OpenVPN Server only Serves traffic from Google.com to Client

Ahazu

Hi,

So I am pretty sure this is a routing/config problem. Whenever my client (Android OpenVPN) connects to the OpenVPN server it can only retrieve traffic from google.com searches. Whenever I try and access another website or service I get "connection interrupted" or "DNS lookup failed". Any help/insights would be appreciated!

server.conf

local 192.168.X.X
dev tun
proto udp 
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/1.crt 
key /etc/openvpn/easy-rsa/keys/1.key 
dh /etc/openvpn/easy-rsa/keys/dh2048.pem 
server 10.8.0.0 255.255.255.0
# server and remote endpoints
ifconfig 10.8.0.1 10.8.0.2
# Add route to Client routing table for the OpenVPN Server
push "route 10.8.0.1 255.255.255.255"
# Add route to Client routing table for the OpenVPN Subnet
push "route 10.8.0.0 255.255.255.0"
# your local subnet
push "route 192.168.X.X 255.255.255.0" 
# Set primary domain name server address to the SOHO Router
# If your router does not do DNS, you can use Google DNS 8.8.8.8
push "dhcp-option DNS 192.168.X.X" # This should already match your router address and not need to be changed.
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 1

iptables -t nat -L

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
SNAT       all  --  10.8.0.0/24          anywhere             to:192.168.X.X
MASQUERADE  all  --  10.8.0.0/24          anywhere

iptables -L
Has no rules.

tcpdump -i eth0 port 80 when trying to access something outside of google search

empty

tcpdump -i tun0 port 80 when trying to access something outside of google search

empty

If there is any other output needed, please ask I would be happy to oblige haha.

Traffic

Ahazu wroteserver.conf
Code:
local 192.168.X.X
..
# If your router does not do DNS, you can use Google DNS 8.8.8.8
push "dhcp-option DNS 192.168.X.X" # This should already match your router address and not need to be changed.

Does your router do DNS ?

Also, what is 192.168.x.x .. I hope it is not 0.1 or 1.1

Ahazu

Traffic wrote
Ahazu wroteserver.conf
Code:
local 192.168.X.X
..
# If your router does not do DNS, you can use Google DNS 8.8.8.8
push "dhcp-option DNS 192.168.X.X" # This should already match your router address and not need to be changed.
Does your router do DNS ?

Also, what is 192.168.x.x .. I hope it is not 0.1 or 1.1

Hi Traffic, thanks for the input. Not sure if my router does DNS so I am guessing not. I changed the config to 8.8.8.8 and I am seeing traffic in tcpdump, however no pages load... They just timeout...

Here is an example of a tcpdump for port 80 on eth0 on my pi:

18:29:12.356550 IP sea09s18-in-f25.1e100.net.http > 192.168.1.9.56443: Flags [S.], seq 2819664936, ack 2164290303, win 42540, options [mss 1430,sackOK,TS val 148881466 ecr 14987105,nop,wscale 7], length 0
18:29:12.424627 IP 192.168.1.9.56443 > sea09s18-in-f25.1e100.net.http: Flags [.], ack 1, win 215, options [nop,nop,TS val 14987112 ecr 148881466], length 0
18:29:12.425844 IP 192.168.1.9.56443 > sea09s18-in-f25.1e100.net.http: Flags [P.], seq 1341:1488, ack 1, win 215, options [nop,nop,TS val 14987114 ecr 148881466], length 147
18:29:12.427443 IP 192.168.1.9.56443 > sea09s18-in-f25.1e100.net.http: Flags [.], seq 1:1341, ack 1, win 215, options [nop,nop,TS val 14987114 ecr 148881466], length 1340
18:29:12.430282 IP sea09s18-in-f25.1e100.net.http > 192.168.1.9.56443: Flags [.], ack 1, win 341, options [nop,nop,TS val 148881540 ecr 14987112,nop,nop,sack 1 {1341:1488}], length 0
18:29:12.432180 IP sea09s18-in-f25.1e100.net.http > 192.168.1.9.56443: Flags [.], ack 1488, win 362, options [nop,nop,TS val 148881542 ecr 14987114], length 0
18:29:12.794807 IP sea09s18-in-f25.1e100.net.http > 192.168.1.9.56443: Flags [.], seq 1:1341, ack 1488, win 362, options [nop,nop,TS val 148881904 ecr 14987114], length 1340
18:29:12.794810 IP sea09s18-in-f25.1e100.net.http > 192.168.1.9.56443: Flags [.], seq 1341:2681, ack 1488, win 362, options [nop,nop,TS val 148881904 ecr 14987114], length 1340
18:29:12.794812 IP sea09s18-in-f25.1e100.net.http > 192.168.1.9.56443: Flags [P.], seq 2681:3902, ack 1488, win 362, options [nop,nop,TS val 148881904 ecr 14987114], length 1221
18:29:12.863671 IP 192.168.1.9.56443 > sea09s18-in-f25.1e100.net.http: Flags [.], ack 1, win 215, options [nop,nop,TS val 14987156 ecr 148881542,nop,nop,sack 1 {2681:3902}], length 0
18:29:12.887064 IP sea09s18-in-f25.1e100.net.http > 192.168.1.9.56443: Flags [.], seq 1:1341, ack 1488, win 362, options [nop,nop,TS val 148881997 ecr 14987156], length 1340
18:29:12.887066 IP sea09s18-in-f25.1e100.net.http > 192.168.1.9.56443: Flags [.], seq 1341:2681, ack 1488, win 362, options [nop,nop,TS val 148881997 ecr 14987156], length 1340
18:29:13.162037 IP sea09s18-in-f25.1e100.net.http > 192.168.1.9.56443: Flags [.], seq 1:1341, ack 1488, win 362, options [nop,nop,TS val 148882272 ecr 14987156], length 1340
18:29:13.710914 IP sea09s18-in-f25.1e100.net.http > 192.168.1.9.56443: Flags [.], seq 1:1341, ack 1488, win 362, options [nop,nop,TS val 148882821 ecr 14987156], length 1340
18:29:14.806913 IP sea09s18-in-f25.1e100.net.http > 192.168.1.9.56443: Flags [.], seq 1:1341, ack 1488, win 362, options [nop,nop,TS val 148883917 ecr 14987156], length 1340
18:29:16.998917 IP sea09s18-in-f25.1e100.net.http > 192.168.1.9.56443: Flags [.], seq 1:1341, ack 1488, win 362, options [nop,nop,TS val 148886109 ecr 14987156], length 1340
18:29:21.382905 IP sea09s18-in-f25.1e100.net.http > 192.168.1.9.56443: Flags [.], seq 1:1341, ack 1488, win 362, options [nop,nop,TS val 148890493 ecr 14987156], length 1340
18:29:30.150933 IP sea09s18-in-f25.1e100.net.http > 192.168.1.9.56443: Flags [.], seq 1:1341, ack 1488, win 362, options [nop,nop,TS val 148899261 ecr 14987156], length 1340
18:29:40.151905 IP sea09s18-in-f25.1e100.net.http > 192.168.1.9.56443: Flags [.], seq 1:1341, ack 1488, win 362, options [nop,nop,TS val 148909261 ecr 14987156], length 1340
18:29:50.150942 IP sea09s18-in-f25.1e100.net.http > 192.168.1.9.56443: Flags [.], seq 1:1341, ack 1488, win 362, options [nop,nop,TS val 148919261 ecr 14987156], length 1340
18:30:00.151928 IP sea09s18-in-f25.1e100.net.http > 192.168.1.9.56443: Flags [.], seq 1:1341, ack 1488, win 362, options [nop,nop,TS val 148929262 ecr 14987156], length 1340
18:30:10.151923 IP sea09s18-in-f25.1e100.net.http > 192.168.1.9.56443: Flags [.], seq 1:1341, ack 1488, win 362, options [nop,nop,TS val 148939262 ecr 14987156], length 1340
18:30:20.151913 IP sea09s18-in-f25.1e100.net.http > 192.168.1.9.56443: Flags [.], seq 1:1341, ack 1488, win 362, options [nop,nop,TS val 148949262 ecr 14987156], length 1340
18:30:30.153435 IP sea09s18-in-f25.1e100.net.http > 192.168.1.9.56443: Flags [.], seq 1:1341, ack 1488, win 362, options [nop,nop,TS val 148959262 ecr 14987156], length 1340
18:30:40.152936 IP sea09s18-in-f25.1e100.net.http > 192.168.1.9.56443: Flags [.], seq 1:1341, ack 1488, win 362, options [nop,nop,TS val 148969263 ecr 14987156], length 1340
18:30:50.152920 IP sea09s18-in-f25.1e100.net.http > 192.168.1.9.56443: Flags [.], seq 1:1341, ack 1488, win 362, options [nop,nop,TS val 148979263 ecr 14987156], length 1340
18:31:00.152918 IP sea09s18-in-f25.1e100.net.http > 192.168.1.9.56443: Flags [.], seq 1:1341, ack 1488, win 362, options [nop,nop,TS val 148989263 ecr 14987156], length 1340

And here is a tcpdump of port 80 on tun0 on my pi

18:37:55.761717 IP 10.8.0.6.45965 > 74.85.65.147.http: Flags [S], seq 2349413623, win 13720, options [mss 1352,sackOK,TS val 15029170 ecr 0,nop,wscale 6], length 0
18:37:55.763296 IP 74.85.65.147.http > 10.8.0.6.45965: Flags [S.], seq 2532958255, ack 2349413624, win 28960, options [mss 1460,sackOK,TS val 25498053 ecr 15029170,nop,wscale 7], length 0
18:37:55.842200 IP 10.8.0.6.45965 > 74.85.65.147.http: Flags [.], ack 1, win 215, options [nop,nop,TS val 15029177 ecr 25498053], length 0
18:37:55.843730 IP 10.8.0.6.45965 > 74.85.65.147.http: Flags [P.], seq 1341:1519, ack 1, win 215, options [nop,nop,TS val 15029178 ecr 25498053], length 178
18:37:55.845119 IP 74.85.65.147.http > 10.8.0.6.45965: Flags [.], ack 1, win 235, options [nop,nop,TS val 25498135 ecr 15029177,nop,nop,sack 1 {1341:1519}], length 0
18:37:55.852502 IP 10.8.0.6.45965 > 74.85.65.147.http: Flags [.], seq 1:1341, ack 1, win 215, options [nop,nop,TS val 15029178 ecr 25498053], length 1340
18:37:55.854182 IP 74.85.65.147.http > 10.8.0.6.45965: Flags [.], ack 1519, win 256, options [nop,nop,TS val 25498144 ecr 15029178], length 0
18:37:55.935410 IP 10.8.0.6.45965 > 74.85.65.147.http: Flags [.], seq 1:1341, ack 1, win 215, options [nop,nop,TS val 15029185 ecr 25498135], length 1340
18:37:55.936947 IP 74.85.65.147.http > 10.8.0.6.45965: Flags [.], ack 1519, win 256, options [nop,nop,TS val 25498227 ecr 15029178,nop,nop,sack 1 {1:1341}], length 0
18:37:56.371177 IP 74.85.65.147.http > 10.8.0.6.45965: Flags [P.], seq 1:628, ack 1519, win 256, options [nop,nop,TS val 25498661 ecr 15029178], length 627
18:37:56.421649 IP 10.8.0.6.45965 > 74.85.65.147.http: Flags [.], ack 628, win 257, options [nop,nop,TS val 15029237 ecr 25498661], length 0

Traffic

FYI:

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

:arrow: Never use 192.168.0.0/24 or 192.168.1.0/24 (or other common subnets) for your OpenVPN Server LAN :!:

You are advised to change your server LAN to a more unique RFC1918 compliant subnet. f.e 192.168.143.0/24