Hi all, I have openvpn v2.3.6 running on my FreeBSD v10.1 server. Two Android clients connect and everything works fine. However, something is going wrong on my Linux Mint laptop which uses the Network Manager openvpn-gnome package. It connects to the server. DNS lookups work. I can connect to apache running on the server. But I can't reach anything beyond the server. Here is sample traceroute output: [code]$ traceroute nrc.nl traceroute to nrc.nl (46.22.183.141), 30 hops max, 60 byte packets 1 10.8.0.1 (10.8.0.1) 20.679 ms 22.965 ms 23.907 ms[/code] This is as far as it gets. Any ideas what might be going wrong here? Like I say, the two Android devices don't have this issue. server.conf: [code]port 1194 proto udp dev tun ca /usr/local/etc/openvpn/keys/ca.crt cert /usr/local/etc/openvpn/keys/server.crt key /usr/local/etc/openvpn/keys/server.key dh /usr/local/etc/openvpn/keys/dh2048.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt keepalive 10 120 tls-auth /usr/local/etc/openvpn/keys/tls.key 0 comp-lzo user nobody group nobody persist-key persist-tun log-append /var/log/openvpn.log verb 3[/code]

Thanks, I'll give try this evening. One question: [quote]while running [b]tcpdump [/b]on your client[/quote] Do not mean [b]ping [/b]or perhaps [b]traceroute[/b]?

[quote="cbrace"]It would seem that this line: Code: 149.210.176.121 192.168.2.1 255.255.255.255 UGH 0 0 0 wlan0 in the first is problematic. [u]This destination is the external IP of the server[/u]. Anyone have any thoughts as to what might be going on here?[/quote]See [b]--redirect-gateway[/b] in [url=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage]The Manual v23x[/url]

Thanks, the redirect-gateway is what I was missing. also needed to add a couple rules to the PF firewall: [code]set skip on { lo0 tun0 }[/code] and [code]nat on vtnet0 from ! (vtnet0) to any -> (vtnet0)[/code]

[Solved]Linux client connects but traffic stops at server

cbrace

Hi all,

I have openvpn v2.3.6 running on my FreeBSD v10.1 server.

Two Android clients connect and everything works fine.

However, something is going wrong on my Linux Mint laptop which uses the Network Manager openvpn-gnome package. It connects to the server. DNS lookups work. I can connect to apache running on the server. But I can't reach anything beyond the server. Here is sample traceroute output:

$ traceroute nrc.nl
traceroute to nrc.nl (46.22.183.141), 30 hops max, 60 byte packets
 1  10.8.0.1 (10.8.0.1)  20.679 ms  22.965 ms  23.907 ms

This is as far as it gets.

Any ideas what might be going wrong here? Like I say, the two Android devices don't have this issue.

server.conf:

port 1194
proto udp
dev tun
ca   /usr/local/etc/openvpn/keys/ca.crt
cert /usr/local/etc/openvpn/keys/server.crt
key  /usr/local/etc/openvpn/keys/server.key
dh /usr/local/etc/openvpn/keys/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
tls-auth /usr/local/etc/openvpn/keys/tls.key 0
comp-lzo
user nobody
group nobody
persist-key
persist-tun
log-append  /var/log/openvpn.log
verb 3

maikcat

can you run

tcpdump -n -i eth0 icmp

on your server while running tcpdump on your client?
please replace eth0 with your NIC name...

Michael.

cbrace

Thanks, I'll give try this evening. One question:

while running tcpdump on your client

Do not mean ping or perhaps traceroute?

maikcat

traceroute...

Michael.

cbrace

I see an endless stream of lines like this:

20:39:04.104822 IP 149.210.176.121 > 177.193.17.98: ICMP 149.210.176.121 udp port 51413 unreachable, length 36

Port 51413 is being used by transmission.

cbrace

I am still puzzling over this, and I've discovered that the client.conf file for my Linux laptop works fine on the command line:

$ sudo openvpn --config myclient.conf

This sets up the connection and works without problem. The above-mentioned problem occurs when I try to set up the VPN via the Gnome NetworkManager app.

Exploring further, I see the following difference in the client routing tables.

The VPN activated by Gnome NetworkManager interface:

$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.8.0.9        0.0.0.0         UG    0      0        0 tun0
10.8.0.0        10.8.0.9        255.255.255.0   UG    0      0        0 tun0
10.8.0.9        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
149.210.176.121 192.168.2.1     255.255.255.255 UGH   0      0        0 wlan0
192.168.2.0     0.0.0.0         255.255.255.0   U     9      0        0 wlan0

This with the command line:

$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.2.1     0.0.0.0         UG    0      0        0 wlan0
10.8.0.0        10.8.0.9        255.255.255.0   UG    0      0        0 tun0
10.8.0.9        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
192.168.2.0     0.0.0.0         255.255.255.0   U     9      0        0 wlan0

It would seem that this line:

149.210.176.121 192.168.2.1     255.255.255.255 UGH   0      0        0 wlan0

[/b]
in the first is problematic. This destination is the external IP of the server.

Anyone have any thoughts as to what might be going on here?

Traffic

cbrace wroteIt would seem that this line:
Code:
149.210.176.121 192.168.2.1 255.255.255.255 UGH 0 0 0 wlan0

in the first is problematic. This destination is the external IP of the server.

Anyone have any thoughts as to what might be going on here?

See --redirect-gateway in The Manual v23x

cbrace

Thanks, the redirect-gateway is what I was missing.

also needed to add a couple rules to the PF firewall:

set skip on { lo0 tun0 }

and

nat on vtnet0 from ! (vtnet0) to any -> (vtnet0)

Traffic

Is this problem solved ? Thanks.

cbrace

yes, do I need to mark as such? Don't see that option anywhere.