OpenVPN Does not Route all Traffic.. and Shows real IP

privacy666

Hello , First im sorry for my very bad english
i made a OpenVPN Server from this tutorial here : https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-ubuntu-14-04
Its working fine! without any problem and http://www.myip.is shows the IP of my Ukrain Server ! thats ok
but the big Problem is now https://diafygi.github.io/webrtc-ips/ theese test Shows My REAL Public IP Adress : http://puu.sh/fxFnZ/b39bfb1b6d.jpg
and when i try to watch a Video on Youtube .. Youtube detects my Real ip adress and block the video in my Country Germany

So what is wrong ?
Is the tutorial not correct ?
or does the server not route the Traffic correctly ? i hope realy u can help me guys

here is my server.conf when u need more informations let me know

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 10.8.0.1"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3

maikcat

can you post the output of tracert 8.8.8.8 from your client?

can you also post the output of

iptables -L -t nat

on your server (if it runs linux)?

Michael.

privacy666

Yes its Linux (Ubuntu 14.04) and here is the output : http://puu.sh/fxJpX/8938cdb739.jpg

privacy666

theese forum blocks my new posts.. i cant answer u

maikcat

your posts need approval by mods they dont blocked,

you can always copy paste output here,

flush your tables and use only ONE NAT rule.

also please post the rule used and the output or tracert requested..

Michael.

privacy666

ah okay ,

I have flush my iptables but what u mean with one NAT rule ?
can u give me a example and how i do this tracert sorry i'm a noob.

maikcat

post the iptables command you runed on openvpn server,

also on your client open a cmd and run

tracert 8.8.8.8

post the output here...

Michael.

privacy666

I Have use this command :

nano /etc/ufw/before.rules

and have put following informations in it :

# START OPENVPN RULES
# NAT table rules
*nat
:POSTROUTING ACCEPT [0:0] 
# Allow traffic from OpenVPN client to eth0
-A POSTROUTING -s 10.8.0.0/8 -o eth0 -j MASQUERADE
COMMIT
# END OPENVPN RULES

i open a cmd and run tracert 8.8.8.8

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. Alle Rechte vorbehalten.

C:\Users\Haze>tracert 8.8.8.8

Routenverfolgung zu google-public-dns-a.google.com [8.8.8.8] über maximal 30 Abs
chnitte:

  1    94 ms    93 ms    96 ms  10.8.0.1
  2    94 ms    94 ms    95 ms  hosted-by.blazingfast.io [185.61.137.97]
  3    94 ms    94 ms    94 ms  gw01-kie1.blazingfast.io [185.61.137.1]
  4    94 ms    97 ms    95 ms  dtel-ix.google.com [193.25.180.164]
  5   154 ms   153 ms   154 ms  209.85.252.123
  6   286 ms   281 ms   166 ms  209.85.249.175
  7   153 ms   154 ms   155 ms  216.239.46.9
  8     *        *        *     Zeitüberschreitung der Anforderung.
  9   154 ms   154 ms   154 ms  google-public-dns-a.google.com [8.8.8.8]

Ablaufverfolgung beendet.

maikcat

your config looks ok,

if you perform a tracert www.youtube.com what it shows?

can you post the output of

netstat -nr

on your client after the vpn is up?

Michael.

privacy666

outpost of tracert :

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. Alle Rechte vorbehalten.

C:\Users\Haze>tracert www.youtube.com

Routenverfolgung zu youtube-ui.l.google.com [173.194.112.132] über maximal 30 Ab
schnitte:

  1    94 ms    99 ms    95 ms  10.8.0.1
  2    96 ms    94 ms    96 ms  hosted-by.blazingfast.io [185.61.137.97]
  3    95 ms    95 ms    95 ms  gw01-kie1.blazingfast.io [185.61.137.1]
  4    96 ms    96 ms    93 ms  dtel-ix.google.com [193.25.180.164]
  5   133 ms   133 ms   161 ms  209.85.245.223
  6   134 ms   133 ms   137 ms  72.14.236.223
  7   132 ms   133 ms   134 ms  fra07s31-in-f4.1e100.net [173.194.112.132]

Ablaufverfolgung beendet.

C:\Users\Haze>

and the netstat -nr output after my vpn is starting:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. Alle Rechte vorbehalten.

C:\Users\Haze>netstat -nr
===========================================================================
Schnittstellenliste
 27...00 ff ad 4e 27 cf ......TAP-Windows Adapter V9
 24...00 ff 12 8b a3 9d ......TAP-Win32 Adapter V9 (Tunngle)
 14...74 27 ea 0d ea c5 ......Realtek PCIe GBE Family Controller
 12...08 00 27 00 54 b5 ......VirtualBox Host-Only Ethernet Adapter
  1...........................Software Loopback Interface 1
 17...00 00 00 00 00 00 00 e0 Microsoft-ISATAP-Adapter
 11...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
 19...00 00 00 00 00 00 00 e0 Microsoft-ISATAP-Adapter #2
 13...00 00 00 00 00 00 00 e0 Microsoft-ISATAP-Adapter #3
 20...00 00 00 00 00 00 00 e0 Microsoft-ISATAP-Adapter #4
===========================================================================

IPv4-Routentabelle
===========================================================================
Aktive Routen:
     Netzwerkziel    Netzwerkmaske          Gateway    Schnittstelle Metrik
          0.0.0.0          0.0.0.0      192.168.1.1      192.168.1.5     20
          0.0.0.0        128.0.0.0         10.8.0.5         10.8.0.6     30
         10.8.0.1  255.255.255.255         10.8.0.5         10.8.0.6     30
         10.8.0.4  255.255.255.252   Auf Verbindung          10.8.0.6    286
         10.8.0.6  255.255.255.255   Auf Verbindung          10.8.0.6    286
         10.8.0.7  255.255.255.255   Auf Verbindung          10.8.0.6    286
        127.0.0.0        255.0.0.0   Auf Verbindung         127.0.0.1    306
        127.0.0.1  255.255.255.255   Auf Verbindung         127.0.0.1    306
  127.255.255.255  255.255.255.255   Auf Verbindung         127.0.0.1    306
        128.0.0.0        128.0.0.0         10.8.0.5         10.8.0.6     30
   185.61.137.116  255.255.255.255      192.168.1.1      192.168.1.5     20
      192.168.1.0    255.255.255.0   Auf Verbindung       192.168.1.5    276
      192.168.1.5  255.255.255.255   Auf Verbindung       192.168.1.5    276
    192.168.1.255  255.255.255.255   Auf Verbindung       192.168.1.5    276
     192.168.56.0    255.255.255.0   Auf Verbindung      192.168.56.1    276
     192.168.56.1  255.255.255.255   Auf Verbindung      192.168.56.1    276
   192.168.56.255  255.255.255.255   Auf Verbindung      192.168.56.1    276
        224.0.0.0        240.0.0.0   Auf Verbindung         127.0.0.1    306
        224.0.0.0        240.0.0.0   Auf Verbindung      192.168.56.1    276
        224.0.0.0        240.0.0.0   Auf Verbindung       192.168.1.5    276
        224.0.0.0        240.0.0.0   Auf Verbindung          10.8.0.6    286
  255.255.255.255  255.255.255.255   Auf Verbindung         127.0.0.1    306
  255.255.255.255  255.255.255.255   Auf Verbindung      192.168.56.1    276
  255.255.255.255  255.255.255.255   Auf Verbindung       192.168.1.5    276
  255.255.255.255  255.255.255.255   Auf Verbindung          10.8.0.6    286
===========================================================================
Ständige Routen:
  Keine

IPv6-Routentabelle
===========================================================================
Aktive Routen:
 If Metrik Netzwerkziel             Gateway
  1    306 ::1/128                  Auf Verbindung
 12    276 fe80::/64                Auf Verbindung
 14    276 fe80::/64                Auf Verbindung
 27    286 fe80::/64                Auf Verbindung
 14    276 fe80::3d4d:c5ff:a2f9:204f/128
                                    Auf Verbindung
 27    286 fe80::404e:230b:e846:91b2/128
                                    Auf Verbindung
 12    276 fe80::6dde:5fb4:4397:f52c/128
                                    Auf Verbindung
  1    306 ff00::/8                 Auf Verbindung
 12    276 ff00::/8                 Auf Verbindung
 14    276 ff00::/8                 Auf Verbindung
 27    286 ff00::/8                 Auf Verbindung
===========================================================================
Ständige Routen:
  Keine

C:\Users\Haze>

maikcat

your tracert shows that you accessing youtube via your vpn tunnel.

what exactly is the problem?

Michael.

privacy666

here so it looks like when i try to watch a video on Youtube with my Online VPN Server :

http://puu.sh/fy2AX/2fb413a1a6.jpg

Thats the result of my ip test its show my Real ip adress and my VPN is running. you can see the result on this picture

http://puu.sh/fy22x/ee38fab05b.jpg

and this site says me evrything is ok he only show my VPN IP :

http://puu.sh/fy2N5/741dd5fd6a.jpg

privacy666

My Server location is "Kiev , Ukraine" and my real location is in "Germany" when i now watch a Video with VPN it says : You are located in Germany, go fuck urself..
but my server is located in the Ukraine why it says im in germany somenthing is wrong.. i hope u understand me.

maikcat

just for test,

remove def1 keyword from push route statement on server and try again

push "redirect-gateway"

you may need to reset your network settings on your client..

Michael.

privacy666

I have edit this line, and restarting the openvpn server and connected again.

but its the same problem again this site leaks my IP Adress and youtube videos are still blocked..

http://puu.sh/fydsD/cbc74d7dfe.jpg

Alwb1IPIi

If you use the Standard OpenVPN Routing like

          0.0.0.0          0.0.0.0     172.27.224.1    172.27.224.31     21  <- Default Gateway local Router
          0.0.0.0        128.0.0.0     172.27.224.1    172.27.224.31     20 <- Default Gateway VPN Router

As WebRTC uses Bind() Function and binds to all local Devices and try to contact external Server. While binding to the local Netwrok Interface with Default Gateway Local Router, the Connection will established beside the Route of VPN Gateway. To prevent WebRTC to leak your IP-Adress you have to delete the default Gateway bound to your Local Network interface after you established a VPN Connection.

This is defenetly a Gateway Problem and if you do not have access to the VPN Server config you can set routing manuelly! :-)

privacy666

Thank You for your Answer but now i think i have routing it wrong..
after i established the connection to my vpn i can't access any site..
can u help me for routing this correctly ?

route -v :

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         hosted-by.blazi 0.0.0.0         UG    0      0        0 eth0
10.8.0.0        business.blazin 255.255.255.0   UG    0      0        0 eth0
10.8.0.2        *               255.255.255.255 UH    0      0        0 tun0  <---- Thats the problem 
root@business:~#

maikcat

you used the same range for both lan & vpn????

Michael.

privacy666

Im not realy understanding..xD i hope this informations are usefully. :

my Server Gateway : 10.8.0.0
My Server Interface : eth0
Genmask : 255.255.255.0

Home Router Gateway : 192.168.1.1
My Home Interface : wlan0
Genmask 255.255.255.0

maikcat

10.8.0.0        business.blazin 255.255.255.0   UG    0      0        0 eth0

i am trying to figure out where this come from...

a route for your openvpn range to business.blazin via eth0?

post please the output of netstat -nr

Michael.