Can't access internet with my VPN (Admin mode W8.1)

Gyoo

Hello,

Well, it seems that my problem is quite a common one but after seeking several similar topics I couldn't find a solution that must be trivial.
I have an OpenVPN server installed on a VPS hosted by OVH with Ubuntu 14.04 server on it.

When I try to connect my Windows 8.1 client on it, I can access internet with OpenVPN GUI no admin mode, but it doesn't seem to do anything, even websites like http://www.whatismyip.com/ still show my usual IP adress.
It becomes interesting when I try to run OpenVPN GUI on admin mode, because... I can't access internet at all. Every single page is stuck on the hostname resolution and then Chrome tells me I'm not connected to Internet at all.

Here is my server.conf file :

#Serveur TCP/443
mode server
proto tcp
port 443
dev tun
# Cles et certificats
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
tls-auth ta.key 0
cipher AES-256-CBC
# Reseau
server 10.8.0.0 255.255.255.0
push "route 10.8.0.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.4.4"
push "dhcp-option DNS 8.8.8.8"
keepalive 10 120
# Securite
user nobody
group nogroup
chroot /etc/openvpn/jail
persist-key
persist-tun
comp-lzo
# Log
verb 3
mute 20
status openvpn-status.log
log-append /var/log/openvpn.log

And my client.conf :

# Client
client
dev tun
proto tcp-client
remote 92.222.5.180 443
resolv-retry infinite
cipher AES-256-CBC
# Cles
ca ca.crt
cert gyoo.crt
key gyoo.key
tls-auth ta.key 1
# Securite
nobind
persist-key
persist-tun
comp-lzo
verb 3

My logfile when I connect OpenVPN, admin mode :

Sun Jan 18 11:06:50 2015 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec 1 2014
Sun Jan 18 11:06:50 2015 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08
Sun Jan 18 11:06:50 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Sun Jan 18 11:06:50 2015 Need hold release from management interface, waiting...
Sun Jan 18 11:06:50 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Sun Jan 18 11:06:50 2015 MANAGEMENT: CMD 'state on'
Sun Jan 18 11:06:50 2015 MANAGEMENT: CMD 'log all on'
Sun Jan 18 11:06:50 2015 MANAGEMENT: CMD 'hold off'
Sun Jan 18 11:06:50 2015 MANAGEMENT: CMD 'hold release'
Sun Jan 18 11:06:50 2015 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Sun Jan 18 11:06:50 2015 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Sun Jan 18 11:06:50 2015 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jan 18 11:06:50 2015 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jan 18 11:06:50 2015 Socket Buffers: R=[65536->65536] S=[65536->65536]
Sun Jan 18 11:06:50 2015 Attempting to establish TCP connection with [AF_INET]92.222.5.180:443 [nonblock]
Sun Jan 18 11:06:50 2015 MANAGEMENT: >STATE:1421575610,TCP_CONNECT,,,
Sun Jan 18 11:06:51 2015 TCP connection established with [AF_INET]92.222.5.180:443
Sun Jan 18 11:06:51 2015 TCPv4_CLIENT link local: [undef]
Sun Jan 18 11:06:51 2015 TCPv4_CLIENT link remote: [AF_INET]92.222.5.180:443
Sun Jan 18 11:06:51 2015 MANAGEMENT: >STATE:1421575611,WAIT,,,
Sun Jan 18 11:06:52 2015 MANAGEMENT: >STATE:1421575612,AUTH,,,
Sun Jan 18 11:06:52 2015 TLS: Initial packet from [AF_INET]92.222.5.180:443, sid=f133503b e6071353
Sun Jan 18 11:06:53 2015 VERIFY OK: depth=1, C=FR, ST=92, L=BourgLaReine, O=Gyoo, OU=Gyoo, CN=Gyoo CA, name=EasyRSA, emailAddress=gyozell@gmail.com
Sun Jan 18 11:06:53 2015 VERIFY OK: depth=0, C=FR, ST=92, L=BourgLaReine, O=Gyoo, OU=Gyoo, CN=server, name=EasyRSA, emailAddress=gyozell@gmail.com
Sun Jan 18 11:06:54 2015 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sun Jan 18 11:06:54 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jan 18 11:06:54 2015 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sun Jan 18 11:06:54 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jan 18 11:06:54 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sun Jan 18 11:06:54 2015 [server] Peer Connection Initiated with [AF_INET]92.222.5.180:443
Sun Jan 18 11:06:56 2015 MANAGEMENT: >STATE:1421575616,GET_CONFIG,,,
Sun Jan 18 11:06:57 2015 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sun Jan 18 11:06:57 2015 PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.4.4,dhcp-option DNS 8.8.8.8,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Sun Jan 18 11:06:57 2015 OPTIONS IMPORT: timers and/or timeouts modified
Sun Jan 18 11:06:57 2015 OPTIONS IMPORT: --ifconfig/up options modified
Sun Jan 18 11:06:57 2015 OPTIONS IMPORT: route options modified
Sun Jan 18 11:06:57 2015 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sun Jan 18 11:06:57 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Jan 18 11:06:57 2015 MANAGEMENT: >STATE:1421575617,ASSIGN_IP,,10.8.0.6,
Sun Jan 18 11:06:57 2015 open_tun, tt->ipv6=0
Sun Jan 18 11:06:57 2015 TAP-WIN32 device [FrozenWay] opened: \\.\Global\{E9FCE9F8-1EA8-490A-94BD-406673F62CA0}.tap
Sun Jan 18 11:06:57 2015 TAP-Windows Driver Version 9.9
Sun Jan 18 11:06:57 2015 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {E9FCE9F8-1EA8-490A-94BD-406673F62CA0} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Sun Jan 18 11:06:57 2015 Successful ARP Flush on interface [9] {E9FCE9F8-1EA8-490A-94BD-406673F62CA0}
Sun Jan 18 11:07:02 2015 TEST ROUTES: 3/3 succeeded len=2 ret=1 a=0 u/d=up
Sun Jan 18 11:07:02 2015 C:\WINDOWS\system32\route.exe ADD 92.222.5.180 MASK 255.255.255.255 192.168.1.254
Sun Jan 18 11:07:02 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4
Sun Jan 18 11:07:02 2015 Route addition via IPAPI succeeded [adaptive]
Sun Jan 18 11:07:02 2015 C:\WINDOWS\system32\route.exe ADD 192.168.1.254 MASK 255.255.255.255 192.168.1.254 IF 20
Sun Jan 18 11:07:02 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4
Sun Jan 18 11:07:02 2015 Route addition via IPAPI succeeded [adaptive]
Sun Jan 18 11:07:02 2015 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5
Sun Jan 18 11:07:02 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sun Jan 18 11:07:02 2015 Route addition via IPAPI succeeded [adaptive]
Sun Jan 18 11:07:02 2015 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.5
Sun Jan 18 11:07:02 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sun Jan 18 11:07:02 2015 Route addition via IPAPI succeeded [adaptive]
Sun Jan 18 11:07:02 2015 MANAGEMENT: >STATE:1421575622,ADD_ROUTES,,,
Sun Jan 18 11:07:02 2015 C:\WINDOWS\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.5
Sun Jan 18 11:07:02 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sun Jan 18 11:07:02 2015 Route addition via IPAPI succeeded [adaptive]
Sun Jan 18 11:07:02 2015 C:\WINDOWS\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Sun Jan 18 11:07:02 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sun Jan 18 11:07:02 2015 Route addition via IPAPI succeeded [adaptive]
Sun Jan 18 11:07:02 2015 Initialization Sequence Completed
Sun Jan 18 11:07:02 2015 MANAGEMENT: >STATE:1421575622,CONNECTED,SUCCESS,10.8.0.6,92.222.5.180

If you need anything else, I'll be glad to answer. If you also need anything related to linux (I know the basics only), if you could add a few commands so I can do it without looking for the right thing for hours, that'd be very nice of you 🙂

Best regards,
Gyoo.

maikcat

2 things,

1)post your nat rule used on your openvpn server

2)is your VPS a VZ container?

Michael.

Traffic

Gyoo wroteWhen I try to connect my Windows 8.1 client on it, I can access internet with OpenVPN GUI no admin mode

yu can connect to the internet because your VPN connection has failed as OpenVPN requires administrator access to modify routing table ..

Gyoo wroteIt becomes interesting when I try to run OpenVPN GUI on admin mode, because... I can't access internet at all

The client log shows a successful connection .. so have you enabled IP_Forwardiing on the server ?

Gyoo

Hi, sorry for the late reply to your questions :/

1)post your nat rule used on your openvpn server

>iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 10.8.0.0/24 anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

2)is your VPS a VZ container?

I don't see anything related to OpenVZ on my server, neither on the OVH interface.

The client log shows a successful connection .. so have you enabled IP_Forwardiing on the server ?

Yes I did

maikcat

please post the output of:

tracert 8.8.8.8

on your client after the vpn is up.

Michael.

Gyoo

Even if it's in french I guess you can see what's going on here.

The weird thing is, some other services work well, like IRC and skype... it's really just the internet browser it seems.

maikcat

please post the output of:

ifconfig
iptables -L -v
on your openvpn server and please post the exact NAT rule you used.

Michael.

Gyoo

ifconfig wrote ifconfig
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:15023 errors:0 dropped:0 overruns:0 frame:0
TX packets:15023 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1819530 (1.8 MB) TX bytes:1819530 (1.8 MB)

tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:2322 errors:0 dropped:0 overruns:0 frame:0
TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:350825 (350.8 KB) TX bytes:678 (678.0 B)

venet0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:127.0.0.2 P-t-P:127.0.0.2 Bcast:0.0.0.0 Mask:255.255.255.255
inet6 addr: 2001:41d0:52:a00::870/56 Scope:Global
UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1
RX packets:2447338 errors:0 dropped:0 overruns:0 frame:0
TX packets:2315858 errors:0 dropped:10125 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:286791780 (286.7 MB) TX bytes:186837699 (186.8 MB)

venet0:0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:92.222.5.180 P-t-P:92.222.5.180 Bcast:92.222.5.255 Mask:255.255.255.0
UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1

iptables -L -v wrote Chain INPUT (policy ACCEPT 727 packets, 58054 bytes)
pkts bytes target prot opt in out source destination
62958 6225K fail2ban-ssh tcp -- any any anywhere anywhere multiport dports ssh

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 734 packets, 75000 bytes)
pkts bytes target prot opt in out source destination

Chain fail2ban-ssh (1 references)
pkts bytes target prot opt in out source destination
48269 5155K RETURN all -- any any anywhere anywhere

I used the following command when configuring my NAT :

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

maikcat

now we getting somewhere...

venet0:0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:92.222.5.180 P-t-P:92.222.5.180 Bcast:92.222.5.255 Mask:255.255.255.0

your server probably IS VZ container,

because of that your NAT rule is wrong for 2 reasons,

1)you should use venet0:0 as output interface (instead of eth0)

2)the NAT rule for vz based servers is different,

with that in mind please issue:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o venet0:0 -j SNAT --to-source 92.222.5.180

Michael.

Gyoo

Thanks for your suggestion.

I added this NAT rule and made sure the previous one was removed just in case.
Sadly, this is still the same situation : services like IRC or skype seem to work (I can send and receive messages) but still nothing with the internet browser :/

Here is what my iptables -L -v looks like now :

Chain INPUT (policy ACCEPT 566 packets, 74957 bytes)
pkts bytes target prot opt in out source destination
64004 6311K fail2ban-ssh tcp -- any any anywhere anywhere multiport dports ssh

Chain FORWARD (policy ACCEPT 190 packets, 12210 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 547 packets, 48062 bytes)
pkts bytes target prot opt in out source destination

Chain fail2ban-ssh (1 references)
pkts bytes target prot opt in out source destination
17 1248 REJECT all -- any any 115.239.228.34 anywhere reject-with icmp-port-unreachable
49298 5239K RETURN all -- any any anywhere anywhere

maikcat

verify your rule by issuing

iptables -t nat -L -v

also run a tracert 8.8.8.8 from your client and post the output here.

Michael.

Gyoo

iptables -t nat -L -v wroteChain PREROUTING (policy ACCEPT 4197 packets, 175K bytes)
pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 485 packets, 35212 bytes)
pkts bytes target prot opt in out source destination
0 0 SNAT all -- any venet0:0 10.8.0.0/24 anywhere to:92.222.5.180

Chain OUTPUT (policy ACCEPT 423 packets, 31274 bytes)
pkts bytes target prot opt in out source destination

Also I get pretty much the same thing as last time when doing a tracert 8.8.8.8

maikcat

can you verify that ip forwarding is enabled please?

all configuration seems ok.. :S

Michael.

Gyoo

root@vps126935:~# cat /proc/sys/net/ipv4/ip_forward
1

This is confirmed 🙂

This issue is a mystery... don't you think it can come from the configuration files ?

maikcat

can you verify with your vps provider that
they enabled iptables + modules by their side?

after that you can always use wireshark to see packet flow..

Michael.

Gyoo

iptables is installed on all their servers by default.

Shall I need to add more rules to iptables since there's any ? (I guess if there's no rule everything is accepted but who knows)

maikcat

venet interface possibly shows that this is a VZ based container,
if it is indeed some networking stuff is enabled from the host.

Please verify that this is a VZ container and ask your admins
if they need to enable something on their side.

just for reference

http://openvz.org/Using_NAT_for_container_with_private_IPs

Michael.

Gyoo

maikcat wrotevenet interface possibly shows that this is a VZ based container,
if it is indeed some networking stuff is enabled from the host.

Please verify that this is a VZ container and ask your admins
if they need to enable something on their side.

Just got a reply from OVH. Everything is enabled on their side and they confirmed that it should be possible to install OpenVPN with ease.

maikcat

before i run out of ideas i suggest:

1)you remove the chroot directive from your config and retset

2)use tcpdump to capture traffic and see what is going on...

Michael.

Traffic

maikcat wrote2)use tcpdump to capture traffic and see what is going on...

I suggest:

On your server:

tcpdump -n -i venet0:0 icmp

then ping 8.8.8.8 from the client.