I have been struggling lately alot with OpenVPN. Have done all kinds of things to fix my OpenVPN connection. Now I am at a stage where my OpenVPN server can be connected to but no internet. I have switched from iptables to ufw just to make things more simplier and to solve this problem. Below are my system outputs:- [b]Output of UFW[/b] [code] ufw status Status: active To Action From -- ------ ---- 1194/udp ALLOW Anywhere 22/tcp ALLOW Anywhere 80/tcp ALLOW Anywhere 443/tcp ALLOW Anywhere Anywhere ALLOW 10.8.0.0/16 1194/udp (v6) ALLOW Anywhere (v6) 22/tcp (v6) ALLOW Anywhere (v6) 80/tcp (v6) ALLOW Anywhere (v6) 443/tcp (v6) ALLOW Anywhere (v6) [/code] [b] Output of server.conf[/b] [code] port 1194 proto udp dev tun ca ca.crt cert server.crt key server.key # This file should be kept secret dh dh2048.pem server 10.8.0.0 255.255.255.0 push "redirect-gateway def1" push "dhcp-option DNS 10.8.0.1" keepalive 10 120 user nobody group nogroup persist-key persist-tun status openvpn-status.log log openvpn.log verb 4[/code] [b]Output of : /etc/dnsmasq.conf[/b] [code] listen-address=127.0.0.1, 10.8.0.1 bind-interfaces [/code] [b]Output of netstat-anup[/b] [code] netstat -anup root@server02:/home/admin# netstat -anup Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name udp 0 0 127.0.0.1:53 0.0.0.0:* 2287/dnsmasq udp 0 0 10.8.0.1:53 0.0.0.0:* 2287/dnsmasq udp 0 0 0.0.0.0:1194 0.0.0.0:* 2248/openvpn [/code] [b]Output of client.conf [/b] [code] client dev tun proto udp remote vpn.com 1194 resolv-retry infinite nobind persist-key persist-tun ca /ca.crt cert /client.crt key /client.key comp-lzo verb 3 [/code] [i] I have ipv4 port forwarding turned on too. I still dont understand why there is no traffic. The client does connect to the server but there is no internet. I would really appreciate if someone could advise or help figure out a way to solve this problem. Really appreciate any help. Thank You Kev [/i]

Hi I am trying to add this to before.rules in ufw. I hope this should work. Any advise ? # START OPENVPN RULES # NAT table rules *nat :POSTROUTING ACCEPT [0:0] # Allow traffic from OpenVPN client to eth0 -A POSTROUTING -s 10.8.0.0/8 -o eth0 -j MASQUERADE COMMIT # END OPENVPN RULES

Hi, I have tried to add the rules but ufw always rejects them. Below is copy of my before.rules file, the below is a section of the last part and the last line is COMMIT but for some reason ufw wont accept this. Could someone tell me why? [code] *nat :POSTROUTING ACCEPT [0:0] # Allow traffic from OpenVPN client to eth0 -A POSTROUTING -s 10.8.0.0/8 -o eth0 -j MASQUERADE COMMIT [/code] [/code]

try this please. [code] *nat :POSTROUTING ACCEPT [0:0] # Allow traffic from OpenVPN client to eth0 iptables -t nat -A POSTROUTING -s 10.8.0.0/8 -o eth0 -j MASQUERADE COMMIT [/code]

Hi, I did that and still no internet :( [code] kev$ ping 8.8.8.8 PING 8.8.8.8 (8.8.8.8): 56 data bytes Request timeout for icmp_seq 0 Request timeout for icmp_seq 1 Request timeout for icmp_seq 2 Request timeout for icmp_seq 3 Request timeout for icmp_seq 4 Request timeout for icmp_seq 5 Request timeout for icmp_seq 6 Request timeout for icmp_seq 7 ^Z [1]+ Stopped ping 8.8.8.8 kev$ ping 10.8.0.1 PING 10.8.0.1 (10.8.0.1): 56 data bytes 64 bytes from 10.8.0.1: icmp_seq=0 ttl=64 time=338.677 ms 64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=328.837 ms 64 bytes from 10.8.0.1: icmp_seq=2 ttl=64 time=328.804 ms 64 bytes from 10.8.0.1: icmp_seq=3 ttl=64 time=328.428 ms 64 bytes from 10.8.0.1: icmp_seq=4 ttl=64 time=328.948 ms 64 bytes from 10.8.0.1: icmp_seq=5 ttl=64 time=328.480 ms ^Z [2]+ Stopped ping 10.8.0.1 [/code] This is the line I added to the /etc/ufw/before.rules : [code] #*nat :POSTROUTING ACCEPT [0:0] # Allow traffic from OpenVPN client to eth0 -A POSTROUTING -s 10.8.0.0/8 -o eth0 -j MASQUERADE COMMIT [/code][i] Really appreciate your help. I hope we can fix this . *finger crossed*[/i]

since ufw uses iptables,can you please run the NAT rule manually? use iptables -L -t nat afterwards to see that the rule is enabled. Michael.

Hi, I tried the following and couldn't get through. Could you please help me with configuring iptables manually. [code] server:/ iptables -L -t nat Chain PREROUTING (policy ACCEPT) target prot opt source destination Chain INPUT (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain POSTROUTING (policy ACCEPT) target prot opt source destination server:/home/admin# -A POSTROUTING -s 10.8.0.0/8 -o eth0 -j MASQUERADE bash: -A: command not found server:/home/admin# iptables -A POSTROUTING -s 10.8.0.0/8 -o eth0 -j MASQUERADE iptables: No chain/target/match by that name. [i]@maikacat : Thanks for your support, could you please advise how to add this rule manually. Appreciate it. [/i] [/code]

this is the correct syntax [code]iptables -t nat -A POSTROUTING -s 10.8.0.0/8 -o eth0 -j MASQUERADE[/code] Michael.

Hi Micheal, I tried it but still no internet connection on the VPN . [code] root@server02:/home/admin# iptables -t nat -A POSTROUTING -s 10.8.0.0/8 -o eth0 -j MASQUERADE root@server02:/home/admin# iptables -L -t nat Chain PREROUTING (policy ACCEPT) target prot opt source destination Chain INPUT (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain POSTROUTING (policy ACCEPT) target prot opt source destination MASQUERADE all -- 10.0.0.0/8 anywhere [/code] [i]Could you help me review my configuration and advise how I could troubleshoot this? Once again thank you very much for helping. [/i]

what tracert 8.8.8.8 returns? (from your openvpn client). is your server a VM? can you post the output of ifconfig? also the netmask in MASQ rule must be /24 not /8. Michael.

Can Ping internal network but no Internet Connection

superinterstellar

Hi,
Just a suggestion.
I think its best to uninstall ufw and just keep iptables.
Flush all the rules on iptables and just have rules for SSH and OpenVPN.

Could you help me come up with the correct syntax rules for doing this?
I think after that it should work.

Please let me know your view.

Thanks once again.
Kevin.

« Previous Page