I can ping Internet but cannot surf (no proxy, etc.)

iautran

Hi,

I have an issue with my OpenVPN on my Raspberry;

Everything was working correctly but since few days I cant surf on Internet through this VPN connection.
When connected, I can resolve and ping everything through cmd.exe (ping www.google.com for example) but when I try to connect to the same website through a browser (chrome, IE, etc.) it doesn't work. I dont have any error message but the request takes veeeeery long time and after a long timeout I have an error OR "sometimes" it can work (after a long time too); so very strange and I dont understand what it can be.
I have the same problem when trying to connect to my local webcam in the same LAN (it takes very long time and sometimes it works and sometimes not; and most of the time it is very very slow).

Here are my conf files :

server.conf :

local 192.168.0.14 # SWAP THIS NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
dev tun
proto udp #Some people prefer to use tcp. Don't change it if you don't know.
port 2244
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/Yepa.crt # SWAP WITH YOUR CRT NAME
key /etc/openvpn/easy-rsa/keys/Yepa.key # SWAP WITH YOUR KEY NAME
dh /etc/openvpn/easy-rsa/keys/dh2048.pem # If you changed to 2048, change that here!
server 10.8.0.0 255.255.255.0
# server and remote endpoints
ifconfig 10.8.0.1 10.8.0.2
# Add route to Client routing table for the OpenVPN Server
push "route 10.8.0.1 255.255.255.255"
# Add route to Client routing table for the OpenVPN Subnet
push "route 10.8.0.0 255.255.255.0"
# your local subnet
push "route 192.168.0.14 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
# Set primary domain name server address to the SOHO Router
# If your router does not do DNS, you can use Google DNS 8.8.8.8
push "dhcp-option DNS 8.8.8.8" # This should already match your router address and not need to be changed.
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
# user nobody
# group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 5
script-security 3 system
# --script-security 2
client-connect "/etc/openvpn/scripts/clientconnect.sh"

Client.conf

client
dev tun
proto udp
remote publicip 2244
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ns-cert-type server
key-direction 1
cipher AES-128-CBC
comp-lzo
verb 1
mute 20
script-security 3 system
<ca>
-----BEGIN CERTIFICATE-----
MIIEqjCCA5KgAwIBAg[]....TYK7MbbTIeAAiJu5Tg==
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
MIIE8DCCA9igAwIBAg[...]vTdRFgChfY=
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,BF3C5EA8B52BC2B1

Mez2V20p[...]drGf2j1rI7+1Q==
-----END RSA PRIVATE KEY-----
</key>
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
be697a3fbac[...]ed00a945f4f
-----END OpenVPN Static key V1-----
</tls-auth>

iautran

Moreover, here is the log created from the OpenVPN command prompt on a Windows 7 :

Tue Feb 17 22:32:14 2015 OpenVPN 2.3.6 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [P
KCS11] [IPv6] built on Dec 1 2014
Tue Feb 17 22:32:14 2015 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08
Enter Private Key Password:
Tue Feb 17 22:32:22 2015 WARNING: this configuration may cache passwords in memo
ry -- use the auth-nocache option to prevent this
Tue Feb 17 22:32:22 2015 Control Channel Authentication: tls-auth using INLINE s
tatic key file
Tue Feb 17 22:32:22 2015 UDPv4 link local: [undef]
Tue Feb 17 22:32:22 2015 UDPv4 link remote: [AF_INET]MyIP:2244
Tue Feb 17 22:32:28 2015 [Yepa] Peer Connection Initiated with [AF_INET]78.193.2
16.199:1223
Tue Feb 17 22:32:31 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Feb 17 22:32:31 2015 open_tun, tt->ipv6=0
Tue Feb 17 22:32:31 2015 TAP-WIN32 device [Connexion au rÃ©seau local 2] opened:
\\.\Global\{8CE146FE-0BB0-4101-9875-39CAE778D284}.tap
Tue Feb 17 22:32:31 2015 Notified TAP-Windows driver to set a DHCP IP/netmask of
10.8.0.6/255.255.255.252 on interface {8CE146FE-0BB0-4101-9875-39CAE778D284} [D
HCP-serv: 10.8.0.5, lease-time: 31536000]
Tue Feb 17 22:32:31 2015 Successful ARP Flush on interface [39] {8CE146FE-0BB0-4
101-9875-39CAE778D284}
Tue Feb 17 22:32:36 2015 Warning: address 10.8.0.1 is not a network address in r
elation to netmask 255.255.255.0
Tue Feb 17 22:32:36 2015 ROUTE: route addition failed using CreateIpForwardEntry
: Paramètre incorrect. [status=87 if_index=39]
Tue Feb 17 22:32:36 2015 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\W
INDOWS\System32\Wbem
Tue Feb 17 22:32:36 2015 ROUTE: route addition failed using CreateIpForwardEntry
: object already exists. [status=5010 if_index=39]
Tue Feb 17 22:32:36 2015 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\W
INDOWS\System32\Wbem
Tue Feb 17 22:32:36 2015 Initialization Sequence Completed

and an ipconfig of the client :

Carte Ethernet Connexion au réseau local 2 :

Suffixe DNS propre à la connexion. . . :
Description. . . . . . . . . . . . . . : TAP-Windows Adapter V9
Adresse physique . . . . . . . . . . . : 00-FF-8C-E1-46-FE
DHCP activé. . . . . . . . . . . . . . : Oui
Configuration automatique activée. . . : Oui
Adresse IPv4. . . . . . . . . . . . . .: 10.8.0.6(préféré)
Masque de sous-réseau. . . . . . . . . : 255.255.255.252
Bail obtenu. . . . . . . . . . . . . . : mardi 17 février 2015 22:32:31
Bail expirant. . . . . . . . . . . . . : mercredi 17 février 2016 22:32:31
Passerelle par défaut. . . . . . . . . :
Serveur DHCP . . . . . . . . . . . . . : 10.8.0.5
Serveurs DNS. . . . . . . . . . . . . : 8.8.8.8
NetBIOS sur Tcpip. . . . . . . . . . . : Activé

Carte réseau sans fil Carte DELL :

Suffixe DNS propre à la connexion. . . :
Description. . . . . . . . . . . . . . : Dell Wireless 1397 WLAN Mini-Card
Adresse physique . . . . . . . . . . . : 00-22-5F-55-DE-CF
DHCP activé. . . . . . . . . . . . . . : Oui
Configuration automatique activée. . . : Oui
Adresse IPv4. . . . . . . . . . . . . .: 172.20.10.11(préféré)
Masque de sous-réseau. . . . . . . . . : 255.255.255.240
Bail obtenu. . . . . . . . . . . . . . : mardi 17 février 2015 22:31:53
Bail expirant. . . . . . . . . . . . . : mercredi 18 février 2015 22:17:29
Passerelle par défaut. . . . . . . . . : 172.20.10.1
Serveur DHCP . . . . . . . . . . . . . : 172.20.10.1
Serveurs DNS. . . . . . . . . . . . . : 172.20.10.1
NetBIOS sur Tcpip. . . . . . . . . . . : Activé

So I have error about the default gateway and I have no default gateway.

With this configuration, I can ping any website from cmd.exe but the request is very slow and response very long when trying to connect to the same website through a browser.
The page can be found and sometimes I have the title of the webpage but nothing else.

I dont understand the subnet mask to 255.255.255.252 neither.

I hope someone can help me.

Thank you

Traffic

It looks like you have your configs and logs mixed up ?

Example:

Your server config:
iautran wrotepush "route 10.8.0.1 255.255.255.255"
Your client log:
iautran wroteTue Feb 17 22:32:36 2015 Warning: address 10.8.0.1 is not a network address in r
elation to netmask 255.255.255.0
Tue Feb 17 22:32:36 2015 ROUTE: route addition failed using CreateIpForwardEntry
: Paramètre incorrect. [status=87 if_index=39]

This one:

iautran wroteTue Feb 17 22:32:36 2015 ROUTE: route addition failed using CreateIpForwardEntry
: object already exists. [status=5010 if_index=39]

suggests you have not stopped openvpn before trying again ...

You can delete these lines from your server config:

iautran wrote# server and remote endpoints
ifconfig 10.8.0.1 10.8.0.2
# Add route to Client routing table for the OpenVPN Server
push "route 10.8.0.1 255.255.255.255"
# Add route to Client routing table for the OpenVPN Subnet
push "route 10.8.0.0 255.255.255.0"

iautran wroteI dont understand the subnet mask to 255.255.255.252

See --topology in The Manual v23x

Best practice .. calm down and take a closer look :geek:

iautran

Thank you for your answer.

The server.conf file provided is correct.
I have checked again and here are my other conf files ; and really I dont understand what is going on as it was working before :

The openvpn log created on the command prompt on my Win7 is this one :

Wed Feb 18 19:56:17 2015 UDPv4 link local: [undef]
Wed Feb 18 19:56:17 2015 UDPv4 link remote: [AF_INET]ip:port
Wed Feb 18 19:56:19 2015 [Yepa] Peer Connection Initiated with [AF_INET]ip:port
Wed Feb 18 19:56:22 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Feb 18 19:56:22 2015 open_tun, tt->ipv6=0
Wed Feb 18 19:56:22 2015 TAP-WIN32 device [Connexion au rÃ©seau local 2] opened:
\\.\Global\{8CE146FE-0BB0-4101-9875-39CAE778D284}.tap
Wed Feb 18 19:56:22 2015 Notified TAP-Windows driver to set a DHCP IP/netmask of
10.8.0.6/255.255.255.252 on interface {8CE146FE-0BB0-4101-9875-39CAE778D284} [D
HCP-serv: 10.8.0.5, lease-time: 31536000]
Wed Feb 18 19:56:22 2015 Successful ARP Flush on interface [21] {8CE146FE-0BB0-4
101-9875-39CAE778D284}
Wed Feb 18 19:56:27 2015 Warning: address 192.168.0.14 is not a network address
in relation to netmask 255.255.255.0
Wed Feb 18 19:56:27 2015 ROUTE: route addition failed using CreateIpForwardEntry
: Paramètre incorrect. [status=87 if_index=21]
Wed Feb 18 19:56:27 2015 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\W
INDOWS\System32\Wbem
Wed Feb 18 19:56:27 2015 ROUTE: route addition failed using CreateIpForwardEntry
: L’objet existe déjà. [status=5010 if_index=21]
Wed Feb 18 19:56:27 2015 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\W
INDOWS\System32\Wbem
Wed Feb 18 19:56:27 2015 Initialization Sequence Completed

The ipconfig of the computer :
Carte Ethernet Connexion au r‚seau local 2 :

Suffixe DNS propre … la connexion. . . :
Description. . . . . . . . . . . . . . : TAP-Windows Adapter V9
Adresse physique . . . . . . . . . . . : 00-FF-8C-E1-46-FE
DHCP activ‚. . . . . . . . . . . . . . : Oui
Configuration automatique activ‚e. . . : Oui
Adresse IPv4. . . . . . . . . . . . . .: 10.8.0.6(pr‚f‚r‚)
Masque de sous-r‚seau. . . .ÿ. . . . . : 255.255.255.252
Bail obtenu. . . . . . . . .ÿ. . . . . : mercredi 18 f‚vrier 2015 19:56:22
Bail expirant. . . . . . . . .ÿ. . . . : jeudi 18 f‚vrier 2016 19:56:22
Passerelle par d‚faut. . . .ÿ. . . . . :
Serveur DHCP . . . . . . . . . . . . . : 10.8.0.5
Serveurs DNS. . . . . . . . . . . . . : 8.8.8.8
NetBIOS sur Tcpip. . . . . . . . . . . : Activ‚

Carte r‚seau sans fil Connexion r‚seau sans fil 2ÿ:

Suffixe DNS propre … la connexion. . . :
Description. . . . . . . . . . . . . . : Microsoft Virtual WiFi Miniport Adapter #2
Adresse physique . . . . . . . . . . . : 00-22-5F-55-DE-CF
DHCP activ‚. . . . . . . . . . . . . . : Non
Configuration automatique activ‚e. . . : Oui
Adresse IPv6 de liaison locale. . . . .: fe80::a461:c6bd:9cad:dfb5%17(pr‚f‚r‚)
Adresse IPv4. . . . . . . . . . . . . .: 192.168.17.1(pr‚f‚r‚)
Masque de sous-r‚seau. . . .ÿ. . . . . : 255.255.255.0
Adresse IPv4. . . . . . . . . . . . . .: 192.168.173.1(pr‚f‚r‚)
Masque de sous-r‚seau. . . .ÿ. . . . . : 255.255.255.0
Passerelle par d‚faut. . . .ÿ. . . . . :
IAID DHCPv6 . . . . . . . . . . . : 536879711
DUID de client DHCPv6. . . . . . . . : 00-01-00-01-12-8B-AE-4B-00-21-70-8C-6F-D1
Serveurs DNS. . . . . . . . . . . . . : 192.168.17.1
NetBIOS sur Tcpip. . . . . . . . . . . : Activ‚

Carte r‚seau sans fil Carte DELLÿ:

Suffixe DNS propre … la connexion. . . :
Description. . . . . . . . . . . . . . : Dell Wireless 1397 WLAN Mini-Card
Adresse physique . . . . . . . . . . . : 00-22-5F-55-DE-CF
DHCP activ‚. . . . . . . . . . . . . . : Oui
Configuration automatique activ‚e. . . : Oui
Adresse IPv4. . . . . . . . . . . . . .: 172.20.10.11(pr‚f‚r‚)
Masque de sous-r‚seau. . . .ÿ. . . . . : 255.255.255.240
Bail obtenu. . . . . . . . .ÿ. . . . . : mercredi 18 f‚vrier 2015 19:53:38
Bail expirant. . . . . . . . .ÿ. . . . : jeudi 19 f‚vrier 2015 19:43:01
Passerelle par d‚faut. . . .ÿ. . . . . : 172.20.10.1
Serveur DHCP . . . . . . . . . . . . . : 172.20.10.1
Serveurs DNS. . . . . . . . . . . . . : 172.20.10.1
NetBIOS sur Tcpip. . . . . . . . . . . : Activ‚

a route print on my Win7 :

IPv4 Table de routage
===========================================================================
Itin‚raires actifsÿ:
Destination r‚seau Masque r‚seau Adr. passerelle Adr. interface M‚trique
0.0.0.0 0.0.0.0 192.168.0.254 192.168.0.16 25
<public_ip_of_openVPN_Serveur> 255.255.255.255 172.20.10.1 192.168.0.16 25
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.0.0 255.255.255.0 On-link 192.168.0.16 281
192.168.0.16 255.255.255.255 On-link 192.168.0.16 281
192.168.0.255 255.255.255.255 On-link 192.168.0.16 281
192.168.17.0 255.255.255.0 On-link 192.168.17.1 261
192.168.17.1 255.255.255.255 On-link 192.168.17.1 261
192.168.17.255 255.255.255.255 On-link 192.168.17.1 261
192.168.173.0 255.255.255.0 On-link 192.168.17.1 261
192.168.173.1 255.255.255.255 On-link 192.168.17.1 261
192.168.173.255 255.255.255.255 On-link 192.168.17.1 261
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.0.16 281
224.0.0.0 240.0.0.0 On-link 192.168.17.1 261
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.0.16 281
255.255.255.255 255.255.255.255 On-link 192.168.17.1 261
===========================================================================

A ping and tracert :

ping www.google.fr

Envoi d'une requête 'ping' sur www.google.fr [173.194.40.143] avec 32 octets de
données :
Réponse de 173.194.40.143 : octets=32 temps=146 ms TTL=52
Réponse de 173.194.40.143 : octets=32 temps=137 ms TTL=52

Statistiques Ping pour 173.194.40.143:
Paquets : envoyés = 2, reçus = 2, perdus = 0 (perte 0%),
Durée approximative des boucles en millisecondes :
Minimum = 137ms, Maximum = 146ms, Moyenne = 141ms
Ctrl+C
^C

tracert www.google.fr

Détermination de l'itinéraire vers www.google.fr [173.194.40.143]
avec un maximum de 30 sauts :

1 252 ms 57 ms 67 ms 10.8.0.1
2 98 ms 62 ms 55 ms 192.168.0.254
3 147 ms 123 ms 52 ms <public gateway ip address of my openvpn>
4 146 ms 120 ms 56 ms 78.255.97.126
5 [...]

So, really I dont understand why I cant connect with no difficulty, I can ping, the tracert is correct but impossible to surf from a browser (even on a webcam in the LAN). For the example of the webcam in the LAN, "sometimes" I have the login/password of the webserver that is displayed; so the traffic is "allowed".

@Admin or modo : please can you remove the public ip address in my last post ?
(line : Tue Feb 17 22:32:28 2015 [Yepa] Peer .....)

Thank you

iautran

Found the issue ! 🙂

I have added this 'tun-mtu' and 'mssfix' to 1380 on my server.conf and now it's ok !

Traffic

iautran wrote# your local subnet
push "route 192.168.0.14 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERRY PI IP ADDRESS

iautran wroteWed Feb 18 19:56:27 2015 Warning: address 192.168.0.14 is not a network address
in relation to netmask 255.255.255.0
Wed Feb 18 19:56:27 2015 ROUTE: route addition failed using CreateIpForwardEntry
: Paramètre incorrect. [status=87 if_index=21]

Replace with:

# your local subnet
push "route 192.168.0.0 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERRY PI LAN SUBNET

Also:

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

iautran

Thank you Traffic for your answer (always you ! 😃)

Ok about the "push route" modification. I will do that.

About the Local LAN you're absolutely right and indeed I have many troubles because of that.

The problem is that my ISP (from where my OpenVPN server is connected) only accepts a LAN on 192.168.0.0/24.

Is there a trick that I can do to allow me to be able to connect to my VPN even if I am remotely connected to a LAN in 192.168.0.x too ?
Or is there any solution in this situation ?

Thank you