Can Ping internal network but no Internet Connection

superinterstellar

I have been struggling lately alot with OpenVPN. Have done all kinds of things to fix my OpenVPN connection. Now I am at a stage where my OpenVPN server can be connected to but no internet. I have switched from iptables to ufw just to make things more simplier and to solve this problem. Below are my system outputs:-

Output of UFW

ufw status

Status: active

To                         Action      From
--                         ------      ----
1194/udp                   ALLOW       Anywhere
22/tcp                     ALLOW       Anywhere
80/tcp                     ALLOW       Anywhere
443/tcp                    ALLOW       Anywhere
Anywhere                   ALLOW       10.8.0.0/16
1194/udp (v6)              ALLOW       Anywhere (v6)
22/tcp (v6)                ALLOW       Anywhere (v6)
80/tcp (v6)                ALLOW       Anywhere (v6)
443/tcp (v6)               ALLOW       Anywhere (v6)

Output of server.conf

port 1194
 proto udp
dev tun
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 10.8.0.1"
keepalive 10 120
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log         openvpn.log
verb 4

Output of : /etc/dnsmasq.conf

listen-address=127.0.0.1, 10.8.0.1
bind-interfaces

Output of netstat-anup

netstat -anup

root@server02:/home/admin# netstat -anup
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
udp        0      0 127.0.0.1:53            0.0.0.0:*                           2287/dnsmasq    
udp        0      0 10.8.0.1:53             0.0.0.0:*                           2287/dnsmasq    
udp        0      0 0.0.0.0:1194            0.0.0.0:*                           2248/openvpn

Output of client.conf

client
dev tun
proto udp
remote vpn.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca /ca.crt
cert /client.crt
key /client.key 
comp-lzo
verb 3

I have ipv4 port forwarding turned on too. I still dont understand why there is no traffic. The client does connect to the server but there is no internet. I would really appreciate if someone could advise or help figure out a way to solve this problem. Really appreciate any help.

Thank You
Kev

maikcat

did you enabled NAT?

Michael.

superinterstellar

Hi
I am trying to add this to before.rules in ufw.
I hope this should work. Any advise ?

# START OPENVPN RULES
# NAT table rules
*nat
😛OSTROUTING ACCEPT [0:0]
# Allow traffic from OpenVPN client to eth0
-A POSTROUTING -s 10.8.0.0/8 -o eth0 -j MASQUERADE
COMMIT
# END OPENVPN RULES

superinterstellar

Hi,
I have tried to add the rules but ufw always rejects them. Below is copy of my before.rules file, the below is a section of the last part and the last line is COMMIT but for some reason ufw wont accept this. Could someone tell me why?

*nat
:POSTROUTING ACCEPT [0:0]
# Allow traffic from OpenVPN client to eth0
-A POSTROUTING -s 10.8.0.0/8 -o eth0 -j MASQUERADE


COMMIT

[/code]

maikcat

try this please.

*nat
:POSTROUTING ACCEPT [0:0]
# Allow traffic from OpenVPN client to eth0
iptables -t nat -A POSTROUTING -s 10.8.0.0/8 -o eth0 -j MASQUERADE
COMMIT

superinterstellar

Hi,
I did that and still no internet 🙁

kev$ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
Request timeout for icmp_seq 3
Request timeout for icmp_seq 4

Request timeout for icmp_seq 5
Request timeout for icmp_seq 6
Request timeout for icmp_seq 7
^Z
[1]+  Stopped                 ping 8.8.8.8
kev$ ping 10.8.0.1
PING 10.8.0.1 (10.8.0.1): 56 data bytes
64 bytes from 10.8.0.1: icmp_seq=0 ttl=64 time=338.677 ms
64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=328.837 ms
64 bytes from 10.8.0.1: icmp_seq=2 ttl=64 time=328.804 ms
64 bytes from 10.8.0.1: icmp_seq=3 ttl=64 time=328.428 ms
64 bytes from 10.8.0.1: icmp_seq=4 ttl=64 time=328.948 ms
64 bytes from 10.8.0.1: icmp_seq=5 ttl=64 time=328.480 ms
^Z
[2]+  Stopped                 ping 10.8.0.1

This is the line I added to the /etc/ufw/before.rules :

#*nat
:POSTROUTING ACCEPT [0:0]
# Allow traffic from OpenVPN client to eth0
-A POSTROUTING -s 10.8.0.0/8 -o eth0 -j MASQUERADE
COMMIT

Really appreciate your help. I hope we can fix this . *finger crossed*

maikcat

since ufw uses iptables,can you please run the NAT rule manually?

use iptables -L -t nat

afterwards to see that the rule is enabled.

Michael.

superinterstellar

Hi,

I tried the following and couldn't get through. Could you please help me with configuring iptables manually.


server:/ iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
server:/home/admin# -A POSTROUTING -s 10.8.0.0/8 -o eth0 -j MASQUERADE
bash: -A: command not found
server:/home/admin# iptables -A POSTROUTING -s 10.8.0.0/8 -o eth0 -j MASQUERADE
iptables: No chain/target/match by that name.


[i]@maikacat : Thanks for your support, could you please advise how to add this rule manually. Appreciate it. [/i]

maikcat

this is the correct syntax

iptables -t nat -A POSTROUTING -s 10.8.0.0/8 -o eth0 -j MASQUERADE

Michael.

superinterstellar

Hi Micheal,

I tried it but still no internet connection on the VPN .

root@server02:/home/admin# iptables -t nat -A POSTROUTING -s 10.8.0.0/8 -o eth0 -j MASQUERADE
root@server02:/home/admin# iptables -L -t nat 
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  10.0.0.0/8           anywhere

Could you help me review my configuration and advise how I could troubleshoot this?
Once again thank you very much for helping.

maikcat

what tracert 8.8.8.8 returns? (from your openvpn client).

is your server a VM?
can you post the output of ifconfig?

also the netmask in MASQ rule must be /24 not /8.

Michael.

superinterstellar

Hello,

My output is as follow for traceroute on the VPN client :-

kunals-MacBook-Pro:~ kunal$ traceroute 8.8.8.8
traceroute to 8.8.8.8 (8.8.8.8), 64 hops max, 52 byte packets
 1  * * *
 2  * * *
 3  * * *
 4  * * *
 5  * *^Z
[2]+  Stopped                 traceroute 8.8.8.8
kunals-MacBook-Pro:~ kunal$

The ifconfig output of the server:-

admin@server02:~$ ifconfig
eth0      Link encap:Ethernet  HWaddr 00:16:3e:46:e2:b5  
          inet addr:46.xxx.xxx.xx  Bcast:46.xxx.xxx.xxx  Mask:255.255.252.0
          inet6 addr: -/64 Scope:Link
          inet6 addr: -/64 Scope:Global
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1038079 errors:0 dropped:0 overruns:0 frame:0
          TX packets:672183 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:104529714 (104.5 MB)  TX bytes:98316805 (98.3 MB)
          Interrupt:26 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:3416 errors:0 dropped:0 overruns:0 frame:0
          TX packets:194 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:214278 (214.2 KB)  TX bytes:55363 (55.3 KB)

My server is VPS(I dont think it is a VMware)

How do i change the rule in the iptables from /24 not /8.
My iptables/ufw command skills are poor so i might need little help there. :oops:
Thanks again.

maikcat

lets take some things from the beginning...

first post please your clients log file,
second can you verify if your VPS is VZ container or not? (possibly its not)
third can you please verify if ip forwarding is enabled?

thank you

michael.

superinterstellar

Hi Michael,

Below is the output of my client log.

Client Log

2014-12-11 10:45:42 *Tunnelblick: OS X 10.10.1; Tunnelblick 3.4.1 (build 4054)
2014-12-11 10:45:42 *Tunnelblick: Attempting connection with kev_laptop; Set nameserver = 1; monitoring connection
2014-12-11 10:45:42 *Tunnelblick: openvpnstart start kev_laptop_.tblk 1337 1 0 3 0 16688 -ptADGNWradsgnw 2.3.4
2014-12-11 10:45:42 OpenVPN 2.3.4 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [PKCS11] [MH] [IPv6] built on Oct 15 2014
2014-12-11 10:45:42 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08
2014-12-11 10:45:42 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:1337
2014-12-11 10:45:42 Need hold release from management interface, waiting...
2014-12-11 10:45:42 *Tunnelblick: openvpnstart starting OpenVPN
2014-12-11 10:45:43 *Tunnelblick: openvpnstart log:
     Tunnelblick: 
     OpenVPN started successfully. Command used to start OpenVPN (one argument per displayed line):
     
          /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.3.4/openvpn
          --daemon
          --log
          /Library/Application Support/Tunnelblick/Logs/-SLibrary-SApplication Support-STunnelblick-SShared-Skunal_laptop_gamaya.tblk-SContents-SResources-Sconfig.ovpn.1_0_3_0_16688.1337.openvpn.log
          --cd
          /Library/Application Support/Tunnelblick/Shared/kev_laptop/Contents/Resources
          --config
          /Library/Application Support/Tunnelblick/Shared/kev_laptop/Contents/Resources/config.ovpn
          --cd
          /Library/Application Support/Tunnelblick/Shared/kev_laptop/Contents/Resources
          --management
          127.0.0.1
          1337
          --management-query-passwords
          --management-hold
          --script-security
          2
          --up
          /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -m -w -d -f -ptADGNWradsgnw
          --down
          /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -m -w -d -f -ptADGNWradsgnw

2014-12-11 10:45:43 *Tunnelblick: Established communication with OpenVPN
2014-12-11 10:45:43 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:1337
2014-12-11 10:45:43 MANAGEMENT: CMD 'pid'
2014-12-11 10:45:43 MANAGEMENT: CMD 'state on'
2014-12-11 10:45:43 MANAGEMENT: CMD 'state'
2014-12-11 10:45:43 MANAGEMENT: CMD 'bytecount 1'
2014-12-11 10:45:43 MANAGEMENT: CMD 'hold release'
2014-12-11 10:45:43 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
2014-12-11 10:45:43 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2014-12-11 10:45:43 Socket Buffers: R=[196724->65536] S=[9216->65536]
2014-12-11 10:45:43 MANAGEMENT: >STATE:1418265943,RESOLVE,,,
2014-12-11 10:45:43 UDPv4 link local: [undef]
2014-12-11 10:45:43 UDPv4 link remote: [AF_INET]46.226.108.41:1194
2014-12-11 10:45:43 MANAGEMENT: >STATE:1418265943,WAIT,,,
2014-12-11 10:45:43 MANAGEMENT: >STATE:1418265943,AUTH,,,
2014-12-11 10:45:43 TLS: Initial packet from [AF_INET]46.226.108.41:1194, sid=1e705684 fa5daabf
2014-12-11 10:45:46 VERIFY OK: depth=1, C=FR, ST=LX, L=Luxembourg, O=Foressn, OU=ITUNIT, CN=Fortessn CA, name=EasySRSA, emailAddress=boss@gamaya.net
2014-12-11 10:45:46 VERIFY OK: depth=0, C=FR, ST=LX, L=Luxembourg, O=Fortessn, OU=ITUNIT, CN=server, name=EasyRSA, emailAddress=boss@gamaya.net
2014-12-11 10:45:50 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
2014-12-11 10:45:50 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2014-12-11 10:45:50 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
2014-12-11 10:45:50 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2014-12-11 10:45:50 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
2014-12-11 10:45:50 [server] Peer Connection Initiated with [AF_INET]46.226.108.41:1194
2014-12-11 10:45:51 MANAGEMENT: >STATE:1418265951,GET_CONFIG,,,
2014-12-11 10:45:52 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
2014-12-11 10:45:53 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 10.8.0.1,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
2014-12-11 10:45:53 OPTIONS IMPORT: timers and/or timeouts modified
2014-12-11 10:45:53 OPTIONS IMPORT: --ifconfig/up options modified
2014-12-11 10:45:53 OPTIONS IMPORT: route options modified
2014-12-11 10:45:53 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2014-12-11 10:45:53 Opened utun device utun0
2014-12-11 10:45:53 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
2014-12-11 10:45:53 MANAGEMENT: >STATE:1418265953,ASSIGN_IP,,10.8.0.6,
2014-12-11 10:45:53 /sbin/ifconfig utun0 delete
                                        ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
2014-12-11 10:45:53 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
2014-12-11 10:45:53 /sbin/ifconfig utun0 10.8.0.6 10.8.0.5 mtu 1500 netmask 255.255.255.255 up
2014-12-11 10:45:53 /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -m -w -d -f -ptADGNWradsgnw utun0 1500 1542 10.8.0.6 10.8.0.5 init
                                        **********************************************
                                        Start of output from client.up.tunnelblick.sh
                                        Retrieved from OpenVPN: name server(s) [ 10.8.0.1 ], search domain(s) [  ] and SMB server(s) [  ] and using default domain name [ openvpn ]
                                        Not aggregating ServerAddresses because running on OS X 10.6 or higher
                                        Setting search domains to 'openvpn' because running under OS X 10.6 or higher and the search domains were not set manually and 'Prepend domain name to search domains' was not selected
                                        Saved the DNS and SMB configurations so they can be restored
                                        Set ServerAddresses to 10.8.0.1
                                        Set SearchDomains   to openvpn
                                        Set DomainName       to openvpn
                                        Flushed the DNS cache via dscacheutil
                                        No matching processes were found
                                        mDNSResponder not running. Not notifying it that the DNS cache was flushed
                                        Setting up to monitor system configuration with process-network-changes
                                        End of output from client.up.tunnelblick.sh
                                        **********************************************
2014-12-11 10:45:56 *Tunnelblick: No 'connected.sh' script to execute
2014-12-11 10:45:56 /sbin/route add -net 46.226.108.41 10.174.22.1 255.255.255.255
                                        add net 46.226.108.41: gateway 10.174.22.1
2014-12-11 10:45:56 /sbin/route add -net 0.0.0.0 10.8.0.5 128.0.0.0
                                        add net 0.0.0.0: gateway 10.8.0.5
2014-12-11 10:45:56 /sbin/route add -net 128.0.0.0 10.8.0.5 128.0.0.0
                                        add net 128.0.0.0: gateway 10.8.0.5
2014-12-11 10:45:56 MANAGEMENT: >STATE:1418265956,ADD_ROUTES,,,
2014-12-11 10:45:56 /sbin/route add -net 10.8.0.1 10.8.0.5 255.255.255.255
                                        add net 10.8.0.1: gateway 10.8.0.5
2014-12-11 10:45:56 Initialization Sequence Completed
2014-12-11 10:45:56 MANAGEMENT: >STATE:1418265956,CONNECTED,SUCCESS,10.8.0.6,46.226.108.41
2014-12-11 10:46:01 *Tunnelblick process-network-changes: A system configuration change was ignored
2014-12-11 10:46:11 *Tunnelblick process-network-changes: A system configuration change was ignored
2014-12-11 10:46:31 *Tunnelblick: After 30.0 seconds, gave up trying to fetch IP address information using the ipInfo host's name after connecting.
2014-12-11 10:47:01 *Tunnelblick: After 30.0 seconds, gave up trying to fetch IP address information using the ipInfo host's IP address after connecting.
2014-12-11 10:47:11 *Tunnelblick process-network-changes: A system configuration change was ignored

I am running a a(not sure if this is VZ container) :-

Welcome to Ubuntu 14.04.1 LTS (GNU/Linux 3.10.59-xenU-22-fd09134-x86_64 x86_64)

I think i do have ipforwarding enabled as indicated below in /etc/sysctl.conf (its uncommented)

# Uncomment the next line to enable packet forwarding for IPv4
net.ipv4.ip_forward=1

Thanks
Kevin

maikcat

your client log looks ok,

your VM is xen based

after enabling ip forwarding did you issue a sysctl -p or rebooted the server?

also please post the output of

iptables -L -v

on openvpn server.

Michael.

superinterstellar

Hi Michael,

Below is the output of
# iptables -L -v :-

Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
878K 89M ACCEPT all -- any any anywhere anywhere
0 0 ufw-before-logging-input all -- any any anywhere anywhere
0 0 ufw-before-input all -- any any anywhere anywhere
0 0 ufw-after-input all -- any any anywhere anywhere
0 0 ufw-after-logging-input all -- any any anywhere anywhere
0 0 ufw-reject-input all -- any any anywhere anywhere
0 0 ufw-track-input all -- any any anywhere anywhere

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ufw-before-logging-forward all -- any any anywhere anywhere
0 0 ufw-before-forward all -- any any anywhere anywhere
0 0 ufw-after-forward all -- any any anywhere anywhere
0 0 ufw-after-logging-forward all -- any any anywhere anywhere
0 0 ufw-reject-forward all -- any any anywhere anywhere
0 0 ufw-track-forward all -- any any anywhere anywhere

Chain OUTPUT (policy ACCEPT 162K packets, 23M bytes)
pkts bytes target prot opt in out source destination
750K 101M ufw-before-logging-output all -- any any anywhere anywhere
750K 101M ufw-before-output all -- any any anywhere anywhere
220K 29M ufw-after-output all -- any any anywhere anywhere
220K 29M ufw-after-logging-output all -- any any anywhere anywhere
220K 29M ufw-reject-output all -- any any anywhere anywhere
220K 29M ufw-track-output all -- any any anywhere anywhere

Chain ufw-after-forward (1 references)
pkts bytes target prot opt in out source destination

Chain ufw-after-input (1 references)
pkts bytes target prot opt in out source destination
0 0 ufw-skip-to-policy-input udp -- any any anywhere anywhere udp dpt:netbios-ns
0 0 ufw-skip-to-policy-input udp -- any any anywhere anywhere udp dpt:netbios-dgm
0 0 ufw-skip-to-policy-input tcp -- any any anywhere anywhere tcp dpt:netbios-ssn
0 0 ufw-skip-to-policy-input tcp -- any any anywhere anywhere tcp dpt:microsoft-ds
0 0 ufw-skip-to-policy-input udp -- any any anywhere anywhere udp dpt:bootps
0 0 ufw-skip-to-policy-input udp -- any any anywhere anywhere udp dpt:bootpc
0 0 ufw-skip-to-policy-input all -- any any anywhere anywhere ADDRTYPE match dst-type BROADCAST

Chain ufw-after-logging-forward (1 references)
pkts bytes target prot opt in out source destination

Chain ufw-after-logging-input (1 references)
pkts bytes target prot opt in out source destination
0 0 LOG all -- any any anywhere anywhere limit: avg 3/min burst 10 LOG level warning prefix "[UFW BLOCK] "

Chain ufw-after-logging-output (1 references)
pkts bytes target prot opt in out source destination

Chain ufw-after-output (1 references)
pkts bytes target prot opt in out source destination

Chain ufw-before-forward (1 references)
pkts bytes target prot opt in out source destination
0 0 ufw-user-forward all -- any any anywhere anywhere

Chain ufw-before-input (1 references)
pkts bytes target prot opt in out source destination
0 0 ufw-user-input all -- any any anywhere anywhere

Chain ufw-before-logging-forward (1 references)
pkts bytes target prot opt in out source destination

Chain ufw-before-logging-input (1 references)
pkts bytes target prot opt in out source destination

Chain ufw-before-logging-output (1 references)
pkts bytes target prot opt in out source destination

Chain ufw-before-output (1 references)
pkts bytes target prot opt in out source destination
167K 23M ufw-user-output all -- any any anywhere anywhere

Chain ufw-logging-allow (0 references)
pkts bytes target prot opt in out source destination
0 0 LOG all -- any any anywhere anywhere limit: avg 3/min burst 10 LOG level warning prefix "[UFW ALLOW] "

Chain ufw-logging-deny (0 references)
pkts bytes target prot opt in out source destination
0 0 RETURN all -- any any anywhere anywhere ctstate INVALID limit: avg 3/min burst 10
0 0 LOG all -- any any anywhere anywhere limit: avg 3/min burst 10 LOG level warning prefix "[UFW BLOCK] "

Chain ufw-reject-forward (1 references)
pkts bytes target prot opt in out source destination

Chain ufw-reject-input (1 references)
pkts bytes target prot opt in out source destination

Chain ufw-reject-output (1 references)
pkts bytes target prot opt in out source destination

Chain ufw-skip-to-policy-forward (0 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- any any anywhere anywhere

Chain ufw-skip-to-policy-input (7 references)
pkts bytes target prot opt in out source destination
0 0 DROP all -- any any anywhere anywhere

Chain ufw-skip-to-policy-output (0 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- any any anywhere anywhere

Chain ufw-track-forward (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- any any anywhere anywhere ctstate NEW
0 0 ACCEPT udp -- any any anywhere anywhere ctstate NEW

Chain ufw-track-input (1 references)
pkts bytes target prot opt in out source destination

Chain ufw-track-output (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- any any anywhere anywhere ctstate NEW
5540 417K ACCEPT udp -- any any anywhere anywhere ctstate NEW

Chain ufw-user-forward (1 references)
pkts bytes target prot opt in out source destination

Chain ufw-user-input (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:openvpn
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:http
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:https
0 0 ACCEPT all -- any any 10.8.0.0/16 anywhere

Chain ufw-user-limit (0 references)
pkts bytes target prot opt in out source destination
0 0 LOG all -- any any anywhere anywhere limit: avg 3/min burst 5 LOG level warning prefix "[UFW LIMIT BLOCK] "
0 0 REJECT all -- any any anywhere anywhere reject-with icmp-port-unreachable

Chain ufw-user-limit-accept (0 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- any any anywhere anywhere

Chain ufw-user-logging-forward (0 references)
pkts bytes target prot opt in out source destination

Chain ufw-user-logging-input (0 references)
pkts bytes target prot opt in out source destination

Chain ufw-user-logging-output (0 references)
pkts bytes target prot opt in out source destination

Chain ufw-user-output (1 references)
pkts bytes target prot opt in out source destination

I did reboot several times but not recently , or have i issued a sysctl -p as of yet.
Would you like me to try that ?

Also let me know if you want me to change to iptables, or other kind of firewall, I just had this server setup for getting VPN to work, so feel free to pass any commands. Will be happy to do it as long as the VPN works.

Thanks
Kevin

maikcat

try the following,

stop ufw , add only the NAT rule and try again...

Michael.

superinterstellar

Hi Michael

I tried the following:-

admin# ufw disable
Firewall stopped and disabled on system startup
admin# iptables -t nat -A POSTROUTING -s 10.8.0.0/8 -o eth0 -j MASQUERADE
admin# iptables
iptables v1.4.21: no command specified
Try `iptables -h' or 'iptables --help' for more information.
root@server02:/home/admin# iptalbes -L -v -n
bash: iptalbes: command not found
root@server02:/home/admin# iptables -L -v -n
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 893K   90M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ufw-before-logging-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ufw-before-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ufw-after-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ufw-after-logging-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ufw-reject-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ufw-track-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ufw-before-logging-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ufw-before-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ufw-after-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ufw-after-logging-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ufw-reject-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ufw-track-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT 556 packets, 72414 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 760K  102M ufw-before-logging-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
 760K  102M ufw-before-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
 231K   31M ufw-after-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
 231K   31M ufw-after-logging-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
 231K   31M ufw-reject-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
 231K   31M ufw-track-output  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain ufw-after-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain ufw-after-input (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain ufw-after-logging-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain ufw-after-logging-input (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain ufw-after-logging-output (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain ufw-after-output (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain ufw-before-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain ufw-before-input (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain ufw-before-logging-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain ufw-before-logging-input (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain ufw-before-logging-output (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain ufw-before-output (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain ufw-reject-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain ufw-reject-input (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain ufw-reject-output (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain ufw-track-forward (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain ufw-track-input (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain ufw-track-output (1 references)
 pkts bytes target     prot opt in     out     source               destination         
admin#

I think the best idea is to have the vpn to run on minimal firewall settings, flush all the rules and only insert very basic rules and try to get it to work.

I have a feeling it something very basic that is going wrong.

Let me know what you think.

Thanks
Kev.

maikcat

and with the above setup tracert 8.8.8.8 shows the same output as before?

also the corrected mask should be

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

just a sec,i noticed this:

2014-12-11 10:45:56 /sbin/route add -net 46.226.108.41 10.174.22.1 255.255.255.255
                                        add net 46.226.108.41: gateway 10.174.22.1

what is your clients LAN ip? what netmask?

Michael.

superinterstellar

Hi,

Below is ifconfig output of my client

client$ ifconfig
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
	options=3<RXCSUM,TXCSUM>
	inet6 ::1 prefixlen 128 
	inet 127.0.0.1 netmask 0xff000000 
	inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 
	inet 127.94.0.1 netmask 0xff000000 
	nd6 options=1<PERFORMNUD>
gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
stf0: flags=0<> mtu 1280
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
	ether 80:e6:50:00:ca:92 
	inet6 fe80::82e6:50ff:fe00:ca92%en0 prefixlen 64 scopeid 0x4 
	inet 192.168.1.105 netmask 0xffffff00 broadcast 192.168.1.255
	nd6 options=1<PERFORMNUD>
	media: autoselect
	status: active
en1: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
	options=60<TSO4,TSO6>
	ether 72:00:04:96:de:f0 
	media: autoselect <full-duplex>
	status: inactive
en2: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
	options=60<TSO4,TSO6>
	ether 72:00:04:96:de:f1 
	media: autoselect <full-duplex>
	status: inactive
p2p0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 2304
	ether 02:e6:50:00:ca:92 
	media: autoselect
	status: inactive
awdl0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1452
	ether be:6d:4a:eb:c5:36 
	inet6 fe80::bc6d:4aff:feeb:c536%awdl0 prefixlen 64 scopeid 0x8 
	nd6 options=1<PERFORMNUD>
	media: autoselect
	status: active
bridge0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
	options=63<RXCSUM,TXCSUM,TSO4,TSO6>
	ether 82:e6:50:00:3e:00 
	Configuration:
		id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
		maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
		root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
		ipfilter disabled flags 0x2
	member: en1 flags=3<LEARNING,DISCOVER>
	        ifmaxaddr 0 port 5 priority 0 path cost 0
	member: en2 flags=3<LEARNING,DISCOVER>
	        ifmaxaddr 0 port 6 priority 0 path cost 0
	nd6 options=1<PERFORMNUD>
	media: <unknown type>
	status: inactive
utun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1500
	inet 10.8.0.6 --> 10.8.0.5 netmask 0xffffffff

The client TCP/IP details are as follows:-

IP Addr:192.168.1.105
Subnet: 255.255.255.0
Router: 192.168.1.1

I just ran the following command. Do I need to flush/delete the previous nat command before running this command? I think there is a problem with netmask.

server02:/home/admin# iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE