2 Problems, Phone issue and Traffic Redirection

jkay

I have created 3 open vpn instances on my server. One is using port 1194 udp with no dns server and no traffic redirection. Works great. The 2nd is port 443 tcp with dns works great. The 3rd is 1195 udp with redirection. I get errors and I'm not sure where I've went wrong.

Here is error log and config

Thu Jan 29 20:07:20 2015 pkcs11_protected_authentication = DISABLED
Thu Jan 29 20:07:20 2015 pkcs11_protected_authentication = DISABLED
Thu Jan 29 20:07:20 2015 pkcs11_protected_authentication = DISABLED
Thu Jan 29 20:07:20 2015 pkcs11_protected_authentication = DISABLED
Thu Jan 29 20:07:20 2015 pkcs11_private_mode = 00000000
Thu Jan 29 20:07:20 2015 pkcs11_private_mode = 00000000
Thu Jan 29 20:07:20 2015 pkcs11_private_mode = 00000000
Thu Jan 29 20:07:20 2015 pkcs11_private_mode = 00000000
Thu Jan 29 20:07:20 2015 pkcs11_private_mode = 00000000
Thu Jan 29 20:07:20 2015 pkcs11_private_mode = 00000000
Thu Jan 29 20:07:20 2015 pkcs11_private_mode = 00000000
Thu Jan 29 20:07:20 2015 pkcs11_private_mode = 00000000
Thu Jan 29 20:07:20 2015 pkcs11_private_mode = 00000000
Thu Jan 29 20:07:20 2015 pkcs11_private_mode = 00000000
Thu Jan 29 20:07:20 2015 pkcs11_private_mode = 00000000
Thu Jan 29 20:07:20 2015 pkcs11_private_mode = 00000000
Thu Jan 29 20:07:20 2015 pkcs11_private_mode = 00000000
Thu Jan 29 20:07:20 2015 pkcs11_private_mode = 00000000
Thu Jan 29 20:07:20 2015 pkcs11_private_mode = 00000000
Thu Jan 29 20:07:20 2015 pkcs11_private_mode = 00000000
Thu Jan 29 20:07:20 2015 pkcs11_cert_private = DISABLED
Thu Jan 29 20:07:20 2015 pkcs11_cert_private = DISABLED
Thu Jan 29 20:07:20 2015 pkcs11_cert_private = DISABLED
Thu Jan 29 20:07:20 2015 pkcs11_cert_private = DISABLED
Thu Jan 29 20:07:20 2015 pkcs11_cert_private = DISABLED
Thu Jan 29 20:07:20 2015 pkcs11_cert_private = DISABLED
Thu Jan 29 20:07:20 2015 pkcs11_cert_private = DISABLED
Thu Jan 29 20:07:20 2015 pkcs11_cert_private = DISABLED
Thu Jan 29 20:07:20 2015 pkcs11_cert_private = DISABLED
Thu Jan 29 20:07:20 2015 pkcs11_cert_private = DISABLED
Thu Jan 29 20:07:20 2015 pkcs11_cert_private = DISABLED
Thu Jan 29 20:07:20 2015 pkcs11_cert_private = DISABLED
Thu Jan 29 20:07:20 2015 pkcs11_cert_private = DISABLED
Thu Jan 29 20:07:20 2015 pkcs11_cert_private = DISABLED
Thu Jan 29 20:07:20 2015 pkcs11_cert_private = DISABLED
Thu Jan 29 20:07:20 2015 pkcs11_cert_private = DISABLED
Thu Jan 29 20:07:20 2015 pkcs11_pin_cache_period = -1
Thu Jan 29 20:07:20 2015 pkcs11_id = '[UNDEF]'
Thu Jan 29 20:07:20 2015 pkcs11_id_management = DISABLED
Thu Jan 29 20:07:20 2015 server_network = 0.0.0.0
Thu Jan 29 20:07:20 2015 server_netmask = 0.0.0.0
Thu Jan 29 20:07:20 2015 server_network_ipv6 = ::
Thu Jan 29 20:07:20 2015 server_netbits_ipv6 = 0
Thu Jan 29 20:07:20 2015 server_bridge_ip = 0.0.0.0
Thu Jan 29 20:07:20 2015 server_bridge_netmask = 0.0.0.0
Thu Jan 29 20:07:20 2015 server_bridge_pool_start = 0.0.0.0
Thu Jan 29 20:07:20 2015 server_bridge_pool_end = 0.0.0.0
Thu Jan 29 20:07:20 2015 ifconfig_pool_defined = DISABLED
Thu Jan 29 20:07:20 2015 ifconfig_pool_start = 0.0.0.0
Thu Jan 29 20:07:20 2015 ifconfig_pool_end = 0.0.0.0
Thu Jan 29 20:07:20 2015 ifconfig_pool_netmask = 0.0.0.0
Thu Jan 29 20:07:20 2015 ifconfig_pool_persist_filename = '[UNDEF]'
Thu Jan 29 20:07:20 2015 ifconfig_pool_persist_refresh_freq = 600
Thu Jan 29 20:07:20 2015 ifconfig_ipv6_pool_defined = DISABLED
Thu Jan 29 20:07:20 2015 ifconfig_ipv6_pool_base = ::
Thu Jan 29 20:07:20 2015 ifconfig_ipv6_pool_netbits = 0
Thu Jan 29 20:07:20 2015 n_bcast_buf = 256
Thu Jan 29 20:07:20 2015 tcp_queue_limit = 64
Thu Jan 29 20:07:20 2015 real_hash_size = 256
Thu Jan 29 20:07:20 2015 virtual_hash_size = 256
Thu Jan 29 20:07:20 2015 client_connect_script = '[UNDEF]'
Thu Jan 29 20:07:20 2015 learn_address_script = '[UNDEF]'
Thu Jan 29 20:07:20 2015 client_disconnect_script = '[UNDEF]'
Thu Jan 29 20:07:20 2015 client_config_dir = '[UNDEF]'
Thu Jan 29 20:07:20 2015 ccd_exclusive = DISABLED
Thu Jan 29 20:07:20 2015 tmp_dir = 'C:\Users\jkay\AppData\Local\Temp\'
Thu Jan 29 20:07:20 2015 push_ifconfig_defined = DISABLED
Thu Jan 29 20:07:20 2015 push_ifconfig_local = 0.0.0.0
Thu Jan 29 20:07:20 2015 push_ifconfig_remote_netmask = 0.0.0.0
Thu Jan 29 20:07:20 2015 push_ifconfig_ipv6_defined = DISABLED
Thu Jan 29 20:07:20 2015 push_ifconfig_ipv6_local = ::/0
Thu Jan 29 20:07:20 2015 push_ifconfig_ipv6_remote = ::
Thu Jan 29 20:07:20 2015 enable_c2c = DISABLED
Thu Jan 29 20:07:20 2015 duplicate_cn = DISABLED
Thu Jan 29 20:07:20 2015 cf_max = 0
Thu Jan 29 20:07:20 2015 cf_per = 0
Thu Jan 29 20:07:20 2015 max_clients = 1024
Thu Jan 29 20:07:20 2015 max_routes_per_client = 256
Thu Jan 29 20:07:20 2015 auth_user_pass_verify_script = '[UNDEF]'
Thu Jan 29 20:07:20 2015 auth_user_pass_verify_script_via_file = DISABLED
Thu Jan 29 20:07:20 2015 client = ENABLED
Thu Jan 29 20:07:20 2015 pull = ENABLED
Thu Jan 29 20:07:20 2015 auth_user_pass_file = '[UNDEF]'
Thu Jan 29 20:07:20 2015 show_net_up = DISABLED
Thu Jan 29 20:07:20 2015 route_method = 0
Thu Jan 29 20:07:20 2015 ip_win32_defined = DISABLED
Thu Jan 29 20:07:20 2015 ip_win32_type = 3
Thu Jan 29 20:07:20 2015 dhcp_masq_offset = 0
Thu Jan 29 20:07:20 2015 dhcp_lease_time = 31536000
Thu Jan 29 20:07:20 2015 tap_sleep = 0
Thu Jan 29 20:07:20 2015 dhcp_options = DISABLED
Thu Jan 29 20:07:20 2015 dhcp_renew = DISABLED
Thu Jan 29 20:07:20 2015 dhcp_pre_release = DISABLED
Thu Jan 29 20:07:20 2015 dhcp_release = DISABLED
Thu Jan 29 20:07:20 2015 domain = '[UNDEF]'
Thu Jan 29 20:07:20 2015 netbios_scope = '[UNDEF]'
Thu Jan 29 20:07:20 2015 netbios_node_type = 0
Thu Jan 29 20:07:20 2015 disable_nbt = DISABLED
Thu Jan 29 20:07:20 2015 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec 1 2014
Thu Jan 29 20:07:20 2015 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08
Thu Jan 29 20:07:20 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25342
Thu Jan 29 20:07:20 2015 Need hold release from management interface, waiting...
Thu Jan 29 20:07:20 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25342
Thu Jan 29 20:07:20 2015 MANAGEMENT: CMD 'state on'
Thu Jan 29 20:07:20 2015 MANAGEMENT: CMD 'log all on'
Thu Jan 29 20:07:20 2015 MANAGEMENT: CMD 'hold off'
Thu Jan 29 20:07:20 2015 MANAGEMENT: CMD 'hold release'
Thu Jan 29 20:07:21 2015 LZO compression initialized
Thu Jan 29 20:07:21 2015 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu Jan 29 20:07:21 2015 Socket Buffers: R=[65536->65536] S=[65536->65536]
Thu Jan 29 20:07:21 2015 MANAGEMENT: >STATE:1422583641,RESOLVE,,,
Thu Jan 29 20:07:21 2015 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Jan 29 20:07:21 2015 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Thu Jan 29 20:07:21 2015 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Thu Jan 29 20:07:21 2015 Local Options hash (VER=V4): '41690919'
Thu Jan 29 20:07:21 2015 Expected Remote Options hash (VER=V4): '530fdded'
Thu Jan 29 20:07:21 2015 UDPv4 link local: [undef]
Thu Jan 29 20:07:21 2015 UDPv4 link remote: [AF_INET]68.***.80.***:1195
Thu Jan 29 20:07:21 2015 MANAGEMENT: >STATE:1422583641,WAIT,,,
Thu Jan 29 20:07:21 2015 UDPv4 WRITE [14] to [AF_INET]68.***.80.***:1195: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Thu Jan 29 20:07:21 2015 UDPv4 READ [0] from [undef]: DATA UNDEF len=-1
Thu Jan 29 20:07:21 2015 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Thu Jan 29 20:07:21 2015 UDPv4 READ [0] from [undef]: DATA UNDEF len=-1
Thu Jan 29 20:07:23 2015 UDPv4 WRITE [14] to [AF_INET]68.1***.80.***:1195: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Thu Jan 29 20:07:23 2015 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Thu Jan 29 20:07:23 2015 UDPv4 READ [0] from [undef]: DATA UNDEF len=-1
Thu Jan 29 20:07:27 2015 UDPv4 WRITE [14] to [AF_INET]68.***.80.***:1195: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Thu Jan 29 20:07:27 2015 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Thu Jan 29 20:07:27 2015 UDPv4 READ [0] from [undef]: DATA UNDEF len=-1

Config

port 1195
proto udp
dev tun
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key  # This file should be kept secret
dh /etc/openvpn/easy-rsa/2.0/keys/dh2048.pem
server 10.30.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS 10.10.1.253"
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 6

The Second issue is on my Samsung S3 I can connect to the network with the first to instances fine and get on my local network, however I cannot get onto the internet. My traffic goes to the openvpn server but external traffic never leaves it. I have flushed the IP tables on the INPUT and still no luck. I have a cisco router 1841 with those ports open as it does connect to openvpn fine. Any ideas? My computer at work has no issues with the internet when connected just my phone.

Thank you!

maikcat

did you forwarded the ports from your router to openvpn server?
also post the output of:

iptables -L -v
iptables -L -v -t nat
lsof -i -P -n

on openvpn server.

Michael.

jkay

Yes on my router I have all 3 ports forwarded to the openvpn server. On a desktop the 1195 and 443 ports work. The 1195 redirection of traffic one does not. On a cell phone I can connect to the first 2 but get no internet.

[root@ovpn admin]# iptables -L -v
Chain INPUT (policy ACCEPT 943K packets, 917M bytes)
pkts bytes target prot opt in out source destination

Chain FORWARD (policy ACCEPT 107K packets, 35M bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 677K packets, 81M bytes)
pkts bytes target prot opt in out source destination

[root@ovpn admin]# iptables -L -v -t nat
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

[root@ovpn admin]# lsof -i -P -n
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
httpd 757 apache 4u IPv6 597493 0t0 TCP *:80 (LISTEN)
httpd 758 apache 4u IPv6 597493 0t0 TCP *:80 (LISTEN)
httpd 759 apache 4u IPv6 597493 0t0 TCP *:80 (LISTEN)
httpd 760 apache 4u IPv6 597493 0t0 TCP *:80 (LISTEN)
httpd 761 apache 4u IPv6 597493 0t0 TCP *:80 (LISTEN)
httpd 762 apache 4u IPv6 597493 0t0 TCP *:80 (LISTEN)
httpd 763 apache 4u IPv6 597493 0t0 TCP *:80 (LISTEN)
httpd 764 apache 4u IPv6 597493 0t0 TCP *:80 (LISTEN)
openvpn 777 nobody 6u IPv4 2349783 0t0 TCP *:443 (LISTEN)
openvpn 790 nobody 6u IPv4 2349826 0t0 UDP *:1194
rpcbind 1448 rpc 6u IPv4 13729 0t0 UDP *:111
rpcbind 1448 rpc 7u IPv4 13731 0t0 UDP *:773
rpcbind 1448 rpc 8u IPv4 13732 0t0 TCP *:111 (LISTEN)
rpcbind 1448 rpc 9u IPv6 13734 0t0 UDP *:111
rpcbind 1448 rpc 10u IPv6 13736 0t0 UDP *:773
rpcbind 1448 rpc 11u IPv6 13737 0t0 TCP *:111 (LISTEN)
mysqld 2038 mysql 10u IPv4 16566 0t0 TCP *:3306 (LISTEN)
httpd 3730 apache 4u IPv6 597493 0t0 TCP *:80 (LISTEN)
httpd 3772 apache 4u IPv6 597493 0t0 TCP *:80 (LISTEN)
httpd 9852 root 4u IPv6 597493 0t0 TCP *:80 (LISTEN)
sshd 9950 root 3r IPv4 2530670 0t0 TCP 10.10.1.249:22->10.28.0.6:52595 (ESTABLISHED)
sshd 9954 admin 3u IPv4 2530670 0t0 TCP 10.10.1.249:22->10.28.0.6:52595 (ESTABLISHED)
rpc.statd 31914 rpcuser 7u IPv4 580532 0t0 UDP *:48911
rpc.statd 31914 rpcuser 8u IPv4 580536 0t0 TCP *:50092 (LISTEN)
rpc.statd 31914 rpcuser 9u IPv4 580528 0t0 UDP 127.0.0.1:717
rpc.statd 31914 rpcuser 10u IPv6 580540 0t0 UDP *:53743
rpc.statd 31914 rpcuser 11u IPv6 580544 0t0 TCP *:49489 (LISTEN)
sshd 32031 root 3u IPv4 581719 0t0 TCP *:22 (LISTEN)
sshd 32031 root 4u IPv6 581721 0t0 TCP *:22 (LISTEN)
cupsd 32061 root 6u IPv6 581913 0t0 TCP [::1]:631 (LISTEN)
cupsd 32061 root 7u IPv4 581914 0t0 TCP 127.0.0.1:631 (LISTEN)
cupsd 32061 root 9u IPv4 581917 0t0 UDP *:631
master 32248 root 12u IPv4 582686 0t0 TCP 127.0.0.1:25 (LISTEN)
ntpd 32363 ntp 16u IPv4 583602 0t0 UDP *:123
ntpd 32363 ntp 17u IPv6 583603 0t0 UDP *:123
ntpd 32363 ntp 18u IPv4 583609 0t0 UDP 127.0.0.1:123
ntpd 32363 ntp 19u IPv4 583610 0t0 UDP 10.10.1.249:123
ntpd 32363 ntp 20u IPv4 2349857 0t0 UDP 10.29.0.1:123
ntpd 32363 ntp 21u IPv6 583612 0t0 UDP [::1]:123
ntpd 32363 ntp 22u IPv6 583613 0t0 UDP [fe80::216:cbff:feaf:b3a7]:123
ntpd 32363 ntp 24u IPv4 2349858 0t0 UDP 10.28.0.1:123
snmpd 32479 root 7u IPv4 585197 0t0 UDP *:161
snmpd 32479 root 8u IPv4 585199 0t0 TCP 127.0.0.1:199 (LISTEN)
[root@ovpn admin]#

Thank you for the help.

Traffic

jkay wrote [root@ovpn admin]# lsof -i -P -n
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
..
openvpn 777 nobody 6u IPv4 2349783 0t0 TCP *:443 (LISTEN)
openvpn 790 nobody 6u IPv4 2349826 0t0 UDP *:1194
..

UDP 1195 is not open ..

maikcat

you also need to perform NAT on traffic destined to internet from
your openvpn clients..

Michael.

jkay

I seem to be having an issue where that instance of openvpn that runs on udp 1195 is not starting. I took my config from one of my other instances and just changed port #'s and ip's and that has worked before. So not sure why this one wouldnt other than it doesn't like the push command to redirect the traffic?

jkay

On the other topic of the phone not working with internet traffic here is my cisco router config.

Building configuration...

Current configuration : 6837 bytes
!
! Last configuration change at 19:12:22 UTC Fri Jan 30 2015 by admin
!
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot system flash:c1841-adventerprisek9-mz.151-3.T4.bin
boot-end-marker
!
!
no logging console
!
no aaa new-model
!
dot11 syslog
ip source-route
!
!
!
!
!
ip cef
ip name-server 8.8.8.8
ip name-server 8.8.4.4
no ipv6 cef
!
multilink bundle-name authenticated
!
crypto pki token default removal timeout 0
!
crypto pki trustpoint TP-self-signed-112413836
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-112413836
revocation-check none
!
!
crypto pki certificate chain TP-self-signed-112413836
certificate self-signed 01
3082022B 30820194 ****0201 02020101 300D0609 2A864886 F70D0101 04050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 31313234 31333833 3635301E 170D3135 30313230 30343035
35335A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 31323431
33383336 3530819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100BAF5 B4C83EB3 91F091F7 FB7B684E 271E58AB 648A903E A8813421 76A81C52
89C2294B 4C619971 9D6B3C94 D64ACA6D 0DBC6E98 B621B68E FC2E6080 72C464FF
1D2525FF 885AB7AB 40DD5990 1B901AF3 C038E4BE D288DE04 01BCCE66 09975C46
98C8D4D6 2A77BEF4 2E9B4DF2 59417BAF ******** 2B4472A7 D31FBDDE 5206E806
CA430203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603
551D2304 18301680 14C9934B C9D41119 E350E485 392B6828 FD7610F0 12301D06
03551D0E 04160414 C9934BC9 D41119E3 50E48539 2B6828FD 7610F012 300D0609
2A864886 F70D0101 04050003 81810048 E680C5A7 9D648252 A0938959 3A53E5B2
4A21FB84 71F30450 1345F128 6ABCF811 05226367 0FCA0219 64B74BD9 306BDF7E
981EB04E CD36156E BACE3156 CFD8F462 C167FED3 56D4CC6E 165EF874 9CF89B51
423DAF33 CF85905D A0E83FE8 1A5AC506 BE727CE9 65AB1E85 594580DE A87BF04E
DA3294A3 FC13BCC0 6AC79DC4 814A5E
quit
!
!
license udi pid CISCO1841 sn FTX143****T
archive
log config
hidekeys
username admin privilege 15 password 0 *************
!
redundancy
!
!
!
class-map type inspect match-any All_Protocols
match protocol tcp
match protocol udp
match protocol icmp
!
!
policy-map type inspect Trusted_to_Internet
class type inspect All_Protocols
inspect
class class-default
drop
!
zone security Trusted
zone security Internet
zone-pair security Trusted->Internet source Trusted destination Internet
service-policy type inspect Trusted_to_Internet
!
!
!
!
!
!
!
interface FastEthernet0/0
description WAN
ip address dhcp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
!
interface FastEthernet0/1
no ip address
duplex auto
speed auto
!
interface FastEthernet0/1.1
description LAN
encapsulation dot1Q 1 native
ip address 10.10.1.253 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface FastEthernet0/1.2
description WIRELESS
encapsulation dot1Q 2
ip address 192.168.2.254 255.255.255.0
ip access-group wifi_block in
ip access-group wifi_block out
ip nat inside
ip virtual-reassembly in
!
interface Serial0/0/0
no ip address
shutdown
!
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
!
!
ip dns server
ip nat inside source static tcp 10.10.1.14 3389 interface FastEthernet0/0 3389
ip nat inside source list NAT interface FastEthernet0/0 overload
ip nat inside source static udp 10.10.1.249 1194 interface FastEthernet0/0 1194
ip nat inside source static udp 10.10.1.249 1195 interface FastEthernet0/0 1195
ip nat inside source static tcp 10.10.1.249 443 interface FastEthernet0/0 443
ip route 10.28.0.0 255.255.255.0 10.10.1.249
ip route 10.29.0.0 255.255.255.0 10.10.1.249
ip route 10.30.0.0 255.255.255.0 10.10.1.249
!
!
ip access-list extended NAT
deny ip 10.10.1.0 0.0.0.255 192.168.2.0 0.0.0.255
deny ip 192.168.2.0 0.0.0.255 10.10.1.0 0.0.0.255
permit ip any any
ip access-list extended wifi_block
deny ip 10.10.1.0 0.0.0.255 192.168.2.0 0.0.0.255
permit ip any any
!
ip sla 1
http get http://freedns.afraid.org/dynamic/update.php?YXRNRVgzN3BrN08******4dVE3aHlhOjEyO*****
ip sla schedule 1 life forever start-time now
logging esm config
!
!
!
!
snmp-server community fast_stats RO
snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart
snmp-server enable traps vrrp
snmp-server enable traps ds1
snmp-server enable traps tty
snmp-server enable traps eigrp
snmp-server enable traps ospf state-change
snmp-server enable traps ospf errors
snmp-server enable traps ospf retransmit
snmp-server enable traps ospf lsa
snmp-server enable traps ospf cisco-specific state-change nssa-trans-change
snmp-server enable traps ospf cisco-specific state-change shamlink interface-old
snmp-server enable traps ospf cisco-specific state-change shamlink neighbor
snmp-server enable traps ospf cisco-specific errors
snmp-server enable traps ospf cisco-specific retransmit
snmp-server enable traps ospf cisco-specific lsa
snmp-server enable traps envmon
snmp-server enable traps flash insertion removal
snmp-server enable traps icsudsu
snmp-server enable traps isdn call-information
snmp-server enable traps isdn layer2
snmp-server enable traps isdn chan-not-avail
snmp-server enable traps isdn ietf
snmp-server enable traps ds0-busyout
snmp-server enable traps ds1-loopback
snmp-server enable traps ethernet cfm cc mep-up mep-down cross-connect loop config
snmp-server enable traps ethernet cfm crosscheck mep-missing mep-unknown service-up
snmp-server enable traps disassociate
snmp-server enable traps deauthenticate
snmp-server enable traps authenticate-fail
snmp-server enable traps dot11-qos
snmp-server enable traps switch-over
snmp-server enable traps rogue-ap
snmp-server enable traps wlan-wep
snmp-server enable traps atm subif
snmp-server enable traps bgp
snmp-server enable traps cnpd
snmp-server enable traps config-copy
snmp-server enable traps config
snmp-server enable traps entity
snmp-server enable traps resource-policy
snmp-server enable traps frame-relay multilink bundle-mismatch
snmp-server enable traps frame-relay
snmp-server enable traps frame-relay subif
snmp-server enable traps hsrp
snmp-server enable traps ipmulticast
snmp-server enable traps msdp
snmp-server enable traps mvpn
snmp-server enable traps pim neighbor-change rp-mapping-change invalid-pim-message
snmp-server enable traps pppoe
!
!
control-plane
!
!
!
line con 0
line aux 0
line vty 0 4
privilege level 15

jkay

Found issue, it was SELinux. That for some reason stopped my 3rd instance from running and my phone from working to access the external network. So that issue is fixed. However I am still unable to redirect my traffic through the vpn.

Any ideas? Here is my config for that one.

port 1195
proto udp
dev tun
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key # This file should be kept secret
dh /etc/openvpn/easy-rsa/2.0/keys/dh2048.pem
server 10.30.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS 10.10.1.253"
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 6

Thank you

maikcat

However I am still unable to redirect my traffic through the vpn.

you still need to enable NAT on your openvpn server so traffic
from this vpn will be NATed when destined to the internet.

Michael.