Can Ping internal network but no Internet Connection

superinterstellar

I have been trying to work around OpenVPN for nearly a week but I keep ending up with same result of no internet and that is frustrating.
Have messed around with the configs, the iptables also and everything. Now I have stopped using iptables and just resorted to using UFW but still cant get the internet to work on my VPN.
I would highly appreciate if someone could shed some light on this.

Below is my ufw output:-

Status: active

To                         Action      From
--                         ------      ----
1194/udp                   ALLOW       Anywhere
22/tcp                     ALLOW       Anywhere
80/tcp                     ALLOW       Anywhere
443/tcp                    ALLOW       Anywhere
Anywhere                   ALLOW       10.8.0.0/16
1194/udp (v6)              ALLOW       Anywhere (v6)
22/tcp (v6)                ALLOW       Anywhere (v6)
80/tcp (v6)                ALLOW       Anywhere (v6)
443/tcp (v6)               ALLOW       Anywhere (v6)

Below is my Server configuration:

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS 10.8.0.1"
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 4

Below is config from client

client 
dev tun
proto udp
remote myvpn.com 1194
resolv-retry infinite
persist-key
persist-tun
ca /ca.crt
cert /client.crt
key /client.key 
comp-lzo
verb 3

Below is output for /etc/dnsmasq/

listen-address=127.0.0.1, 10.8.0.1
bind-interfaces

Below is output for netstat -anup

# netstat -anup
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
udp        0      0 127.0.0.1:53            0.0.0.0:*                           2287/dnsmasq    
udp        0      0 10.8.0.1:53             0.0.0.0:*                           2287/dnsmasq    
udp        0      0 0.0.0.0:1194            0.0.0.0:*                           2248/openvpn

Output for /etc/sysctl.conf :-

 net.ipv4.ip_forward=1

I would highly appreciate if someone could see my config and help solve the problem. I will be grateful for any kind of help here. Please kindly help me!
Thank you very much
Regards
Kevin

Traffic

As you have not posted your OpenVPN log files I will presume that you can connect to the VPN successfully.

Re: No Internet

superinterstellar wroteBelow is my Server configuration:
Code:
...
push "dhcp-option DNS 10.8.0.1"

I see your server is listening on UDP:53 but I do not know enough about dnsmasq to know if it will actually resolve names for your client.

Try using google DNS for your clients like so:

push "dhcp-option DNS 8.8.8.8
push "dhcp-option DNS 8.8.4.4

Re: iptables

superinterstellar wroteNow I have stopped using iptables and just resorted to using UFW

Use iptables and disable ufw, use the following command only in iptables:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

Note: eth0 must be changed to your out going network interface.

Once you get it working you can then use iptables to manage the network security of your server.

A useful test to try once you are connected to your vpn server is (from the client):

traceroute 8.8.8.8

superinterstellar

Hi traffic,
Still having problems with the connection.
Also I am pointing dns to google with following :-
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

This is the server hardware address.

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:8791 errors:0 dropped:0 overruns:0 frame:0
          TX packets:592 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:555695 (555.6 KB)  TX bytes:165001 (165.0 KB)

The log on my system:-

2015-01-06 00:57:27 /sbin/route add -net xx.xxx.xxx.xx 192.168.50.1 255.255.255.255
                                        add net 46.226.108.41: gateway 192.168.50.1
2015-01-06 00:57:27 /sbin/route add -net 0.0.0.0 10.8.0.5 128.0.0.0
                                        add net 0.0.0.0: gateway 10.8.0.5
2015-01-06 00:57:27 /sbin/route add -net 128.0.0.0 10.8.0.5 128.0.0.0
                                        add net 128.0.0.0: gateway 10.8.0.5
2015-01-06 00:57:27 MANAGEMENT: >STATE:1420480647,ADD_ROUTES,,,
2015-01-06 00:57:27 /sbin/route add -net 10.8.0.1 10.8.0.5 255.255.255.255
                                        add net 10.8.0.1: gateway 10.8.0.5
2015-01-06 00:57:27 Initialization Sequence Completed
2015-01-06 00:57:27 MANAGEMENT: >STATE:1420480647,CONNECTED,SUCCESS,10.8.0.6,xx.xxx.xxx.xx
2015-01-06 00:57:27 *Tunnelblick: No 'connected.sh' script to execute
2015-01-06 00:57:32 *Tunnelblick process-network-changes: A system configuration change was ignored

My current iptables rules looks like this:-

#!/bin/sh 

iptables --flush 
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

Please help advise whats the problem.
My server address is : 10.8.0.0 255.255.255.0

Something doesnt makes sense here. I also have ufw uninstalled!
Really baffling. Please help !!

Traffic

I don't know much about tunnelblick .. but this looks bad:

superinterstellar wrote2015-01-06 00:57:27 *Tunnelblick: No 'connected.sh' script to execute
2015-01-06 00:57:32 *Tunnelblick process-network-changes: A system configuration change was ignored

suggest you find out why "connected.sh" is missing (or why it is expected) .. and what was ignored ..

superinterstellar

Hello everyone,

i found the the problem by using the following iptables detail:-


#!/bin/sh 

iptables --flush 
iptables -A INPUT -p udp --dport 1194 -j ACCEPT
iptables -A INPUT -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -j ACCEPT
iptables -A OUTPUT -m state --state NEW -o eth0 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state NEW -o eth0 -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

My server conf is as follows(i basically cleared the entire server.conf and wrote a fresh slate):-

local xx.xxx.xxx.xx
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
persist-key
persist-tun
status openvpn-status.log
verb 3

The only problem I am having now is trying to get the Tomato Router(client) OpenVPN TUN to communicate with the server.
Below is the readings

TUN/TAP read bytes	0
TUN/TAP write bytes	0
TCP/UDP read bytes	4556
TCP/UDP write bytes	4055
Auth read bytes	0
pre-compress bytes	0
post-compress bytes	0
pre-decompress bytes	0
post-decompress bytes	0

Below is the Basic Tomato Router settings

Start with WAN	YES
Interface Type	 TUN 
Protocol	       UDP
Server Address/Port   XXX.COM / 1194	
Firewall	  AUTOMATIC
Authorization Mode	 NONE 
Username/Password Authentication	 DISABLED 
Extra HMAC authorization (tls-auth)	
Create NAT on tunnel	YES

Below is the Advanced Tomato Router settings

Poll Interval	 (in minutes, 0 to disable)
Redirect Internet traffic	YES
Accept DNS configuration	 STRICT
Encryption cipher	 DEFAULT 
Compression	  ENABLED 
TLS Renegotiation Time	 (in seconds, -1 for default) -1
Connection retry	 (in seconds; -1 for infinite)   30
Verify server certificate (tls-remote)	NO

Please help a little more! I really appreciate the help here!
Thanks
Kevin

Traffic

Please post your new server & client logs.

superinterstellar

Hi
Below is my server log

Thu Jan  8 17:54:48 2015 us=592091 124.121.242.157:6984 Re-using SSL/TLS context
Thu Jan  8 17:54:48 2015 us=592117 124.121.242.157:6984 LZO compression initialized
Thu Jan  8 17:54:48 2015 us=592285 124.121.242.157:6984 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu Jan  8 17:54:48 2015 us=592308 124.121.242.157:6984 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Jan  8 17:54:48 2015 us=592357 124.121.242.157:6984 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-serve$
Thu Jan  8 17:54:48 2015 us=592372 124.121.242.157:6984 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2$
Thu Jan  8 17:54:48 2015 us=592401 124.121.242.157:6984 Local Options hash (VER=V4): '530fdded'
Thu Jan  8 17:54:48 2015 us=592422 124.121.242.157:6984 Expected Remote Options hash (VER=V4): '41690919'
Thu Jan  8 17:54:48 2015 us=592470 124.121.242.157:6984 TLS: Initial packet from [AF_INET]124.121.242.157:6984, sid=8fbc6ec5 be928da0
Thu Jan  8 17:54:52 2015 us=666663 124.121.242.157:6984 VERIFY ERROR: depth=0, error=unable to get local issuer certificate: C=TH, ST=TH, L=BKK, O=HOME, OU=ITUNIT, CN=ausus_n66u_darknight_client, name=$
Thu Jan  8 17:54:52 2015 us=666806 124.121.242.157:6984 TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
Thu Jan  8 17:54:52 2015 us=666826 124.121.242.157:6984 TLS Error: TLS object -> incoming plaintext read error
Thu Jan  8 17:54:52 2015 us=666841 124.121.242.157:6984 TLS Error: TLS handshake failed
Thu Jan  8 17:54:52 2015 us=666940 124.121.242.157:6984 SIGUSR1[soft,tls-error] received, client-instance restarting
Thu Jan  8 17:55:15 2015 us=575484 MULTI: multi_create_instance called
Thu Jan  8 17:55:15 2015 us=575611 125.24.164.103:2052 Re-using SSL/TLS context
Thu Jan  8 17:55:15 2015 us=575636 125.24.164.103:2052 LZO compression initialized
Thu Jan  8 17:55:15 2015 us=575771 125.24.164.103:2052 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu Jan  8 17:55:15 2015 us=575792 125.24.164.103:2052 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Jan  8 17:55:15 2015 us=575841 125.24.164.103:2052 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Thu Jan  8 17:55:15 2015 us=575856 125.24.164.103:2052 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,$
Thu Jan  8 17:55:15 2015 us=575886 125.24.164.103:2052 Local Options hash (VER=V4): '530fdded'
Thu Jan  8 17:55:15 2015 us=575908 125.24.164.103:2052 Expected Remote Options hash (VER=V4): '41690919'
Thu Jan  8 17:55:15 2015 us=575957 125.24.164.103:2052 TLS: Initial packet from [AF_INET]125.24.164.103:2052, sid=216b3b9c 57c4c5de
Thu Jan  8 17:55:23 2015 us=409193 125.24.164.103:2052 VERIFY ERROR: depth=0, error=unable to get local issuer certificate: C=, ST=, L=, O=, OU=, CN=__, name=Ea$
Thu Jan  8 17:55:23 2015 us=409342 125.24.164.103:2052 TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
Thu Jan  8 17:55:23 2015 us=409364 125.24.164.103:2052 TLS Error: TLS object -> incoming plaintext read error
Thu Jan  8 17:55:23 2015 us=409479 125.24.164.103:2052 TLS Error: TLS handshake failed
Thu Jan  8 17:55:23 2015 us=409596 125.24.164.103:2052 SIGUSR1[soft,tls-error] received, client-instance restarting

My client config is as follows:

Jan  8 17:55:52 unknown daemon.notice openvpn[2324]: Socket Buffers: R=[112640->131072] S=[112640->131072]
Jan  8 17:55:52 unknown daemon.notice openvpn[2324]: UDPv4 link local: [undef]
Jan  8 17:55:52 unknown daemon.notice openvpn[2324]: UDPv4 link remote: [AF_INET]
Jan  8 17:55:52 unknown daemon.notice openvpn[2324]: TLS: Initial packet from [AF_INET]sid=6d64a154 ba1bd3cb
Jan  8 17:55:54 unknown daemon.notice openvpn[2324]: VERIFY OK: 
Jan  8 17:55:54 unknown daemon.notice openvpn[2324]: VERIFY OK: 
Jan  8 17:56:52 unknown daemon.err openvpn[2324]: TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Jan  8 17:56:52 unknown daemon.err openvpn[2324]: TLS Error: TLS handshake failed
Jan  8 17:56:52 unknown daemon.notice openvpn[2324]: SIGUSR1[soft,tls-error] received, process restarting
Jan  8 17:56:52 unknown daemon.notice openvpn[2324]: Restart pause, 2 second(s)
Jan  8 17:56:54 unknown daemon.warn openvpn[2324]: WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Jan  8 17:56:54 unknown daemon.notice openvpn[2324]: Socket Buffers: R=[112640->131072] S=[112640->131072]
Jan  8 17:56:54 unknown daemon.notice openvpn[2324]: UDPv4 link local: [undef]
Jan  8 17:56:54 unknown daemon.notice openvpn[2324]: UDPv4 link remote: [AF_INET]
Jan  8 17:56:54 unknown daemon.notice openvpn[2324]: TLS: Initial packet from [AF_INET], sid=b674e392 2387f217
Jan  8 17:57:00 unknown daemon.notice openvpn[2324]: VERIFY OK: 
Jan  8 17:57:00 unknown daemon.notice openvpn[2324]: VERIFY OK:

Really appreciate the help!

Traffic

It looks like either: Your PKI is out of sync or You have imported your cert/key pair improperly.

Thu Jan 8 17:55:23 2015 us=409193 125.24.164.103:2052 VERIFY ERROR: depth=0, error=unable to get local issuer certificate: C=, ST=, L=, O=, OU=, CN=__, name=Ea$
Thu Jan 8 17:55:23 2015 us=409342 125.24.164.103:2052 TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned

superinterstellar

Hi
How do i correct this?
My server is running openvpn.

my client OpenVPN is Tomato . Is there a way to fix it?

I just copied and pasted the keys into the OpenVPN client on my Tomato router

maikcat

Thu Jan  8 17:55:23 2015 us=409193 125.24.164.103:2052 VERIFY ERROR: depth=0, error=unable to get local issuer certificate: C=, ST=, L=, O=, OU=, CN=__, name=Ea$

all the fields are blank?
how did you copied the keys?

Michael.

superinterstellar

Hi,
No its not blank. I am just masking the details.

I copied pasted the keys as follows in the respected correct fields for Certificate Authority, Client Certiificate, and Client key.
Not sure why it isnt working on the tomato router.

Could it be because its plain text?

I copied out the encryption file details and pasted in the OpenVPN client settings like below

-----BEGIN CERTIFICATE-----
MIIEwTCCA6mljljljljlkhoiuojljljMIGbMQswC
VEIdH2eljljljlhowefwougreghfdsflgjegoegoeugoubdofibureogiueoiuegoiuvf
-----END CERTIFICATE-----

superinterstellar

Yes. It was a key mistake.
I figured out. Nothing wrong with the machine.
The keys were out of sync.
Tried to make new keys.

Now new error is as follows:-

ERROR: Cannot open TUN/TAP dev /dev/net/tun: No such file or directory (errno=2

Pls help if possible, meanwhile i try googling around