17.2 GB)
lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:6808 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6808 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:2158598 (2.1 MB)  TX bytes:2158598 (2.1 MB)
tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:213 errors:0 dropped:0 overruns:0 frame:0
          TX packets:23 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:13116 (13.1 KB)  TX bytes:1968 (1.9 KB)

root@MainServer:/etc/openvpn# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 162.243.150.1 0.0.0.0 UG 0 0 0 eth0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
10.8.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
162.243.150.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
Server config:
root@MainServer:/etc/openvpn# cat server.conf

port 61098
proto udp
dev tun
ca ca.crt
cert vpnserver.crt
key vpnserver.key  # This file should be kept secret
dh dh4096.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
keepalive 10 120
cipher AES-256-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3

maikcat

please post the output of:

iptables -L -v
iptables -t nat -L -v

on your openvpn server.

Michael.

DrDinosaur

root@MainServer:/etc/openvpn# iptables -L -v
Chain INPUT (policy DROP 582 packets, 85895 bytes)
 pkts bytes target     prot opt in     out     source               destination
16106 1055K fail2ban-ssh  tcp  --  any    any     anywhere             anywhere             multiport dports 54996
  25M   26G ufw-before-logging-input  all  --  any    any     anywhere             anywhere
  25M   26G ufw-before-input  all  --  any    any     anywhere             anywhere
11985 8618K ufw-after-input  all  --  any    any     anywhere             anywhere
11519 8582K ufw-after-logging-input  all  --  any    any     anywhere             anywhere
11519 8582K ufw-reject-input  all  --  any    any     anywhere             anywhere
11519 8582K ufw-track-input  all  --  any    any     anywhere             anywhere

Chain FORWARD (policy DROP 466 packets, 27960 bytes)
 pkts bytes target     prot opt in     out     source               destination
 2243  138K ufw-before-logging-forward  all  --  any    any     anywhere             anywhere
 2243  138K ufw-before-forward  all  --  any    any     anywhere             anywhere
 2104  126K ufw-after-forward  all  --  any    any     anywhere             anywhere
 2104  126K ufw-after-logging-forward  all  --  any    any     anywhere             anywhere
 2104  126K ufw-reject-forward  all  --  any    any     anywhere             anywhere
 2104  126K ufw-track-forward  all  --  any    any     anywhere             anywhere

Chain OUTPUT (policy ACCEPT 320 packets, 27131 bytes)
 pkts bytes target     prot opt in     out     source               destination
  23M   28G ufw-before-logging-output  all  --  any    any     anywhere             anywhere
  23M   28G ufw-before-output  all  --  any    any     anywhere             anywhere
83996   14M ufw-after-output  all  --  any    any     anywhere             anywhere
83996   14M ufw-after-logging-output  all  --  any    any     anywhere             anywhere
83996   14M ufw-reject-output  all  --  any    any     anywhere             anywhere
83996   14M ufw-track-output  all  --  any    any     anywhere             anywhere

Chain fail2ban-ssh (1 references)
 pkts bytes target     prot opt in     out     source               destination
16106 1055K RETURN     all  --  any    any     anywhere             anywhere

Chain ufw-after-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-after-input (1 references)
 pkts bytes target     prot opt in     out     source               destination
  150 11700 ufw-skip-to-policy-input  udp  --  any    any     anywhere             anywhere             udp dpt:netbios-ns
    0     0 ufw-skip-to-policy-input  udp  --  any    any     anywhere             anywhere             udp dpt:netbios-dgm
    0     0 ufw-skip-to-policy-input  tcp  --  any    any     anywhere             anywhere             tcp dpt:netbios-ssn
    2    96 ufw-skip-to-policy-input  tcp  --  any    any     anywhere             anywhere             tcp dpt:microsoft-ds
    0     0 ufw-skip-to-policy-input  udp  --  any    any     anywhere             anywhere             udp dpt:bootps
    0     0 ufw-skip-to-policy-input  udp  --  any    any     anywhere             anywhere             udp dpt:bootpc
    0     0 ufw-skip-to-policy-input  all  --  any    any     anywhere             anywhere             ADDRTYPE match dst-type BROADCAST

Chain ufw-after-logging-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination
  229 13740 LOG        all  --  any    any     anywhere             anywhere             limit: avg 3/min burst 10 LOG level warning prefix "[UFW BLOCK] "

Chain ufw-after-logging-input (1 references)
 pkts bytes target     prot opt in     out     source               destination
  431 76613 LOG        all  --  any    any     anywhere             anywhere             limit: avg 3/min burst 10 LOG level warning prefix "[UFW BLOCK] "

Chain ufw-after-logging-output (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-after-output (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-before-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination
   13  1092 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp destination-unreachable
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp source-quench
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp time-exceeded
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp parameter-problem
    3   252 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp echo-request
  466 27960 ufw-user-forward  all  --  any    any     anywhere             anywhere

Chain ufw-before-input (1 references)
 pkts bytes target     prot opt in     out     source               destination
 5124 1637K ACCEPT     all  --  lo     any     anywhere             anywhere
9838K   11G ACCEPT     all  --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED
  515  121K ufw-logging-deny  all  --  any    any     anywhere             anywhere             ctstate INVALID
  515  121K DROP       all  --  any    any     anywhere             anywhere             ctstate INVALID
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp destination-unreachable
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp source-quench
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp time-exceeded
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp parameter-problem
   18   840 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp echo-request
    0     0 ACCEPT     udp  --  any    any     anywhere             anywhere             udp spt:bootps dpt:bootpc
30339 1820K ufw-not-local  all  --  any    any     anywhere             anywhere
    0     0 ACCEPT     udp  --  any    any     anywhere             224.0.0.251          udp dpt:mdns
    0     0 ACCEPT     udp  --  any    any     anywhere             239.255.255.250      udp dpt:1900
30339 1820K ufw-user-input  all  --  any    any     anywhere             anywhere

Chain ufw-before-logging-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-before-logging-input (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-before-logging-output (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-before-output (1 references)
 pkts bytes target     prot opt in     out     source               destination
 5124 1637K ACCEPT     all  --  any    lo      anywhere             anywhere
8936K   11G ACCEPT     all  --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED
31329 1669K ufw-user-output  all  --  any    any     anywhere             anywhere

Chain ufw-logging-allow (0 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 LOG        all  --  any    any     anywhere             anywhere             limit: avg 3/min burst 10 LOG level warning prefix "[UFW ALLOW] "

Chain ufw-logging-deny (2 references)
 pkts bytes target     prot opt in     out     source               destination
  491  120K RETURN     all  --  any    any     anywhere             anywhere             ctstate INVALID limit: avg 3/min burst 10
   21  1430 LOG        all  --  any    any     anywhere             anywhere             limit: avg 3/min burst 10 LOG level warning prefix "[UFW BLOCK] "

Chain ufw-not-local (1 references)
 pkts bytes target     prot opt in     out     source               destination
30339 1820K RETURN     all  --  any    any     anywhere             anywhere             ADDRTYPE match dst-type LOCAL
    0     0 RETURN     all  --  any    any     anywhere             anywhere             ADDRTYPE match dst-type MULTICAST
    0     0 RETURN     all  --  any    any     anywhere             anywhere             ADDRTYPE match dst-type BROADCAST
    0     0 ufw-logging-deny  all  --  any    any     anywhere             anywhere             limit: avg 3/min burst 10
    0     0 DROP       all  --  any    any     anywhere             anywhere

Chain ufw-reject-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-reject-input (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-reject-output (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-skip-to-policy-forward (0 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       all  --  any    any     anywhere             anywhere

Chain ufw-skip-to-policy-input (7 references)
 pkts bytes target     prot opt in     out     source               destination
  152 11796 DROP       all  --  any    any     anywhere             anywhere

Chain ufw-skip-to-policy-output (0 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere

Chain ufw-track-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-track-input (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-track-output (1 references)
 pkts bytes target     prot opt in     out     source               destination
30605 1616K ACCEPT     tcp  --  any    any     anywhere             anywhere             ctstate NEW
  404 26079 ACCEPT     udp  --  any    any     anywhere             anywhere             ctstate NEW

Chain ufw-user-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-user-input (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:54996
   30  1764 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:http
  162  8444 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:https
    0     0 ACCEPT     all  --  any    any     network/24           anywhere
    0     0 ACCEPT     udp  --  any    any     anywhere             anywhere             udp dpt:60000
    0     0 ACCEPT     udp  --  any    any     anywhere             anywhere             udp dpt:60001
28498 1662K ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:9001
  914 50372 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:9030
    0     0 ACCEPT     udp  --  any    any     anywhere             anywhere             udp dpt:61098

Chain ufw-user-limit (0 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 LOG        all  --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 LOG level warning prefix "[UFW LIMIT BLOCK] "
    0     0 REJECT     all  --  any    any     anywhere             anywhere             reject-with icmp-port-unreachable

Chain ufw-user-limit-accept (0 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere

Chain ufw-user-logging-forward (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-user-logging-input (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-user-logging-output (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain ufw-user-output (1 references)
 pkts bytes target     prot opt in     out     source               destination
root@MainServer:/etc/openvpn# iptables -t nat -L -v
Chain PREROUTING (policy ACCEPT 30241 packets, 1806K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain INPUT (policy ACCEPT 29244 packets, 1701K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 24428 packets, 1279K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 24428 packets, 1279K bytes)
 pkts bytes target     prot opt in     out     source               destination
   20  1680 MASQUERADE  all  --  any    eth0    10.8.0.0/24          anywhere
    0     0 MASQUERADE  all  --  any    eth0    10.8.0.0/24          anywhere
    0     0 MASQUERADE  all  --  any    eth0    10.8.0.0/24          anywhere
root@MainServer:/etc/openvpn#

maikcat

for testing drop ALL your tables and leave only the NAT one.

tell us if you still have problems.

Michael.

DrDinosaur

What command is that? I tried iptables -F and I can tell you that did not end well. I had to restore to a backup.

maikcat

emptying the ruleset while having the default action to DROP WILL lock you out....

so FIRST switch the default action to ALLOW then flush your rules,

also as a backup plan you must have console access to your server somehow...

Michael.

DrDinosaur

This has been solved on serverfault. Thanks for the help though 🙂

http://serverfault.com/questions/648118/openvpn-not-default-gateway-for-all-traffic

maikcat

is there any similarities with the post of serverfault?

here i see a dozen of iptables rules , there they are ALL Allow...

never mind..

Michael.