[Solved]OpenVPN works again but still cant connect

superinterstellar

Hello,
I have been really trying hard to get OpenVPN to work lately.
Just redid the entire server on an Ubuntu 12.04 but still getting into some complications.
So really appreciate if someone could walk me through where I am going wrong.

I am posting all the important parts with code below. At the end of th post I have added the client and server log.

I request someone here to help me figure out what is wrong here. I will really appreciate it. Please help me!!

Internet(ifconfig) ---> Firewall(firewall.sh / iptables) ---> OpenVPN Server(server.conf)

Internet / ifconfig

eth0      Link encap:Ethernet  HWaddr 00:16:3e:92:af:f8  
          inet addr:46.xxx.xxx.41  Bcast:46.xxx.xxx.255  Mask:255.255.252.0
          inet6 addr: fe80::216:3eff:fe92:aff8/64 Scope:Link
          inet6 addr: 2001:4b98:dc2:41:216:3eff:fe92:aff8/64 Scope:Global
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:13446 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4498 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:1239327 (1.2 MB)  TX bytes:543928 (543.9 KB)
          Interrupt:26 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:4 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:168 (168.0 B)  TX bytes:168 (168.0 B)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

Output of the firewall file

#!/bin/sh 

iptables --flush 
iptables -A INPUT -p udp --dport 1194 -j ACCEPT
iptables -A INPUT -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -j ACCEPT
iptables -A OUTPUT -m state --state NEW -o eth0 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state NEW -o eth0 -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

Output of the iptables

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    1    42 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:1194
    0     0 ACCEPT     all  --  tun+   *       0.0.0.0/0            0.0.0.0/0           
   13   916 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  tun+   *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  *      eth0    0.0.0.0/0            0.0.0.0/0            state NEW
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED

Chain OUTPUT (policy ACCEPT 9 packets, 1013 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      eth0    0.0.0.0/0            0.0.0.0/0            state NEW

Output of the server.conf

local 46.226.108.41
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
persist-key
persist-tun
status openvpn-status.log
verb 3
comp-lzo

Output of client.


client
dev tun
proto udp
remote domain.net 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca   /NewVPN/ca.crt
cert NewVPN/client1.crt
key  /NewVPN/client1.key 
comp-lzo
verb 3

Client Log

2015-01-21 21:10:01 *Tunnelblick: openvpnstart starting OpenVPN
2015-01-21 21:10:01 *Tunnelblick: OS X 10.10.1; Tunnelblick 3.4.3 (build 4055.4198); prior version 3.4.2 (build 4055.4161)
2015-01-21 21:10:01 *Tunnelblick: Attempting connection with client1 using shadow copy; Set nameserver = 1; monitoring connection
2015-01-21 21:10:01 *Tunnelblick: openvpnstart start client1.tblk 1338 1 0 1 0 16688 -ptADGNWradsgnw 2.3.6
2015-01-21 21:10:02 *Tunnelblick: openvpnstart log:
     Tunnelblick: 
     OpenVPN started successfully. Command used to start OpenVPN (one argument per displayed line):
     
          /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -m -w -d -f -ptADGNWradsgnw
          --down
          /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -m -w -d -f -ptADGNWradsgnw

2015-01-21 21:10:02 *Tunnelblick: Established communication with OpenVPN
2015-01-21 21:10:02 OpenVPN 2.3.6 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [PKCS11] [MH] [IPv6] built on Jan  8 2015
2015-01-21 21:10:02 library versions: OpenSSL 1.0.1k 8 Jan 2015, LZO 2.08
2015-01-21 21:10:02 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:1338
2015-01-21 21:10:02 Need hold release from management interface, waiting...
2015-01-21 21:10:02 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:1338
2015-01-21 21:10:02 MANAGEMENT: CMD 'pid'
2015-01-21 21:10:02 MANAGEMENT: CMD 'state on'
2015-01-21 21:10:02 MANAGEMENT: CMD 'state'
2015-01-21 21:10:02 MANAGEMENT: CMD 'bytecount 1'
2015-01-21 21:10:02 MANAGEMENT: CMD 'hold release'
2015-01-21 21:10:02 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
2015-01-21 21:10:02 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2015-01-21 21:10:02 Socket Buffers: R=[196724->65536] S=[9216->65536]
2015-01-21 21:10:02 MANAGEMENT: >STATE:1421849402,RESOLVE,,,
2015-01-21 21:10:02 UDPv4 link local: [undef]
2015-01-21 21:10:02 UDPv4 link remote: [AF_INET]46.xxx.xxx.41:1194
2015-01-21 21:10:02 MANAGEMENT: >STATE:1421849402,WAIT,,,
2015-01-21 21:10:03 MANAGEMENT: >STATE:1421849403,AUTH,,,
2015-01-21 21:10:03 TLS: Initial packet from [AF_INET]46.xxx.xxx.41:1194, sid=2ec30afb 9fcde6c5
2015-01-21 21:10:15 VERIFY OK: depth=1, C=FR, ST=LX, L=, O=, OU=IT, CN=, name=, emailAddress=.net
2015-01-21 21:10:15 VERIFY OK: depth=0, C=FR, ST=LX, L=, O=, OU=IT, CN=, name=, emailAddress=@
2015-01-21 21:10:27 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
2015-01-21 21:10:27 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2015-01-21 21:10:27 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
2015-01-21 21:10:27 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2015-01-21 21:10:30 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
2015-01-21 21:10:30 [GAMAYA] Peer Connection Initiated with [AF_INET]46.xxx.xxx.41:1194
2015-01-21 21:10:31 MANAGEMENT: >STATE:1421849431,GET_CONFIG,,,
2015-01-21 21:10:32 SENT CONTROL [GAMAYA]: 'PUSH_REQUEST' (status=1)
2015-01-21 21:10:33 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
2015-01-21 21:10:33 OPTIONS IMPORT: timers and/or timeouts modified
2015-01-21 21:10:33 OPTIONS IMPORT: --ifconfig/up options modified
2015-01-21 21:10:33 OPTIONS IMPORT: route options modified
2015-01-21 21:10:33 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2015-01-21 21:10:33 Opened utun device utun0
2015-01-21 21:10:33 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
2015-01-21 21:10:33 MANAGEMENT: >STATE:1421849433,ASSIGN_IP,,10.8.0.6,
2015-01-21 21:10:33 /sbin/ifconfig utun0 delete
                                        ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
2015-01-21 21:10:33 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
2015-01-21 21:10:33 /sbin/ifconfig utun0 10.8.0.6 10.8.0.5 mtu 1500 netmask 255.255.255.255 up
2015-01-21 21:10:33 /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -m -w -d -f -ptADGNWradsgnw utun0 1500 1542 10.8.0.6 10.8.0.5 init
                                        **********************************************
                                        Start of output from client.up.tunnelblick.sh
                                        Retrieved from OpenVPN: name server(s) [ 8.8.8.8 8.8.4.4 ], search domain(s) [  ] and SMB server(s) [  ] and using default domain name [ openvpn ]
                                        Not aggregating ServerAddresses because running on OS X 10.6 or higher
                                        Setting search domains to 'openvpn' because running under OS X 10.6 or higher and the search domains were not set manually and 'Prepend domain name to search domains' was not selected
                                        Saved the DNS and SMB configurations so they can be restored
                                        Set ServerAddresses to 8.8.8.8 8.8.4.4
                                        Set SearchDomains   to openvpn
                                        Set DomainName       to openvpn
                                        Flushed the DNS cache via dscacheutil
                                        No matching processes were found
                                        mDNSResponder not running. Not notifying it that the DNS cache was flushed
                                        Setting up to monitor system configuration with process-network-changes
                                        End of output from client.up.tunnelblick.sh
                                        **********************************************
2015-01-21 21:10:36 /sbin/route add -net 46.xxx.xxx.41 192.168.50.1 255.255.255.255
                                        add net 46.xxx.xxx.41: gateway 192.168.50.1
2015-01-21 21:10:36 /sbin/route add -net 0.0.0.0 10.8.0.5 128.0.0.0
                                        add net 0.0.0.0: gateway 10.8.0.5
2015-01-21 21:10:36 /sbin/route add -net 128.0.0.0 10.8.0.5 128.0.0.0
                                        add net 128.0.0.0: gateway 10.8.0.5
2015-01-21 21:10:36 MANAGEMENT: >STATE:1421849436,ADD_ROUTES,,,
2015-01-21 21:10:36 /sbin/route add -net 10.8.0.1 10.8.0.5 255.255.255.255
                                        add net 10.8.0.1: gateway 10.8.0.5
2015-01-21 21:10:36 Initialization Sequence Completed
2015-01-21 21:10:36 MANAGEMENT: >STATE:1421849436,CONNECTED,SUCCESS,10.8.0.6,46.xxx.xxx.41
2015-01-21 21:10:36 *Tunnelblick: No 'connected.sh' script to execute
2015-01-21 21:10:41 *Tunnelblick process-network-changes: A system configuration change was ignored
2015-01-21 21:10:53 *Tunnelblick process-network-changes: A system configuration change was ignored

Client log output:-

Jan 21 15:14:31 server02 ovpn-server[1344]: 124.121.242.157:33861 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Jan 21 15:14:31 server02 ovpn-server[1344]: 124.121.242.157:33861 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Jan 21 15:14:31 server02 ovpn-server[1344]: 124.121.242.157:33861 Local Options hash (VER=V4): '530fdded'
Jan 21 15:14:31 server02 ovpn-server[1344]: 124.121.242.157:33861 Expected Remote Options hash (VER=V4): '41690919'
Jan 21 15:14:31 server02 ovpn-server[1344]: 124.121.242.157:33861 TLS: Initial packet from [AF_INET]124.121.242.157:33861, sid=638dbce6 8a701abb
Jan 21 15:14:31 server02 ovpn-server[1344]: read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Jan 21 15:14:33 server02 ovpn-server[1344]: 124.121.242.157:15512 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network co$
Jan 21 15:14:33 server02 ovpn-server[1344]: 124.121.242.157:15512 TLS Error: TLS handshake failed
Jan 21 15:14:33 server02 ovpn-server[1344]: 124.121.242.157:15512 SIGUSR1[soft,tls-error] received, client-instance restarting
Jan 21 15:14:33 server02 ovpn-server[1344]: read UDPv4 [ECONNREFUSED|ECONNREFUSED|ECONNREFUSED]: Connection refused (code=111)
Jan 21 15:14:34 server02 ovpn-server[1344]: read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Jan 21 15:14:34 server02 ovpn-server[1344]: read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Jan 21 15:14:35 server02 ovpn-server[1344]: read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Jan 21 15:14:35 server02 ovpn-server[1344]: read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Jan 21 15:14:37 server02 ovpn-server[1344]: 124.121.242.157:46390 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network co$
Jan 21 15:14:37 server02 ovpn-server[1344]: 124.121.242.157:46390 TLS Error: TLS handshake failed
Jan 21 15:14:37 server02 ovpn-server[1344]: 124.121.242.157:46390 SIGUSR1[soft,tls-error] received, client-instance restarting
Jan 21 15:14:37 server02 ovpn-server[1344]: read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Jan 21 15:14:38 server02 ovpn-server[1344]: 101.108.8.120:2075 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network conne$
Jan 21 15:14:38 server02 ovpn-server[1344]: 101.108.8.120:2075 TLS Error: TLS handshake failed
Jan 21 15:14:38 server02 ovpn-server[1344]: 101.108.8.120:2075 SIGUSR1[soft,tls-error] received, client-instance restarting
Jan 21 15:14:38 server02 ovpn-server[1344]: read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Jan 21 15:14:38 server02 ovpn-server[1344]: read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Jan 21 15:14:38 server02 ovpn-server[1344]: MULTI: multi_create_instance called
Jan 21 15:14:38 server02 ovpn-server[1344]: 124.121.242.157:44648 Re-using SSL/TLS context
Jan 21 15:14:38 server02 ovpn-server[1344]: 124.121.242.157:44648 LZO compression initialized
Jan 21 15:14:38 server02 ovpn-server[1344]: 124.121.242.157:44648 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Jan 21 15:14:38 server02 ovpn-server[1344]: 124.121.242.157:44648 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Jan 21 15:14:38 server02 ovpn-server[1344]: 124.121.242.157:44648 Local Options hash (VER=V4): '530fdded'
Jan 21 15:14:38 server02 ovpn-server[1344]: 124.121.242.157:44648 Expected Remote Options hash (VER=V4): '41690919'

maikcat

i want to try to help you but...

Just redid the entire server on an Ubuntu 12.04 but still getting into some complications.

complications? like what? what isnt working?

your first client log has 2015-01-21 21:10:01 time stamp

your client log output (server maybe) has Jan 21 15:14:31 time stamp

can you verify/clarify the above info please?

Michael.

superinterstellar

Time difference in location.
My server and client are not in same region. 6hrs difference.

superinterstellar

No internet.
It connects but no internet.
Could you pls see the config and tell me if you can spot something wrong.

superinterstellar

My client machine has added this route:-

/sbin/route add -net 10.8.0.1 10.8.0.5 255.255.255.255

But my iptable subnet suggests:-

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

And my server.conf suggests:-

server 10.8.0.0 255.255.255.0

Please advise / help!

maikcat

dont hurry!

post the output of:

netstat -nr on your client,
tracert 8.8.8.8 on your client,

if tracert shows that traffic flows via vpn then it may be DNS issue.

Michael.

superinterstellar

Hey,

Thanks for your input.Sorry for being in a little bit of a hurry but I need to have this config soon.
Really appreciate if you could list some key diagnostic tools/commands to ensure traffic is flowing correctly so that I could pinpoint the problem .

Output from client

netstat -nr
Routing tables

Internet:
Destination        Gateway            Flags        Refs      Use   Netif Expire
0/1                10.8.0.5           UGSc            5        0   utun0
default            192.168.50.6       UGSc            8        0     en0
10.8.0.1/32        10.8.0.5           UGSc            0        0   utun0
10.8.0.5           10.8.0.6           UHr             9        0   utun0
46.226.108.41/32   192.168.50.6       UGSc            1        0     en0
127                127.0.0.1          UCS             0        0     lo0
127.0.0.1          127.0.0.1          UH              3     2848     lo0
127.94.0.1         127.94.0.1         UH              0        0     lo0
128.0/1            10.8.0.5           UGSc            1        0   utun0
169.254            link#4             UCS             0        0     en0
192.168.50         link#4             UCS             2        0     en0
192.168.50.6/32    link#4             UCS             1        0     en0
192.168.50.6       c8:b3:73:31:27:34  UHLWIir         4     1102     en0   1176
192.168.50.165/32  link#4             UCS             1        0     en0
192.168.50.178     c:84:dc:cc:bc:c2   UHLWI           0        0     en0   1195
192.168.50.255     ff:ff:ff:ff:ff:ff  UHLWbI          0       43     en0

Internet6:
Destination                             Gateway                         Flags         Netif Expire
::1                                     ::1                             UHL             lo0
fe80::%lo0/64                           fe80::1%lo0                     UcI             lo0
fe80::1%lo0                             link#1                          UHLI            lo0
fe80::%en0/64                           link#4                          UCI             en0
fe80::82e6:50ff:fe00:ca92%en0           80:e6:50:0:ca:92                UHLI            lo0
fe80::%awdl0/64                         link#8                          UCI           awdl0
fe80::288a:56ff:fec6:f0b0%awdl0         2a:8a:56:c6:f0:b0               UHLI            lo0
ff01::%lo0/32                           ::1                             UmCI            lo0
ff01::%en0/32                           link#4                          UmCI            en0
ff01::%awdl0/32                         link#8                          UmCI          awdl0
ff02::%lo0/32                           ::1                             UmCI            lo0
ff02::%en0/32                           link#4                          UmCI            en0
ff02::%awdl0/32                         link#8                          UmCI          awdl0

This is output of the traceroute command on client.

traceroute 8.8.8.8
traceroute to 8.8.8.8 (8.8.8.8), 64 hops max, 52 byte packets
 1  * * *
 2  * * *
 3  * * *

Please help and/or advise some good diagnostic commands/tools to fix this. I really appreciate your help/feedback. Thank you!

Regards
Kevin

superinterstellar

Hi,
Server can ping to client as follows:-

ping 10.8.0.6
PING 10.8.0.6 (10.8.0.6) 56(84) bytes of data.
64 bytes from 10.8.0.6: icmp_req=1 ttl=64 time=509 ms
64 bytes from 10.8.0.6: icmp_req=2 ttl=64 time=522 ms
64 bytes from 10.8.0.6: icmp_req=3 ttl=64 time=409 ms
64 bytes from 10.8.0.6: icmp_req=4 ttl=64 time=395 ms
64 bytes from 10.8.0.6: icmp_req=5 ttl=64 time=465 ms
64 bytes from 10.8.0.6: icmp_req=6 ttl=64 time=401 ms
64 bytes from 10.8.0.6: icmp_req=7 ttl=64 time=413 ms
64 bytes from 10.8.0.6: icmp_req=8 ttl=64 time=432 ms
64 bytes from 10.8.0.6: icmp_req=9 ttl=64 time=395 ms
64 bytes from 10.8.0.6: icmp_req=10 ttl=64 time=481 ms
64 bytes from 10.8.0.6: icmp_req=11 ttl=64 time=704 ms
64 bytes from 10.8.0.6: icmp_req=12 ttl=64 time=402 ms
64 bytes from 10.8.0.6: icmp_req=13 ttl=64 time=409 ms
64 bytes from 10.8.0.6: icmp_req=14 ttl=64 time=396 ms
64 bytes from 10.8.0.6: icmp_req=15 ttl=64 time=490 ms
64 bytes from 10.8.0.6: icmp_req=16 ttl=64 time=396 ms
64 bytes from 10.8.0.6: icmp_req=17 ttl=64 time=445 ms
64 bytes from 10.8.0.6: icmp_req=18 ttl=64 time=405 ms
64 bytes from 10.8.0.6: icmp_req=19 ttl=64 time=394 ms
64 bytes from 10.8.0.6: icmp_req=20 ttl=64 time=502 ms
64 bytes from 10.8.0.6: icmp_req=21 ttl=64 time=395 ms
64 bytes from 10.8.0.6: icmp_req=22 ttl=64 time=518 ms
64 bytes from 10.8.0.6: icmp_req=23 ttl=64 time=639 ms
64 bytes from 10.8.0.6: icmp_req=24 ttl=64 time=568 ms
64 bytes from 10.8.0.6: icmp_req=25 ttl=64 time=411 ms

Client utun0 output below:-

utun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1500
	inet 10.8.0.6 --> 10.8.0.5 netmask 0xffffffff

Not sure if netmask and ip addr is correct. Please advise .
Thanks

maikcat

did you enabled ip forwarding on server?

also post the output of:

iptables -L -t nat -v

on your openvpn server.

next you will have to use wireshark...

Michael.

superinterstellar

Hi,

Output of iptables -L -t nat -v

 iptables -L -t nat -v 
Chain PREROUTING (policy ACCEPT 33038 packets, 1715K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 30437 packets, 1533K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 12527 packets, 913K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 12527 packets, 913K bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MASQUERADE  all  --  any    eth0    10.8.0.0/24          anywhere

Do you mean tcpdump or wireshark? I dont think i can remotely wireshark (from what I read/heard)
Please help advise on this.

Thanks so much!
Kevin

maikcat

wireshark,
cant you run a vnc session?

Michael.

superinterstellar

I could do wireshark if it's really needed.
I would have to install vnc too to have it working.
Will we be able to accurately troubleshoot the problem with wireshark?
If yes, will add wireshark & vnc.
Thanks
Kevin

superinterstellar

Hi

Would this do it:
http://blog.jasonantman.com/2011/04/using-wireshark-to-capture-packets-from-a-remote-host/

Or this command
Terminal - analyze traffic remotely over ssh w/ wireshark
ssh root@server.com 'tshark -f "port !22" -w -' | wireshark -k -i -

Pls advise.
Thanks

maikcat

can you please answer if ip forwarding is enabled?

yes the above link should do.

Michael.

superinterstellar

hi michael,
it works!!!
thank you so much for your time and help. really appreciate it!

server02: echo 1 > /proc/sys/net/ipv4/ip_forward
server02:echo 1 > /proc/sys/net/ipv4/ip_forward
server02:nano -w /etc/sysctl.conf
server02:sysctl -p
net.ipv4.ip_forward = 1
server02:service openvpn start
 * Starting virtual private network daemon(s)...                                          *   Autostarting VPN 'server'

After starting up. The vpn connection worked. Thanks alot!

Regards
Kevin

maikcat

superinterstellar wrotehi michael,
it works!!!
thank you so much for your time and help. really appreciate it!

Nice to know 😃

Marked as solved,
closing topic

regards,

Michael.