[Solved]Client connects fine, but no Internet connection

apoc

I just set up my first OpenVPN server and everything seems fine, but the client has no internet connection.

server config:

port 443
proto udp
dev tun
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/brimstone.crt
key /etc/openvpn/certs/brimstone.key  # This file should be kept secret
dh /etc/openvpn/certs/dh4096.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push redirect-gateway def1
keepalive 10 120
tls-cipher DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-CAMELLIA256-SHA:DHE-RSA-AES256-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-RSA-AES128-SHA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA
cipher AES-256-CBC
auth SHA384
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

iptables-save:

# Generated by iptables-save v1.4.14 on Fri Jul 24 07:44:57 2015
*raw
:PREROUTING ACCEPT [69770:12550856]
:OUTPUT ACCEPT [52469:5225827]
COMMIT
# Completed on Fri Jul 24 07:44:57 2015
# Generated by iptables-save v1.4.14 on Fri Jul 24 07:44:57 2015
*nat
:PREROUTING ACCEPT [171:11702]
:POSTROUTING ACCEPT [136:8184]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -s 10.8.0.0/24 -o venet0 -j MASQUERADE
COMMIT
# Completed on Fri Jul 24 07:44:57 2015
# Generated by iptables-save v1.4.14 on Fri Jul 24 07:44:57 2015
*mangle
:PREROUTING ACCEPT [69770:12550856]
:INPUT ACCEPT [69068:12508784]
:FORWARD ACCEPT [684:41112]
:OUTPUT ACCEPT [52469:5225827]
:POSTROUTING ACCEPT [53153:5266939]
COMMIT
# Completed on Fri Jul 24 07:44:57 2015
# Generated by iptables-save v1.4.14 on Fri Jul 24 07:44:57 2015
*filter
:INPUT DROP [25:2952]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [320:45993]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -m state --state NEW -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 443 -j ACCEPT
-A FORWARD -s 10.8.0.0/24 -j ACCEPT
COMMIT
# Completed on Fri Jul 24 07:44:57 2015

client config:

client
dev tun
proto udp
remote X.X.X.X 443
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/rytlock.crt
key /etc/openvpn/certs/rytlock.key
ns-cert-type server
tls-cipher DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-CAMELLIA256-SHA:DHE-RSA-AES256-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-RSA-AES128-SHA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA
cipher AES-256-CBC
auth SHA384
remote-cert-tls server
comp-lzo
verb 3

IPv4 forwarding is enabled on the server. When connected I can ping the 10.8.0.1.. The server itself is able to access the internet.

maikcat

since your server is a VZ container you do need to write tha NAT rule differently

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o venet0 -j SNAT --to-source 1.2.3.4

1.2.3.4 is your servers real ip

Michael.

Traffic

Is this a docs bug:

The Manual wrote--push option
Push a config file option back to the client for remote execution. Note that option must be enclosed in double quotes ("").

However:

apoc wroteserver config:

Code:

push redirect-gateway def1

no double quotes .. while the OP has not included logs, my tests show:

In my Server config:

push redirect-gateway def1

no double quotes ..

My Server log:

SENT CONTROL [xxx]: 'PUSH_REPLY,topology subnet,explicit-exit-notify 3,ping 10,ping-restart 30,comp-lzo no,redirect-gateway def1
...

My Client log:

SENT CONTROL [yyy]: 'PUSH_REQUEST' (status=1)
>LOG:1437737227,,PUSH: Received control message: 'PUSH_REPLY,topology subnet,explicit-exit-notify 3,ping 10,ping-restart 30,comp-lzo no,redirect-gateway def1,
...
>LOG:1437737227,,/usr/bin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 10.yyy
>LOG:1437737227,,/usr/bin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 10.yyy
>LOG:1437737227,I,Initialization Sequence Completed

curios .. worth raising a bug rep or not ? :?

apoc

maikcat wrotesince your server is a VZ container you do need to write tha NAT rule differently

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o venet0 -j SNAT --to-source 1.2.3.4

1.2.3.4 is your servers real ip

Michael.

Thanks for the answer, I removed the old nat rule and added the one you suggested, but the client still has no internet connection.

maikcat

please post:

clients logs
output of tracert 8.8.8.8 from your client.

Michael.

apoc

Solved.

I made quite a dumb mistake.. I simply forgot to ACCEPT ESTABLISHED & RELATED traffic for the FORWARD chain..