Yet another newbie stuck on config - thanks for your help. After googling around and trying many different approaches (firewall modification, rebooting, iptables, connecting via Tunnelblick and Windows client), I can connect to OpenVPN on my VPS successfully and get an IP address assigned from the server, but then don't have internet access. In detail: On Windows, host names don't resolve; with Tunnelblick on Mac OS X set to "Do not set nameserver", a 'traceroute' run on the client resolves the host name correctly but the connection then also remains stuck on 10.8.0.1 and doesn't connect on from there: [code]traceroute to www.heise.de (193.99.144.85), 64 hops max, 52 byte packets 1 10.8.0.1 (10.8.0.1) 211.488 ms 213.847 ms 212.781 ms 2 * * * 3 * [/code] [b]Server[/b] OpenVPN running on Ubuntu 14.04 32-bit VPS. [b]Client[/b] Tunnelblick 3.4.3 on Yosemite, OpenVPN client on Win7 - both with same error. sysctl on server [code]net.ipv4.ip_forward=1[/code] ufw status verbose (I disabled ufw and tried again after reboot, but no change.) [code] Status: active Logging: on (low) Default: deny (incoming), allow (outgoing), allow (routed) New profiles: skip To Action From -- ------ ---- 22 ALLOW IN Anywhere 1194/udp ALLOW IN Anywhere 80 ALLOW IN Anywhere 22 (v6) ALLOW IN Anywhere (v6) 1194/udp (v6) ALLOW IN Anywhere (v6) 80 (v6) ALLOW IN Anywhere (v6)[/code] server.conf: [code]port 1194 proto udp dev tun ca /etc/openvpn/easy-rsa/keys/ca.crt cert /etc/openvpn/easy-rsa/keys/[servername].crt key /etc/openvpn/easy-rsa/keys/[servername].key # This file should be kept secret dh /etc/openvpn/easy-rsa/keys/dh2048.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 208.67.222.222" push "dhcp-option DNS 208.67.220.220" duplicate-cn keepalive 10 120 comp-lzo user nobody group nogroup persist-key persist-tun status openvpn-status.log verb 4[/code] client.ovpn for Win7 client as per [url]https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-ubuntu-14-04[/url] [code] client dev tun proto udp remote [VPS IP] 1194 resolv-retry infinite nobind persist-key persist-tun ns-cert-type server comp-lzo verb 4 explicit-exit-notify 2 ping 10 ping-restart 60 route-method exe route-delay 2 [certificate] [certificate] [key] [/code] Server log [code]Mar 10 16:39:11 [server-name] ovpn-server[483]: 79.245.XXX.XXX:52941 TLS: Initial packet from [AF_INET]79.245.XXX.XXX:52941, sid=d3c109a8 dc2e99b2 Mar 10 16:39:29 [server-name] ovpn-server[483]: 79.245.XXX.XXX:52941 VERIFY OK: depth=1, C=DE, ST=BER, L=[]], O=[org-name], OU=[org-name], CN=[org-name] CA, name=EasyRSA, emailAddress=key@[org-name].com Mar 10 16:39:29 [server-name] ovpn-server[483]: 79.245.XXX.XXX:52941 VERIFY OK: depth=0, C=DE, ST=BER, L=[]], O=[org-name], OU=[org-name], CN=[server-name]-client, name=EasyRSA, emailAddress=key@[org-name].com Mar 10 16:39:30 [server-name] ovpn-server[483]: 79.245.XXX.XXX:52941 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key Mar 10 16:39:30 [server-name] ovpn-server[483]: 79.245.XXX.XXX:52941 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Mar 10 16:39:30 [server-name] ovpn-server[483]: 79.245.XXX.XXX:52941 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key Mar 10 16:39:30 [server-name] ovpn-server[483]: 79.245.XXX.XXX:52941 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Mar 10 16:39:30 [server-name] ovpn-server[483]: 79.245.XXX.XXX:52941 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA Mar 10 16:39:30 [server-name] ovpn-server[483]: 79.245.XXX.XXX:52941 [[server-name]-client] Peer Connection Initiated with [AF_INET]79.245.XXX.XXX:52941 Mar 10 16:39:30 [server-name] ovpn-server[483]: [server-name]-client/79.245.XXX.XXX:52941 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled) Mar 10 16:39:30 [server-name] ovpn-server[483]: [server-name]-client/79.245.XXX.XXX:52941 MULTI: Learn: 10.8.0.6 -> [server-name]-client/79.245.XXX.XXX:52941 Mar 10 16:39:30 [server-name] ovpn-server[483]: [server-name]-client/79.245.XXX.XXX:52941 MULTI: primary virtual IP for [server-name]-client/79.245.XXX.XXX:52941: 10.8.0.6 Mar 10 16:39:36 [server-name] ovpn-server[483]: [server-name]-client/79.245.XXX.XXX:52941 PUSH: Received control message: 'PUSH_REQUEST' Mar 10 16:39:36 [server-name] ovpn-server[483]: [server-name]-client/79.245.XXX.XXX:52941 send_push_reply(): safe_cap=940 Mar 10 16:39:36 [server-name] ovpn-server[483]: [server-name]-client/79.245.XXX.XXX:52941 SENT CONTROL [[server-name]-client]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)[/code] Client log [code]Tue Mar 10 21:39:14 2015 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Mar 4 2015 Tue Mar 10 21:39:14 2015 library versions: OpenSSL 1.0.1l 15 Jan 2015, LZO 2.08 Enter Management Password: Tue Mar 10 21:39:14 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340 Tue Mar 10 21:39:14 2015 Need hold release from management interface, waiting... Tue Mar 10 21:39:14 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340 Tue Mar 10 21:39:14 2015 MANAGEMENT: CMD 'state on' Tue Mar 10 21:39:14 2015 MANAGEMENT: CMD 'log all on' Tue Mar 10 21:39:14 2015 MANAGEMENT: CMD 'hold off' Tue Mar 10 21:39:14 2015 MANAGEMENT: CMD 'hold release' Tue Mar 10 21:39:14 2015 Socket Buffers: R=[8192->8192] S=[8192->8192] Tue Mar 10 21:39:14 2015 UDPv4 link local: [undef] Tue Mar 10 21:39:14 2015 UDPv4 link remote: [AF_INET][server-ip]:1194 Tue Mar 10 21:39:14 2015 MANAGEMENT: >STATE:1426019954,WAIT,,, Tue Mar 10 21:39:14 2015 MANAGEMENT: >STATE:1426019954,AUTH,,, Tue Mar 10 21:39:14 2015 TLS: Initial packet from [AF_INET][server-ip]:1194, sid=263adf9b e6849787 Tue Mar 10 21:39:22 2015 VERIFY OK: depth=1, C=DE, ST=BER, L=[]], O=[org-name], OU=[org-name], CN=[org-name] CA, name=EasyRSA, emailAddress=key@[org-name].com Tue Mar 10 21:39:22 2015 VERIFY OK: nsCertType=SERVER Tue Mar 10 21:39:22 2015 VERIFY OK: depth=0, C=DE, ST=BER, L=[]], O=[org-name], OU=[org-name], CN=[server-name]], name=EasyRSA, emailAddress=key@[org-name].com Tue Mar 10 21:39:34 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key Tue Mar 10 21:39:34 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Tue Mar 10 21:39:34 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key Tue Mar 10 21:39:34 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Tue Mar 10 21:39:37 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA Tue Mar 10 21:39:37 2015 [[server-name]] Peer Connection Initiated with [AF_INET][server-ip]:1194 Tue Mar 10 21:39:38 2015 MANAGEMENT: >STATE:1426019978,GET_CONFIG,,, Tue Mar 10 21:39:39 2015 SENT CONTROL [[server-name]]: 'PUSH_REQUEST' (status=1) Tue Mar 10 21:39:39 2015 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' Tue Mar 10 21:39:39 2015 OPTIONS IMPORT: timers and/or timeouts modified Tue Mar 10 21:39:39 2015 OPTIONS IMPORT: --ifconfig/up options modified Tue Mar 10 21:39:39 2015 OPTIONS IMPORT: route options modified Tue Mar 10 21:39:39 2015 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified Tue Mar 10 21:39:39 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0 Tue Mar 10 21:39:39 2015 MANAGEMENT: >STATE:1426019979,ASSIGN_IP,,10.8.0.6, Tue Mar 10 21:39:39 2015 open_tun, tt->ipv6=0 Tue Mar 10 21:39:39 2015 TAP-WIN32 device [LAN-Verbindung 4] opened: \\.\Global\{57ACE824-B123-4425-B519-0480B13EECB1}.tap Tue Mar 10 21:39:39 2015 TAP-Windows Driver Version 9.21 Tue Mar 10 21:39:39 2015 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {57ACE824-B123-4425-B519-0480B13EECB1} [DHCP-serv: 10.8.0.5, lease-time: 31536000] Tue Mar 10 21:39:39 2015 Successful ARP Flush on interface [23] {57ACE824-B123-4425-B519-0480B13EECB1} Tue Mar 10 21:39:44 2015 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up Tue Mar 10 21:39:44 2015 C:\Windows\system32\route.exe ADD [server-ip] MASK 255.255.255.255 192.168.2.1 Tue Mar 10 21:39:44 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4 Tue Mar 10 21:39:44 2015 Route addition via IPAPI succeeded [adaptive] Tue Mar 10 21:39:44 2015 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5 Tue Mar 10 21:39:44 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4 Tue Mar 10 21:39:44 2015 Route addition via IPAPI succeeded [adaptive] Tue Mar 10 21:39:44 2015 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.5 Tue Mar 10 21:39:44 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4 Tue Mar 10 21:39:44 2015 Route addition via IPAPI succeeded [adaptive] Tue Mar 10 21:39:44 2015 MANAGEMENT: >STATE:1426019984,ADD_ROUTES,,, Tue Mar 10 21:39:44 2015 C:\Windows\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5 Tue Mar 10 21:39:44 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4 Tue Mar 10 21:39:44 2015 Route addition via IPAPI succeeded [adaptive] Tue Mar 10 21:39:44 2015 Initialization Sequence Completed Tue Mar 10 21:39:44 2015 MANAGEMENT: >STATE:1426019984,CONNECTED,SUCCESS,10.8.0.6,[server-ip][/code]

[quote]How do I see the iptables rule that is used?[/quote] it doesnt matter,simply remove it and use this: [code]iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o venet0:0 -j SNAT --to-source 1.2.3.4 1.2.3.4 is openvz real ip[/code] Michael.

[quote]I should save the current iptables rules and have them load automatically on boot - is there an easy way to do that?[/quote] AFAIK you can use iptables-save script to create the /etc/sysconfig/iptables file then start iptables as a service.. Michael.

[quote]Thanks again, Michael![/quote] You welcome :D Marked as solved, Closing topic Regards, Michael.

[Solved]OpenVPN on Ubuntu VPS: no internet,stuck on 10.8.0.1

speedracr_ovpn

Yet another newbie stuck on config - thanks for your help.
After googling around and trying many different approaches (firewall modification, rebooting, iptables, connecting via Tunnelblick and Windows client), I can connect to OpenVPN on my VPS successfully and get an IP address assigned from the server, but then don't have internet access.
In detail: On Windows, host names don't resolve; with Tunnelblick on Mac OS X set to "Do not set nameserver", a 'traceroute' run on the client resolves the host name correctly but the connection then also remains stuck on 10.8.0.1 and doesn't connect on from there:

traceroute to www.heise.de (193.99.144.85), 64 hops max, 52 byte packets
 1  10.8.0.1 (10.8.0.1)  211.488 ms  213.847 ms  212.781 ms
 2  * * *
 3  *

Server OpenVPN running on Ubuntu 14.04 32-bit VPS.
Client Tunnelblick 3.4.3 on Yosemite, OpenVPN client on Win7 - both with same error.

sysctl on server

net.ipv4.ip_forward=1

ufw status verbose
(I disabled ufw and tried again after reboot, but no change.)

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), allow (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22                         ALLOW IN    Anywhere
1194/udp                   ALLOW IN    Anywhere
80                         ALLOW IN    Anywhere
22 (v6)                    ALLOW IN    Anywhere (v6)
1194/udp (v6)              ALLOW IN    Anywhere (v6)
80 (v6)                    ALLOW IN    Anywhere (v6)

server.conf:

port 1194
proto udp
dev tun
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/[servername].crt
key /etc/openvpn/easy-rsa/keys/[servername].key  # This file should be kept secret
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
duplicate-cn
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 4

client.ovpn for Win7 client as per https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-ubuntu-14-04

client
dev tun
proto udp
remote [VPS IP] 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ns-cert-type server
comp-lzo
verb 4
explicit-exit-notify 2
ping 10
ping-restart 60
route-method exe
route-delay 2

<ca>
[certificate]
</ca>
<cert>
[certificate]
</cert>
<key>
[key]
</key>

Server log

Mar 10 16:39:11 [server-name] ovpn-server[483]: 79.245.XXX.XXX:52941 TLS: Initial packet from [AF_INET]79.245.XXX.XXX:52941, sid=d3c109a8 dc2e99b2
Mar 10 16:39:29 [server-name] ovpn-server[483]: 79.245.XXX.XXX:52941 VERIFY OK: depth=1, C=DE, ST=BER, L=[]], O=[org-name], OU=[org-name], CN=[org-name] CA, name=EasyRSA, emailAddress=key@[org-name].com
Mar 10 16:39:29 [server-name] ovpn-server[483]: 79.245.XXX.XXX:52941 VERIFY OK: depth=0, C=DE, ST=BER, L=[]], O=[org-name], OU=[org-name], CN=[server-name]-client, name=EasyRSA, emailAddress=key@[org-name].com
Mar 10 16:39:30 [server-name] ovpn-server[483]: 79.245.XXX.XXX:52941 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mar 10 16:39:30 [server-name] ovpn-server[483]: 79.245.XXX.XXX:52941 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mar 10 16:39:30 [server-name] ovpn-server[483]: 79.245.XXX.XXX:52941 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mar 10 16:39:30 [server-name] ovpn-server[483]: 79.245.XXX.XXX:52941 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mar 10 16:39:30 [server-name] ovpn-server[483]: 79.245.XXX.XXX:52941 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mar 10 16:39:30 [server-name] ovpn-server[483]: 79.245.XXX.XXX:52941 [[server-name]-client] Peer Connection Initiated with [AF_INET]79.245.XXX.XXX:52941
Mar 10 16:39:30 [server-name] ovpn-server[483]: [server-name]-client/79.245.XXX.XXX:52941 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Mar 10 16:39:30 [server-name] ovpn-server[483]: [server-name]-client/79.245.XXX.XXX:52941 MULTI: Learn: 10.8.0.6 -> [server-name]-client/79.245.XXX.XXX:52941
Mar 10 16:39:30 [server-name] ovpn-server[483]: [server-name]-client/79.245.XXX.XXX:52941 MULTI: primary virtual IP for [server-name]-client/79.245.XXX.XXX:52941: 10.8.0.6
Mar 10 16:39:36 [server-name] ovpn-server[483]: [server-name]-client/79.245.XXX.XXX:52941 PUSH: Received control message: 'PUSH_REQUEST'
Mar 10 16:39:36 [server-name] ovpn-server[483]: [server-name]-client/79.245.XXX.XXX:52941 send_push_reply(): safe_cap=940
Mar 10 16:39:36 [server-name] ovpn-server[483]: [server-name]-client/79.245.XXX.XXX:52941 SENT CONTROL [[server-name]-client]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)

Client log

Tue Mar 10 21:39:14 2015 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Mar  4 2015
Tue Mar 10 21:39:14 2015 library versions: OpenSSL 1.0.1l 15 Jan 2015, LZO 2.08
Enter Management Password:
Tue Mar 10 21:39:14 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Tue Mar 10 21:39:14 2015 Need hold release from management interface, waiting...
Tue Mar 10 21:39:14 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Tue Mar 10 21:39:14 2015 MANAGEMENT: CMD 'state on'
Tue Mar 10 21:39:14 2015 MANAGEMENT: CMD 'log all on'
Tue Mar 10 21:39:14 2015 MANAGEMENT: CMD 'hold off'
Tue Mar 10 21:39:14 2015 MANAGEMENT: CMD 'hold release'
Tue Mar 10 21:39:14 2015 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Mar 10 21:39:14 2015 UDPv4 link local: [undef]
Tue Mar 10 21:39:14 2015 UDPv4 link remote: [AF_INET][server-ip]:1194
Tue Mar 10 21:39:14 2015 MANAGEMENT: >STATE:1426019954,WAIT,,,
Tue Mar 10 21:39:14 2015 MANAGEMENT: >STATE:1426019954,AUTH,,,
Tue Mar 10 21:39:14 2015 TLS: Initial packet from [AF_INET][server-ip]:1194, sid=263adf9b e6849787
Tue Mar 10 21:39:22 2015 VERIFY OK: depth=1, C=DE, ST=BER, L=[]], O=[org-name], OU=[org-name], CN=[org-name] CA, name=EasyRSA, emailAddress=key@[org-name].com
Tue Mar 10 21:39:22 2015 VERIFY OK: nsCertType=SERVER
Tue Mar 10 21:39:22 2015 VERIFY OK: depth=0, C=DE, ST=BER, L=[]], O=[org-name], OU=[org-name], CN=[server-name]], name=EasyRSA, emailAddress=key@[org-name].com
Tue Mar 10 21:39:34 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Mar 10 21:39:34 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 10 21:39:34 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Mar 10 21:39:34 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 10 21:39:37 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Tue Mar 10 21:39:37 2015 [[server-name]] Peer Connection Initiated with [AF_INET][server-ip]:1194
Tue Mar 10 21:39:38 2015 MANAGEMENT: >STATE:1426019978,GET_CONFIG,,,
Tue Mar 10 21:39:39 2015 SENT CONTROL [[server-name]]: 'PUSH_REQUEST' (status=1)
Tue Mar 10 21:39:39 2015 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Tue Mar 10 21:39:39 2015 OPTIONS IMPORT: timers and/or timeouts modified
Tue Mar 10 21:39:39 2015 OPTIONS IMPORT: --ifconfig/up options modified
Tue Mar 10 21:39:39 2015 OPTIONS IMPORT: route options modified
Tue Mar 10 21:39:39 2015 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Mar 10 21:39:39 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Mar 10 21:39:39 2015 MANAGEMENT: >STATE:1426019979,ASSIGN_IP,,10.8.0.6,
Tue Mar 10 21:39:39 2015 open_tun, tt->ipv6=0
Tue Mar 10 21:39:39 2015 TAP-WIN32 device [LAN-Verbindung 4] opened: \\.\Global\{57ACE824-B123-4425-B519-0480B13EECB1}.tap
Tue Mar 10 21:39:39 2015 TAP-Windows Driver Version 9.21 
Tue Mar 10 21:39:39 2015 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {57ACE824-B123-4425-B519-0480B13EECB1} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Tue Mar 10 21:39:39 2015 Successful ARP Flush on interface [23] {57ACE824-B123-4425-B519-0480B13EECB1}
Tue Mar 10 21:39:44 2015 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Tue Mar 10 21:39:44 2015 C:\Windows\system32\route.exe ADD [server-ip] MASK 255.255.255.255 192.168.2.1
Tue Mar 10 21:39:44 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4
Tue Mar 10 21:39:44 2015 Route addition via IPAPI succeeded [adaptive]
Tue Mar 10 21:39:44 2015 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5
Tue Mar 10 21:39:44 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Tue Mar 10 21:39:44 2015 Route addition via IPAPI succeeded [adaptive]
Tue Mar 10 21:39:44 2015 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.5
Tue Mar 10 21:39:44 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Tue Mar 10 21:39:44 2015 Route addition via IPAPI succeeded [adaptive]
Tue Mar 10 21:39:44 2015 MANAGEMENT: >STATE:1426019984,ADD_ROUTES,,,
Tue Mar 10 21:39:44 2015 C:\Windows\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Tue Mar 10 21:39:44 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Tue Mar 10 21:39:44 2015 Route addition via IPAPI succeeded [adaptive]
Tue Mar 10 21:39:44 2015 Initialization Sequence Completed
Tue Mar 10 21:39:44 2015 MANAGEMENT: >STATE:1426019984,CONNECTED,SUCCESS,10.8.0.6,[server-ip]

maikcat

post your NAT rule used please.

Michael.

speedracr_ovpn

NAT rule = iptables -L -t nat ?

Here is what I have for that:

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  10.0.0.0/8           anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

maikcat

is your vps a vz container?

if yes please post the iptables rule you used (not the output of iptables -L -t nat command)

also post the output of ifconfig

Michael.

speedracr_ovpn

Thanks Michael -
yes, it is an OpenVZ container. How do I see the iptables rule that is used?

ifconfig:

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:1506 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:288803 (288.8 KB)  TX bytes:600 (600.0 B)

venet0    Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:127.0.0.2  P-t-P:127.0.0.2  Bcast:0.0.0.0  Mask:255.255.255.255
          UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1
          RX packets:7665 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4586 errors:0 dropped:1492 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:930326 (930.3 KB)  TX bytes:872419 (872.4 KB)

venet0:0  Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:[server-ip]  P-t-P:[server-ip]  Bcast:[server-ip]  Mask:255.255.255.255
          UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1

maikcat

How do I see the iptables rule that is used?

it doesnt matter,simply remove it and use this:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o venet0:0 -j SNAT --to-source 1.2.3.4   1.2.3.4 is openvz real ip

Michael.

speedracr_ovpn

Thanks Michael! Didn't work initially, but changing

venet0:0

venet0

did the trick for Tunnelblick and I'll check my Windows client later.
If I understood the iptables guides correctly, I should save the current iptables rules and have them load automatically on boot - is there an easy way to do that?

maikcat

I should save the current iptables rules and have them load automatically on boot - is there an easy way to do that?

AFAIK you can use iptables-save script to create the /etc/sysconfig/iptables file then start iptables as a service..

Michael.

speedracr_ovpn

OK, mostly wanted to make sure I'm not missing a simple fix - I have now added the iptables-persistent package as per http://stackoverflow.com/questions/9330694/how-to-permanently-update-iptables and am all set up.

Thanks again, Michael!

maikcat

Thanks again, Michael!

You welcome 😃

Marked as solved,

Closing topic

Regards,

Michael.