OpenVPN connected but no internet access

Applier

Greetings.

I used cwaffles' ezopenvpn script from Github to set up OpenVPN on my VPS (OpenVZ virtualization). It all goes fine until I connect to my OpenVPN server, I even get allotted an IP by the OpenVPN server. But I can't access the internet once the OpenVPN connection is established. I can't ping any addresses except my VPS's IP, and all web browsers get stuck on "resolving web address".

My traceroutes get stuck at "connecting to 10.0.0.1" so I'm wondering if it's a DNS problem, but cwaffle's script sets google DNS servers as default, so I don't know what's causing this issue.

I've successfully set up a server using this same script in the past, and everything worked well back then. I don't know what's changed.

Any help will be greatly appreciated.

Thanks and best regards.

maikcat

so I'm wondering if it's a DNS problem

without posting config files used,logs,NAT rules no-one can tell why your setup is not working...

Michael.

Applier

maikcat wrote
so I'm wondering if it's a DNS problem
without posting config files used,logs,NAT rules no-one can tell why your setup is not working...

Michael.

Thanks for your response Michael, and my apologies for not posting logs and config files. Here they are:

Client config file:

client
dev tun
proto udp
remote myserver'sip 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
ns-cert-type server
comp-lzo
verb 3
remote-cert-tls server

Obscured my server's IP in the client config file.

Server config file:

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

Log of OpenVPN client trying to connect:

Tue Dec 09 17:19:59 2014 OpenVPN 2.3.2 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO]
[PKCS11] [eurephia] [IPv6] built on Aug  7 2014
Enter Private Key Password:
Tue Dec 09 17:20:02 2014 WARNING: this configuration may cache passwords in memo
ry -- use the auth-nocache option to prevent this
Tue Dec 09 17:20:02 2014 Socket Buffers: R=[65536->65536] S=[65536->65536]
Tue Dec 09 17:20:02 2014 UDPv4 link local: [undef]
Tue Dec 09 17:20:02 2014 UDPv4 link remote: [AF_INET]myserver:1194
Tue Dec 09 17:20:02 2014 TLS: Initial packet from [AF_INET]myserver:1194, s
id=12cd4795 d4fca001
Tue Dec 09 17:20:05 2014 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort
-Funston, OU=changeme, CN=changeme, name=changeme, emailAddress=mail@host.domain

Tue Dec 09 17:20:05 2014 VERIFY OK: nsCertType=SERVER
Tue Dec 09 17:20:05 2014 Validating certificate key usage
Tue Dec 09 17:20:05 2014 ++ Certificate has key usage  00a0, expects 00a0
Tue Dec 09 17:20:05 2014 VERIFY KU OK
Tue Dec 09 17:20:05 2014 Validating certificate extended key usage
Tue Dec 09 17:20:05 2014 ++ Certificate has EKU (str) TLS Web Server Authenticat
ion, expects TLS Web Server Authentication
Tue Dec 09 17:20:05 2014 VERIFY EKU OK
Tue Dec 09 17:20:05 2014 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort
-Funston, OU=changeme, CN=changeme, name=changeme, emailAddress=mail@host.domain

Tue Dec 09 17:20:19 2014 Data Channel Encrypt: Cipher 'BF-CBC' initialized with
128 bit key
Tue Dec 09 17:20:19 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1'
 for HMAC authentication
Tue Dec 09 17:20:19 2014 Data Channel Decrypt: Cipher 'BF-CBC' initialized with
128 bit key
Tue Dec 09 17:20:19 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1'
 for HMAC authentication
Tue Dec 09 17:20:19 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES2
56-SHA, 2048 bit RSA
Tue Dec 09 17:20:19 2014 [changeme] Peer Connection Initiated with [AF_INET]5.17
5.185.177:1194
Tue Dec 09 17:20:21 2014 SENT CONTROL [changeme]: 'PUSH_REQUEST' (status=1)
Tue Dec 09 17:20:21 2014 PUSH: Received control message: 'PUSH_REPLY,redirect-ga
teway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.
8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Tue Dec 09 17:20:21 2014 OPTIONS IMPORT: timers and/or timeouts modified
Tue Dec 09 17:20:21 2014 OPTIONS IMPORT: --ifconfig/up options modified
Tue Dec 09 17:20:21 2014 OPTIONS IMPORT: route options modified
Tue Dec 09 17:20:21 2014 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options
 modified
Tue Dec 09 17:20:21 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Dec 09 17:20:21 2014 open_tun, tt->ipv6=0
Tue Dec 09 17:20:21 2014 TAP-WIN32 device [Ethernet 2] opened: \\.\Global\{F0BE1
BA12-4B54-BA20-12311E900724}.tap
Tue Dec 09 17:20:21 2014 TAP-Windows Driver Version 9.9
Tue Dec 09 17:20:21 2014 Notified TAP-Windows driver to set a DHCP IP/netmask of
 10.8.0.6/255.255.255.252 on interface {1231521-BA12-4B54-BA20-12311E900724} [D
HCP-serv: 10.8.0.5, lease-time: 31536000]
Tue Dec 09 17:20:21 2014 Successful ARP Flush on interface [15] {F0BE1C70-BA47-4
B27-BA90-23BC1E900724}
Tue Dec 09 17:20:26 2014 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Tue Dec 09 17:20:26 2014 C:\Windows\system32\route.exe ADD myserverIP MASK 25
5.255.255.255 192.168.2.1
Tue Dec 09 17:20:26 2014 ROUTE: route addition failed using CreateIpForwardEntry
: The object already exists.   [status=5010 if_index=3]
Tue Dec 09 17:20:26 2014 Route addition via IPAPI failed [adaptive]
Tue Dec 09 17:20:26 2014 Route addition fallback to route.exe
Tue Dec 09 17:20:26 2014 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\W
INDOWS\System32\Wbem
Tue Dec 09 17:20:26 2014 C:\Windows\system32\route.exe ADD 192.168.2.1 MASK 255.
255.255.255 192.168.2.1 IF 3
Tue Dec 09 17:20:26 2014 ROUTE: route addition failed using CreateIpForwardEntry
: The object already exists.   [status=5010 if_index=3]
Tue Dec 09 17:20:26 2014 Route addition via IPAPI failed [adaptive]
Tue Dec 09 17:20:26 2014 Route addition fallback to route.exe
Tue Dec 09 17:20:26 2014 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\W
INDOWS\System32\Wbem
Tue Dec 09 17:20:26 2014 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.
0 10.8.0.5
Tue Dec 09 17:20:26 2014 ROUTE: route addition failed using CreateIpForwardEntry
: The object already exists.   [status=5010 if_index=15]
Tue Dec 09 17:20:26 2014 Route addition via IPAPI failed [adaptive]
Tue Dec 09 17:20:26 2014 Route addition fallback to route.exe
Tue Dec 09 17:20:26 2014 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\W
INDOWS\System32\Wbem
Tue Dec 09 17:20:26 2014 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.
0.0 10.8.0.5
Tue Dec 09 17:20:26 2014 ROUTE: route addition failed using CreateIpForwardEntry
: The object already exists.   [status=5010 if_index=15]
Tue Dec 09 17:20:26 2014 Route addition via IPAPI failed [adaptive]
Tue Dec 09 17:20:26 2014 Route addition fallback to route.exe
Tue Dec 09 17:20:26 2014 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\W
INDOWS\System32\Wbem
Tue Dec 09 17:20:26 2014 C:\Windows\system32\route.exe ADD 10.8.0.1 MASK 255.255
.255.255 10.8.0.5
Tue Dec 09 17:20:26 2014 ROUTE: route addition failed using CreateIpForwardEntry
: The object already exists.   [status=5010 if_index=15]
Tue Dec 09 17:20:26 2014 Route addition via IPAPI failed [adaptive]
Tue Dec 09 17:20:26 2014 Route addition fallback to route.exe
Tue Dec 09 17:20:26 2014 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\W
INDOWS\System32\Wbem
Tue Dec 09 17:20:26 2014 Initialization Sequence Completed

Where can I get the NAT rules?

Thanks very much.

maikcat

your configs look ok,

Where can I get the NAT rules?

post the output of

iptables -L -v -t nat

probably you will need to add something like:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 1.2.3.4

1.2.3.4 is openvz real ip
eth0 needs to be your lan interface (venet0?)

Michael.

Applier

maikcat wroteyour configs look ok,

Where can I get the NAT rules?

post the output of

iptables -L -v -t nat

probably you will need to add something like:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 1.2.3.4

1.2.3.4 is openvz real ip
eth0 needs to be your lan interface (venet0?)

Michael.

Thank you for the response.

Output of iptables -L -v -t nat :

iptables v1.4.12: can't initialize iptables table `nat': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.

When I try the second command you posted, I get the same error:

iptables v1.4.12: can't initialize iptables table `nat': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.

Apologies, but I googled and couldn't find the solution to this issue. I read somewhere that this is because of OpenVZ? I tried updating iptables but it says that it's up to date.

Thank you for your time!

Traffic

Applier wroteLog of OpenVPN client trying to connect:

Code:
Tue Dec 09 17:19:59 2014 OpenVPN 2.3.2 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO]
[PKCS11] [eurephia] [IPv6] built on Aug 7 2014

Upgrade to latest version 236

maikcat

please talk to your VZ admins,possibly they need to enable iptables on your container.

Michael.

Applier

Traffic wrote
Applier wroteLog of OpenVPN client trying to connect:

Code:
Tue Dec 09 17:19:59 2014 OpenVPN 2.3.2 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO]
[PKCS11] [eurephia] [IPv6] built on Aug 7 2014
Upgrade to latest version 236

Tried that one too, it results in the same issues.

maikcat wroteplease talk to your VZ admins,possibly they need to enable iptables on your container.

Michael.

Ah!! That might be the issue! Thanks, I'll talk to them then update this thread on how it goes.

Applier

maikcat wroteplease talk to your VZ admins,possibly they need to enable iptables on your container.

Michael.

I would NEVER have figured this out on my own!

After getting NAT turned on for my VPS, ran the ezopenVPN script once, and it all went without a hiccup.

Thank you SO very much for your time and help Michael!

maikcat

I would NEVER have figured this out on my own!

After getting NAT turned on for my VPS, ran the ezopenVPN script once, and it all went without a hiccup.

Thank you SO very much for your time and help Michael!

Glad ive helped you out 🙂

Closing topic,

Regards,

Michael.