Hello everyone,
I started to setup an openvpn-server for a friend. Because at his university he has
a restricted network, which doesn't allow that much (some online games).
For me with this config its working very well with Tunnelblick on OS X.
But my friend behind his NAT*ed network it doesn't work.
I tried a few things but I'm not able to get this working.
Server IP is: 89.XX.XX.XX
Public IP from my friend is: 195.XX.XX.XX
Private IP my friend network is: 10.203.0.77
Any help would be appreciated.
I just used some parts from the logs, if more is necessary let me know it.
Thanks.
Server config:
port 443
proto tcp-server
dev tun
ca easy-rsa/keys/ca.crt
cert easy-rsa/keys/example.orgcrt
key easy-rsa/keys/exapmle.org.key # This file should be kept secret
tls-auth /etc/openvpn/tls-auth.key 0
dh easy-rsa/keys/dh2048.pem
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
push "topology subnet"
topology subnet
ifconfig-pool-persist ipp.txt
client-config-dir ccd
route 10.203.0.0 255.255.255.0
route 10.8.0.0 255.255.255.0
route-gateway 10.8.0.1
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status log/openvpn-status.log
verb 4
script-security 1
tcp-queue-limit 256
tls-version-min 1.2
cipher AES-256-CBC
auth SHA512
tls-cipher TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256:TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256:TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256
ccd/client2 file:
iroute 10.203.0.0 255.255.255.0
Client config:
client
remote example.org 443
ca ca.crt
cert client2.crt
key client2.key
comp-lzo yes
dev tun
proto tcp-client
nobind
auth-nocache
script-security 2
ns-cert-type server
persist-key
persist-tun
user nobody
group nogroup
remote-cert-tls server
tls-version-min 1.2
tls-auth tls-auth.key 1
cipher AES-256-CBC
auth SHA512
tls-cipher TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256:TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256:TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256
Server log:
Nov 21 14:59:01 vpn ovpn-server[5034]: 195.XX.XX.XX:11809 [client2] Peer Connection Initiated with [AF_INET]195.XX.XX.XX:11809
Nov 21 14:59:01 vpn ovpn-server[5034]: client2/195.XX.XX.XX:11809 OPTIONS IMPORT: reading client specific options from: ccd/client2
Nov 21 14:59:01 vpn ovpn-server[5034]: client2/195.XX.XX.XX:11809 MULTI_sva: pool returned IPv4=10.8.0.5, IPv6=(Not enabled)
Nov 21 14:59:01 vpn ovpn-server[5034]: client2/195.XX.XX.XX:11809 MULTI: Learn: 10.8.0.5 -> client2/195.XX.XX.XX:11809
Nov 21 14:59:01 vpn ovpn-server[5034]: client2/195.XX.XX.XX:11809 MULTI: primary virtual IP for client2/195.XX.XX.XX:11809: 10.8.0.5
Nov 21 14:59:01 vpn ovpn-server[5034]: client2/195.XX.XX.XX:11809 MULTI: internal route 10.203.0.0/24 -> client2/195.XX.XX.XX:11809
Nov 21 14:59:01 vpn ovpn-server[5034]: client2/195.XX.XX.XX:11809 MULTI: Learn: 10.203.0.0/24 -> client2/195.XX.XX.XX:11809
Nov 21 14:59:03 vpn ovpn-server[5034]: client2/195.XX.XX.XX:11809 PUSH: Received control message: 'PUSH_REQUEST'
Nov 21 14:59:03 vpn ovpn-server[5034]: client2/195.XX.XX.XX:11809 send_push_reply(): safe_cap=940
Nov 21 14:59:03 vpn ovpn-server[5034]: client2/195.XX.XX.XX:11809 SENT CONTROL [cesy]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,topology subnet,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.5 255.255.255.0' (status=1)
Nov 21 14:59:04 vpn ovpn-server[5034]: client2/195.XX.XX.XX:11809 MULTI: Learn: 10.203.0.77 -> client2/195.XX.XX.XX:11809
Client log:
Sat Nov 21 14:58:41 2015 us=171051 OPTIONS IMPORT: timers and/or timeouts modified
Sat Nov 21 14:58:41 2015 us=171067 OPTIONS IMPORT: --ifconfig/up options modified
Sat Nov 21 14:58:41 2015 us=171075 OPTIONS IMPORT: route options modified
Sat Nov 21 14:58:41 2015 us=171084 OPTIONS IMPORT: route-related options modified
Sat Nov 21 14:58:41 2015 us=171092 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sat Nov 21 14:58:41 2015 us=171294 ROUTE_GATEWAY 10.203.0.254/255.255.252.0 IFACE=eth0 HWADDR=60:02:92:30:a9:2b
Sat Nov 21 14:58:41 2015 us=171676 TUN/TAP device tun0 opened
Sat Nov 21 14:58:41 2015 us=171708 TUN/TAP TX queue length set to 100
Sat Nov 21 14:58:41 2015 us=171734 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sat Nov 21 14:58:41 2015 us=171778 /sbin/ip link set dev tun0 up mtu 1500
Sat Nov 21 14:58:41 2015 us=173545 /sbin/ip addr add dev tun0 10.8.0.5/24 broadcast 10.8.0.255
Sat Nov 21 14:58:41 2015 us=175709 /sbin/ip route add 89.XX.XX.XX/32 via 10.203.0.254
Sat Nov 21 14:58:41 2015 us=176859 /sbin/ip route add 0.0.0.0/1 via 10.8.0.1
Sat Nov 21 14:58:41 2015 us=178828 /sbin/ip route add 128.0.0.0/1 via 10.8.0.1
Sat Nov 21 14:58:41 2015 us=181108 GID set to nogroup
Sat Nov 21 14:58:41 2015 us=181137 UID set to nobody
Sat Nov 21 14:58:41 2015 us=181144 Initialization Sequence Completed
Iptables rules:
*filter
-A FORWARD -o eth0 -i tun0 -s 10.8.0.0/24 -m conntrack --ctstate NEW -j ACCEPT
*nat
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
