OpenVPN server not recieving tun0 traffic

priyoaujla

I had another topic (https://forums.openvpn.net/topic18850.html) posted but all my replies are not being posted to that topic so I have created another with hopefully the correct info as per the forum rules.

I want to setup a VPN so that my clients have the office IP to allow them to access internet services which are IP blocked (only Office IP access). I have the OpenVPN server and the client sitting on the same LAN whilst I am testing. Once OpenVPN is setup correctly I will have the port forwarding done on the office internet router.

The traffic from my client is not being received by the server on tun0 interface, I confirmed this using tcpdump.

I have only used one iptable rules as per suggestions from Traffic on my previous topic (please see above).

Server config

port 1194
proto udp
dev tun
ca /opt/easyrsa/EasyRSA-2.2.2/keys/ca.crt
cert /opt/easyrsa/EasyRSA-2.2.2/keys/the-key.net.crt
key /opt/easyrsa/EasyRSA-2.2.2/keys/the-key.key
dh /opt/easyrsa/EasyRSA-2.2.2/keys/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS 10.8.0.1"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

Client config

client
dev tun
proto udp
remote 10.29.66.236 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert priyo.crt
key priyo.key
comp-lzo
verb 3

Server log before client connects

Wed May 20 09:14:47 2015 OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Dec  1 2014
Wed May 20 09:14:47 2015 Diffie-Hellman initialized with 2048 bit key
Wed May 20 09:14:47 2015 Socket Buffers: R=[212992->131072] S=[212992->131072]
Wed May 20 09:14:47 2015 ROUTE_GATEWAY 10.29.66.1/255.255.255.0 IFACE=eth0 HWADDR=00:1f:16:fa:08:41
Wed May 20 09:14:47 2015 TUN/TAP device tun0 opened
Wed May 20 09:14:47 2015 TUN/TAP TX queue length set to 100
Wed May 20 09:14:47 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed May 20 09:14:47 2015 /sbin/ip link set dev tun0 up mtu 1500
Wed May 20 09:14:47 2015 /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
Wed May 20 09:14:47 2015 /sbin/ip route add 10.8.0.0/24 via 10.8.0.2
Wed May 20 09:14:47 2015 UDPv4 link local (bound): [undef]
Wed May 20 09:14:47 2015 UDPv4 link remote: [undef]
Wed May 20 09:14:47 2015 MULTI: multi_init called, r=256 v=256
Wed May 20 09:14:47 2015 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Wed May 20 09:14:47 2015 ifconfig_pool_read(), in='priyo,10.8.0.4', TODO: IPv6
Wed May 20 09:14:47 2015 succeeded -> ifconfig_pool_set()
Wed May 20 09:14:47 2015 IFCONFIG POOL LIST
Wed May 20 09:14:47 2015 priyo,10.8.0.4
Wed May 20 09:14:47 2015 Initialization Sequence Complete

Client log

Wed May 20 09:14:32 2015 OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Dec  1 2014
Wed May 20 09:14:32 2015 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Wed May 20 09:14:33 2015 Socket Buffers: R=[212992->131072] S=[212992->131072]
Wed May 20 09:14:33 2015 UDPv4 link local: [undef]
Wed May 20 09:14:33 2015 UDPv4 link remote: [AF_INET]10.29.66.236:1194
Wed May 20 09:14:33 2015 TLS: Initial packet from [AF_INET]10.29.66.236:1194, sid=c4c8d226 ce4623ce
Wed May 20 09:14:33 2015 VERIFY OK: depth=1, C=UK, ST=London, L=London, O=Smartology Ltd, OU=Development Team, CN=smartology-vpn, name=smartology-vpn, emailAddress=operations@smartology.net
Wed May 20 09:14:33 2015 VERIFY OK: depth=0, C=UK, ST=London, L=London, O=Smartology Ltd, OU=Development Team, CN=vpn.smartology.net, name=smartology-vpn, emailAddress=operations@smartology.net
Wed May 20 09:14:33 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed May 20 09:14:33 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed May 20 09:14:33 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed May 20 09:14:33 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed May 20 09:14:33 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed May 20 09:14:33 2015 [vpn.smartology.net] Peer Connection Initiated with [AF_INET]10.29.66.236:1194
Wed May 20 09:14:35 2015 SENT CONTROL [vpn.smartology.net]: 'PUSH_REQUEST' (status=1)
Wed May 20 09:14:35 2015 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 10.8.0.1,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Wed May 20 09:14:35 2015 OPTIONS IMPORT: timers and/or timeouts modified
Wed May 20 09:14:35 2015 OPTIONS IMPORT: --ifconfig/up options modified
Wed May 20 09:14:35 2015 OPTIONS IMPORT: route options modified
Wed May 20 09:14:35 2015 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed May 20 09:14:35 2015 ROUTE_GATEWAY 10.29.66.1/255.255.255.0 IFACE=eth0 HWADDR=88:51:fb:51:d2:ad
Wed May 20 09:14:35 2015 TUN/TAP device tun0 opened
Wed May 20 09:14:35 2015 TUN/TAP TX queue length set to 100
Wed May 20 09:14:35 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed May 20 09:14:35 2015 /sbin/ip link set dev tun0 up mtu 1500
Wed May 20 09:14:35 2015 /sbin/ip addr add dev tun0 local 10.8.0.6 peer 10.8.0.5
Wed May 20 09:14:35 2015 /sbin/ip route add 10.29.66.236/32 via 10.29.66.1
Wed May 20 09:14:35 2015 /sbin/ip route add 0.0.0.0/1 via 10.8.0.5
Wed May 20 09:14:35 2015 /sbin/ip route add 128.0.0.0/1 via 10.8.0.5
Wed May 20 09:14:35 2015 /sbin/ip route add 10.8.0.1/32 via 10.8.0.5
Wed May 20 09:14:35 2015 Initialization Sequence Completed

Server log after client connects

Wed May 20 09:17:24 2015 10.29.66.13:41067 TLS: Initial packet from [AF_INET]10.29.66.13:41067, sid=98d07e07 bae04f2a
Wed May 20 09:17:24 2015 10.29.66.13:41067 VERIFY OK: depth=1, C=UK, ST=London, L=London, O=Smartology Ltd, OU=Development Team, CN=smartology-vpn, name=smartology-vpn, emailAddress=operations@smartology.net
Wed May 20 09:17:24 2015 10.29.66.13:41067 VERIFY OK: depth=0, C=UK, ST=London, L=London, O=Smartology Ltd, OU=Development Team, CN=priyo, name=EasyRSA, emailAddress=priyo.aujla@smartology.net
Wed May 20 09:17:24 2015 10.29.66.13:41067 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed May 20 09:17:24 2015 10.29.66.13:41067 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed May 20 09:17:24 2015 10.29.66.13:41067 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed May 20 09:17:24 2015 10.29.66.13:41067 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed May 20 09:17:24 2015 10.29.66.13:41067 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed May 20 09:17:24 2015 10.29.66.13:41067 [priyo] Peer Connection Initiated with [AF_INET]10.29.66.13:41067
Wed May 20 09:17:24 2015 priyo/10.29.66.13:41067 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Wed May 20 09:17:24 2015 priyo/10.29.66.13:41067 MULTI: Learn: 10.8.0.6 -> priyo/10.29.66.13:41067
Wed May 20 09:17:24 2015 priyo/10.29.66.13:41067 MULTI: primary virtual IP for priyo/10.29.66.13:41067: 10.8.0.6
Wed May 20 09:17:27 2015 priyo/10.29.66.13:41067 PUSH: Received control message: 'PUSH_REQUEST'
Wed May 20 09:17:27 2015 priyo/10.29.66.13:41067 send_push_reply(): safe_cap=940
Wed May 20 09:17:27 2015 priyo/10.29.66.13:41067 SENT CONTROL [priyo]: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 10.8.0.1,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)

route table on client

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.8.0.5        128.0.0.0       UG    0      0        0 tun0
0.0.0.0         10.29.66.1      0.0.0.0         UG    0      0        0 eth0
10.8.0.1        10.8.0.5        255.255.255.255 UGH   0      0        0 tun0
10.8.0.5        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
10.29.66.0      0.0.0.0         255.255.255.0   U     1      0        0 eth0
10.29.66.236    10.29.66.1      255.255.255.255 UGH   0      0        0 eth0
128.0.0.0       10.8.0.5        128.0.0.0       UG    0      0        0 tun0

I have disabled ufw to make troubleshooting easier.

/etc/sysctl.conf has the following uncommented.

net.ipv4.ip_forward=1

I used the following IPTables rule.

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

after running iptables -L -v i have the following output which i'm not sure if it is right.

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination        

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination        

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Traffic

priyoaujla wroteI have the OpenVPN server and the client sitting on the same LAN whilst I am testing.

the only ip address you can use to test this is the VPN IP: Server 10.8.0.1; Client 10.8.0.6

Try removing: push "redirect-gateway def1" from the server

From the server ping 10.8.0.6 (or what ever IP the client receives)

Your logs show no errors so if the ping does not work it is almost guaranteed to be a software firewall ..

priyoaujla

Hi Traffic,

Thank you for your responses, I commented out the push "redirect-gateway def1" this is what my server config looks like now

port 1194
proto udp
dev tun
ca /opt/easyrsa/EasyRSA-2.2.2/keys/ca.crt
cert /opt/easyrsa/EasyRSA-2.2.2/keys/vpn.smartology.net.crt
key /opt/easyrsa/EasyRSA-2.2.2/keys/vpn.smartology.net.key  # This file should be kept secret
dh /opt/easyrsa/EasyRSA-2.2.2/keys/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 10.8.0.1"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

I was able to ping the client from the server on its IP address of 10.8.0.6.

And the server output from a client connection

Thu May 28 13:09:07 2015 OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Dec  1 2014
Thu May 28 13:09:07 2015 Diffie-Hellman initialized with 2048 bit key
Thu May 28 13:09:07 2015 Socket Buffers: R=[212992->131072] S=[212992->131072]
Thu May 28 13:09:07 2015 ROUTE_GATEWAY 10.29.66.1/255.255.255.0 IFACE=eth0 HWADDR=00:1f:16:fa:08:41
Thu May 28 13:09:07 2015 TUN/TAP device tun0 opened
Thu May 28 13:09:07 2015 TUN/TAP TX queue length set to 100
Thu May 28 13:09:07 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu May 28 13:09:07 2015 /sbin/ip link set dev tun0 up mtu 1500
Thu May 28 13:09:07 2015 /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
Thu May 28 13:09:07 2015 /sbin/ip route add 10.8.0.0/24 via 10.8.0.2
Thu May 28 13:09:07 2015 UDPv4 link local (bound): [undef]
Thu May 28 13:09:07 2015 UDPv4 link remote: [undef]
Thu May 28 13:09:07 2015 MULTI: multi_init called, r=256 v=256
Thu May 28 13:09:07 2015 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Thu May 28 13:09:07 2015 ifconfig_pool_read(), in='priyo,10.8.0.4', TODO: IPv6
Thu May 28 13:09:07 2015 succeeded -> ifconfig_pool_set()
Thu May 28 13:09:07 2015 IFCONFIG POOL LIST
Thu May 28 13:09:07 2015 priyo,10.8.0.4
Thu May 28 13:09:07 2015 Initialization Sequence Completed

Thu May 28 13:09:13 2015 10.29.66.13:46756 TLS: Initial packet from [AF_INET]10.29.66.13:46756, sid=ecffec85 92ec825a
Thu May 28 13:09:13 2015 10.29.66.13:46756 VERIFY OK: depth=1, C=UK, ST=London, L=London, O=Smartology Ltd, OU=Development Team, CN=smartology-vpn, name=smartology-vpn, emailAddress=operations@smartology.net
Thu May 28 13:09:13 2015 10.29.66.13:46756 VERIFY OK: depth=0, C=UK, ST=London, L=London, O=Smartology Ltd, OU=Development Team, CN=priyo, name=EasyRSA, emailAddress=priyo.aujla@smartology.net
Thu May 28 13:09:13 2015 10.29.66.13:46756 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu May 28 13:09:13 2015 10.29.66.13:46756 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu May 28 13:09:13 2015 10.29.66.13:46756 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu May 28 13:09:13 2015 10.29.66.13:46756 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu May 28 13:09:13 2015 10.29.66.13:46756 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Thu May 28 13:09:13 2015 10.29.66.13:46756 [priyo] Peer Connection Initiated with [AF_INET]10.29.66.13:46756
Thu May 28 13:09:13 2015 priyo/10.29.66.13:46756 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Thu May 28 13:09:13 2015 priyo/10.29.66.13:46756 MULTI: Learn: 10.8.0.6 -> priyo/10.29.66.13:46756
Thu May 28 13:09:13 2015 priyo/10.29.66.13:46756 MULTI: primary virtual IP for priyo/10.29.66.13:46756: 10.8.0.6
Thu May 28 13:09:15 2015 priyo/10.29.66.13:46756 PUSH: Received control message: 'PUSH_REQUEST'
Thu May 28 13:09:15 2015 priyo/10.29.66.13:46756 send_push_reply(): safe_cap=940
Thu May 28 13:09:15 2015 priyo/10.29.66.13:46756 SENT CONTROL [priyo]: 'PUSH_REPLY,dhcp-option DNS 10.8.0.1,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)

And the client log

Thu May 28 13:09:30 2015 OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Dec  1 2014
Thu May 28 13:09:30 2015 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Thu May 28 13:09:30 2015 Socket Buffers: R=[212992->131072] S=[212992->131072]
Thu May 28 13:09:30 2015 UDPv4 link local: [undef]
Thu May 28 13:09:30 2015 UDPv4 link remote: [AF_INET]10.29.66.236:1194
Thu May 28 13:09:30 2015 TLS: Initial packet from [AF_INET]10.29.66.236:1194, sid=eab4b2df 2a812d34
Thu May 28 13:09:30 2015 VERIFY OK: depth=1, C=UK, ST=London, L=London, O=Smartology Ltd, OU=Development Team, CN=smartology-vpn, name=smartology-vpn, emailAddress=operations@smartology.net
Thu May 28 13:09:30 2015 VERIFY OK: depth=0, C=UK, ST=London, L=London, O=Smartology Ltd, OU=Development Team, CN=vpn.smartology.net, name=smartology-vpn, emailAddress=operations@smartology.net
Thu May 28 13:09:30 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu May 28 13:09:30 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu May 28 13:09:30 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu May 28 13:09:30 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu May 28 13:09:30 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Thu May 28 13:09:30 2015 [vpn.smartology.net] Peer Connection Initiated with [AF_INET]10.29.66.236:1194
Thu May 28 13:09:32 2015 SENT CONTROL [vpn.smartology.net]: 'PUSH_REQUEST' (status=1)
Thu May 28 13:09:32 2015 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 10.8.0.1,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Thu May 28 13:09:32 2015 OPTIONS IMPORT: timers and/or timeouts modified
Thu May 28 13:09:32 2015 OPTIONS IMPORT: --ifconfig/up options modified
Thu May 28 13:09:32 2015 OPTIONS IMPORT: route options modified
Thu May 28 13:09:32 2015 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu May 28 13:09:32 2015 ROUTE_GATEWAY 10.29.66.1/255.255.255.0 IFACE=eth0 HWADDR=88:51:fb:51:d2:ad
Thu May 28 13:09:32 2015 TUN/TAP device tun0 opened
Thu May 28 13:09:32 2015 TUN/TAP TX queue length set to 100
Thu May 28 13:09:32 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu May 28 13:09:32 2015 /sbin/ip link set dev tun0 up mtu 1500
Thu May 28 13:09:32 2015 /sbin/ip addr add dev tun0 local 10.8.0.6 peer 10.8.0.5
Thu May 28 13:09:32 2015 /sbin/ip route add 10.8.0.1/32 via 10.8.0.5
Thu May 28 13:09:32 2015 Initialization Sequence Completed

I made sure the ufw firewall which comes with Xubuntu was disabled and i re-run the test and put back the push "redirect-gateway def1" setting, I was unable to ping the server from the client or the client from the server. I don't think there is any other software firewall on xubuntu.

Do you think i should try this on a different variant of Lonux to reduce the number of config differences? If so which Linux distribution should i try?

TiTex

Are you sure that the network interface you are masquerading on is eth0 ?

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

in linux distros that are using systemd (the latest *ubuntu distros , that is 15.04 and up are using systemd by this blueprint https://blueprints.launchpad.net/ubuntu/+spec/xubuntu-v-features), this naming convention has changed ... usually it's something like enp0s3 or something similar

check with route -n or ip addr show

priyoaujla

Hi TiTex,

I ran route -n and the following is my output

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.29.66.1      0.0.0.0         UG    0      0        0 eth0
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.8.0.2        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
10.29.66.0      0.0.0.0         255.255.255.0   U     1      0        0 eth0

I think Xubuntu 14.04 is still using eth0.

My ipaddr show output

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 00:1f:16:fa:08:41 brd ff:ff:ff:ff:ff:ff
    inet 10.29.66.236/24 brd 10.29.66.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::21f:16ff:fefa:841/64 scope link
       valid_lft forever preferred_lft forever
9: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
    link/none
    inet 10.8.0.1 peer 10.8.0.2/32 scope global tun0
       valid_lft forever preferred_lft forever

Traffic

priyoaujla wroteI commented out the push "redirect-gateway def1"

priyoaujla wroteI was able to ping the client from the server on its IP address of 10.8.0.6

priyoaujla wroteput back the push "redirect-gateway def1" setting, I was unable to ping the server from the client or the client from the server

I have just setup a test VPN on a single LAN (server and client in the same LAN) with --push "redirect-gateway" and I can not replicate your problem ..

Note: the IP address on the client of 10.8.0.5 (gateway) is not ping-able by design only 10.8.0.1 of the server is ping-able ..

priyoaujla wroteDo you think i should try this on a different variant of Lonux

Xubuntu is ok.

The only suggestion I can give at this time is to setup all the machines in the real environment and not your test LAN and then see what happens.

TiTex

Since you are using NAT instead of routing , can you do some packet captures on the gateway and see if it does get traffic originating from 10.29.66.236 - openvpn server eth0 when you try to access the internet trough the vpn from a remote machine ?

maybe you could try with routing too , you just need to set up a manual route on your lan gateway for 10.8.0.0 255.255.255.0 , and also try pushing google public dns server to client 8.8.8.8 , and remove the iptables rule for NAT

also note this line in your server logs Wed May 20 09:14:47 2015 /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2 , i think by default you are using topology p2p if you don't specify otherwise in your config.

priyoaujla

Hi TiTex,

Thank you for responding, the Internet Gateway is managed by the buildingm, they prodivde us with a VLAN and the Internet access. Talking with their tech team and getting Port Forwarding done is a possibility and i shall raise the issue with my CTO, i avoided bringing in the Building's tech team unless i had a working VPN setup where a machine on the same LAN could tunnel traffic through tun0 and load a webpage.

Also I am not working on this full time, it's something i am only allowed to work on when I have free time which is not very often. I shall have to find some time after work to try out the google DNS option.