[Solved] connecting to server but i can't access to internet

ghorgor

Hi Everybody,

I'm trying to make a openvpn connection between a client in a docker container and a server which is probably on a xen host.

Here is my client config :

client
dev tun
proto udp
remote <MY_SERVER_PUBLIC_IP> <MY_OPENVPN_PORT>
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca keys/ca.crt
cert keys/my_user.crt
key keys/my_user.key
ns-cert-type server
tls-auth keys/ta.key 1
cipher AES-256-CBC
auth SHA512
comp-lzo
verb 3
tun-mtu 1492
redirect-gateway def1
status openvpn-status.log
log-append  openvpn.log
script-security 2
up "/etc/openvpn/clean-resolv-conf && /etc/openvpn/update-resolv-conf"
down /etc/openvpn/update-resolv-conf

if you're curious, here is the script clean-resolv-conf, which I wrote to make resolvconf to work in a container :

#!/bin/bash
umount /etc/resolv.conf
rm /etc/resolv.conf
ln -s /etc/resolvconf/run/resolv.conf /etc/resolv.conf

my client logs :

openvpn.log:
Sun Dec 27 20:49:57 2015 OpenVPN 2.3.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Dec  1 2014
Sun Dec 27 20:49:57 2015 library versions: OpenSSL 1.0.1k 8 Jan 2015, LZO 2.08
Sun Dec 27 20:49:57 2015 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sun Dec 27 20:49:57 2015 Control Channel Authentication: using 'keys/ta.key' as a OpenVPN static key file
Sun Dec 27 20:49:57 2015 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Sun Dec 27 20:49:57 2015 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Sun Dec 27 20:49:57 2015 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1492)
Sun Dec 27 20:49:57 2015 Socket Buffers: R=[212992->131072] S=[212992->131072]
Sun Dec 27 20:49:57 2015 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Sun Dec 27 20:49:57 2015 UDPv4 link local: [undef]
Sun Dec 27 20:49:57 2015 UDPv4 link remote: [AF_INET]<MY_SERVER_PUBLIC_IP>:<MY_OPENVPN_PORT>
Sun Dec 27 20:49:57 2015 TLS: Initial packet from [AF_INET]<MY_SERVER_PUBLIC_IP>:<MY_OPENVPN_PORT>, sid=5b0d6bc3 8d9c1b2e
Sun Dec 27 20:49:58 2015 VERIFY OK: depth=1, C=FR, ST=n/a, L=n/a, O=me, OU=me, CN=my CA, name=Me, emailAddress=me@mail.com
Sun Dec 27 20:49:58 2015 VERIFY OK: nsCertType=SERVER
Sun Dec 27 20:49:58 2015 VERIFY OK: depth=0, C=FR, ST=n/a, L=n/a, O=me, OU=me, CN=server, name=Me, emailAddress=me@mail.com
Sun Dec 27 20:50:03 2015 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sun Dec 27 20:50:03 2015 Data Channel Encrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Sun Dec 27 20:50:03 2015 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sun Dec 27 20:50:03 2015 Data Channel Decrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Sun Dec 27 20:50:03 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 8192 bit RSA
Sun Dec 27 20:50:03 2015 [server] Peer Connection Initiated with [AF_INET]<MY_SERVER_PUBLIC_IP>:<MY_OPENVPN_PORT>
Sun Dec 27 20:50:06 2015 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sun Dec 27 20:50:06 2015 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 80.67.169.12,dhcp-option DNS 80.67.169.40,route 10.8.49.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.49.6 10.8.49.5'
Sun Dec 27 20:50:06 2015 OPTIONS IMPORT: timers and/or timeouts modified
Sun Dec 27 20:50:06 2015 OPTIONS IMPORT: --ifconfig/up options modified
Sun Dec 27 20:50:06 2015 OPTIONS IMPORT: route options modified
Sun Dec 27 20:50:06 2015 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sun Dec 27 20:50:06 2015 ROUTE_GATEWAY 172.17.0.1/255.255.0.0 IFACE=eth0 HWADDR=03:36:bc:41:51:02
Sun Dec 27 20:50:06 2015 TUN/TAP device tun0 opened
Sun Dec 27 20:50:06 2015 TUN/TAP TX queue length set to 100
Sun Dec 27 20:50:06 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Dec 27 20:50:06 2015 /sbin/ip link set dev tun0 up mtu 1492
Sun Dec 27 20:50:06 2015 /sbin/ip addr add dev tun0 local 10.8.49.6 peer 10.8.49.5
Sun Dec 27 20:50:06 2015 /etc/openvpn/clean-resolv-conf && /etc/openvpn/update-resolv-conf tun0 1492 1594 10.8.49.6 10.8.49.5 init
Sun Dec 27 20:50:06 2015 /sbin/ip route add <MY_SERVER_PUBLIC_IP>/32 via 172.17.0.1
Sun Dec 27 20:50:06 2015 /sbin/ip route add 0.0.0.0/1 via 10.8.49.5
Sun Dec 27 20:50:06 2015 /sbin/ip route add 128.0.0.0/1 via 10.8.49.5
Sun Dec 27 20:50:06 2015 /sbin/ip route add 10.8.49.1/32 via 10.8.49.5
Sun Dec 27 20:50:06 2015 GID set to nogroup
Sun Dec 27 20:50:06 2015 UID set to nobody
Sun Dec 27 20:50:06 2015 Initialization Sequence Completed

I can't ping anything :

ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
^C--- 8.8.8.8 ping statistics ---
8 packets transmitted, 0 packets received, 100% packet loss

except for the openvpn server ip :

# ping <MY_SERVER_PUBLIC_IP>
PING <MY_SERVER_PUBLIC_IP> (<MY_SERVER_PUBLIC_IP>): 56 data bytes
64 bytes from <MY_SERVER_PUBLIC_IP>: icmp_seq=0 ttl=52 time=70.411 ms
64 bytes from <MY_SERVER_PUBLIC_IP>: icmp_seq=1 ttl=52 time=71.218 ms
^C--- <MY_SERVER_PUBLIC_IP> ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss

I don't think it's a dns problem, here is my resolv.conf :

cat /etc/resolv.conf
# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 80.67.169.12
nameserver 80.67.169.40

on the docker host and on the openvpn server host I use ufw and I've put the good settings to forward packets (I think):
in /etc/default/ufw :

DEFAULT_FORWARD_POLICY="ACCEPT"

# cat /proc/sys/net/ipv4/ip_forward
1

and on the open vpn server:

# ufw status
Status: active

To                         Action      From
--                         ------      ----
<MY_SERVER_PUBLIC_IP> <MY_OPENVPN_PORT>/udp    ALLOW       <MY_PUBLIC_IP>

Here is my server conf :

port <MY_OPENVPN_PORT>
proto udp
dev tun
ca keys/ca.crt
cert keys/server.crt
key keys/server.key  # This file should be kept secret
dh keys/dh8192.pem
server 10.8.49.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 80.67.169.12"
push "dhcp-option DNS 80.67.169.40"
keepalive 10 120
tls-auth keys/ta.key 0 # This file is secret
cipher AES-256-CBC   # AES
comp-lzo
max-clients 2
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log         openvpn.log
log-append  openvpn.log
verb 3
mute 5
script-security 2
tun-mtu 1492
auth SHA512

What's wrong with this ? I've tried to disable ufw on both the docker host and the openvpn server but it didn’t work, either

Thanks in advance for your help.

Traffic

Do you have iptables on the server ?

ghorgor

iptable is installed, it's a ufw dependancy.

Here is the iptable config :

iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination         
ufw-before-logging-input  all  --  anywhere             anywhere            
ufw-before-input  all  --  anywhere             anywhere            
ufw-after-input  all  --  anywhere             anywhere            
ufw-after-logging-input  all  --  anywhere             anywhere            
ufw-reject-input  all  --  anywhere             anywhere            
ufw-track-input  all  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ufw-before-logging-forward  all  --  anywhere             anywhere            
ufw-before-forward  all  --  anywhere             anywhere            
ufw-after-forward  all  --  anywhere             anywhere            
ufw-after-logging-forward  all  --  anywhere             anywhere            
ufw-reject-forward  all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ufw-before-logging-output  all  --  anywhere             anywhere            
ufw-before-output  all  --  anywhere             anywhere            
ufw-after-output  all  --  anywhere             anywhere            
ufw-after-logging-output  all  --  anywhere             anywhere            
ufw-reject-output  all  --  anywhere             anywhere            
ufw-track-output  all  --  anywhere             anywhere            

Chain ufw-after-forward (1 references)
target     prot opt source               destination         

Chain ufw-after-input (1 references)
target     prot opt source               destination         
ufw-skip-to-policy-input  udp  --  anywhere             anywhere             udp dpt:netbios-ns
ufw-skip-to-policy-input  udp  --  anywhere             anywhere             udp dpt:netbios-dgm
ufw-skip-to-policy-input  tcp  --  anywhere             anywhere             tcp dpt:netbios-ssn
ufw-skip-to-policy-input  tcp  --  anywhere             anywhere             tcp dpt:microsoft-ds
ufw-skip-to-policy-input  udp  --  anywhere             anywhere             udp dpt:bootps
ufw-skip-to-policy-input  udp  --  anywhere             anywhere             udp dpt:bootpc
ufw-skip-to-policy-input  all  --  anywhere             anywhere             ADDRTYPE match dst-type BROADCAST

Chain ufw-after-logging-forward (1 references)
target     prot opt source               destination         

Chain ufw-after-logging-input (1 references)
target     prot opt source               destination         
LOG        all  --  anywhere             anywhere             limit: avg 3/min burst 10 LOG level warning prefix "[UFW BLOCK] "

Chain ufw-after-logging-output (1 references)
target     prot opt source               destination         

Chain ufw-after-output (1 references)
target     prot opt source               destination         

Chain ufw-before-forward (1 references)
target     prot opt source               destination         
ufw-user-forward  all  --  anywhere             anywhere            

Chain ufw-before-input (1 references)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ufw-logging-deny  all  --  anywhere             anywhere             state INVALID
DROP       all  --  anywhere             anywhere             state INVALID
ACCEPT     icmp --  anywhere             anywhere             icmp destination-unreachable
ACCEPT     icmp --  anywhere             anywhere             icmp source-quench
ACCEPT     icmp --  anywhere             anywhere             icmp time-exceeded
ACCEPT     icmp --  anywhere             anywhere             icmp parameter-problem
ACCEPT     icmp --  anywhere             anywhere             icmp echo-request
ACCEPT     udp  --  anywhere             anywhere             udp spt:bootps dpt:bootpc
ufw-not-local  all  --  anywhere             anywhere            
ACCEPT     udp  --  anywhere             224.0.0.251          udp dpt:mdns
ACCEPT     udp  --  anywhere             239.255.255.250      udp dpt:1900
ufw-user-input  all  --  anywhere             anywhere            

Chain ufw-before-logging-forward (1 references)
target     prot opt source               destination         

Chain ufw-before-logging-input (1 references)
target     prot opt source               destination         

Chain ufw-before-logging-output (1 references)
target     prot opt source               destination         

Chain ufw-before-output (1 references)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ufw-user-output  all  --  anywhere             anywhere            

Chain ufw-logging-allow (0 references)
target     prot opt source               destination         
LOG        all  --  anywhere             anywhere             limit: avg 3/min burst 10 LOG level warning prefix "[UFW ALLOW] "

Chain ufw-logging-deny (2 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere             state INVALID limit: avg 3/min burst 10
LOG        all  --  anywhere             anywhere             limit: avg 3/min burst 10 LOG level warning prefix "[UFW BLOCK] "

Chain ufw-not-local (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere             ADDRTYPE match dst-type LOCAL
RETURN     all  --  anywhere             anywhere             ADDRTYPE match dst-type MULTICAST
RETURN     all  --  anywhere             anywhere             ADDRTYPE match dst-type BROADCAST
ufw-logging-deny  all  --  anywhere             anywhere             limit: avg 3/min burst 10
DROP       all  --  anywhere             anywhere            

Chain ufw-reject-forward (1 references)
target     prot opt source               destination         

Chain ufw-reject-input (1 references)
target     prot opt source               destination         

Chain ufw-reject-output (1 references)
target     prot opt source               destination         

Chain ufw-skip-to-policy-forward (0 references)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            

Chain ufw-skip-to-policy-input (7 references)
target     prot opt source               destination         
DROP       all  --  anywhere             anywhere            

Chain ufw-skip-to-policy-output (0 references)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            

Chain ufw-track-input (1 references)
target     prot opt source               destination         

Chain ufw-track-output (1 references)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere             state NEW
ACCEPT     udp  --  anywhere             anywhere             state NEW

Chain ufw-user-forward (1 references)
target     prot opt source               destination         

Chain ufw-user-input (1 references)
target     prot opt source               destination         
ACCEPT     tcp  --  <MY_PUBLIC_HOSTNAME>  <MY_SERVER_PUBLIC_IP>        tcp dpt:<ANOTHER_PORT_FOR_SOMETHING_ELSE>
ACCEPT     udp  --  <MY_PUBLIC_HOSTNAME>  <MY_SERVER_PUBLIC_IP>        udp dpt:<MY_OPENVPN_PORT>

Chain ufw-user-limit (0 references)
target     prot opt source               destination         
LOG        all  --  anywhere             anywhere             limit: avg 3/min burst 5 LOG level warning prefix "[UFW LIMIT BLOCK] "
REJECT     all  --  anywhere             anywhere             reject-with icmp-port-unreachable

Chain ufw-user-limit-accept (0 references)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            

Chain ufw-user-logging-forward (0 references)
target     prot opt source               destination         

Chain ufw-user-logging-input (0 references)
target     prot opt source               destination         

Chain ufw-user-logging-output (0 references)
target     prot opt source               destination         

Chain ufw-user-output (1 references)
target     prot opt source               destination

But when I try to ping or to access a webserver on the internet I don't have any log in /var/log/syslog.

Traffic

I am not going to debug your iptables rules ..
However, this page: HOWTO: Routing all client traffic (including web-traffic) through the VPN
explains what you need to complete your setup. * Note the iptables rule for NAT.

ghorgor

OMG ! thanks a lot ! Finally, it's working. 😃

I just add this lines on top of the file /etc/ufw/before.rules :

# NAT table rules
*nat
:POSTROUTING ACCEPT [0:0]

# Forward traffic through eth0 - Change to match you out-interface
-A POSTROUTING -s 10.8.49.0/24 -o eth0 -j MASQUERADE

# don't delete the 'COMMIT' line or these nat table rules won't
# be processed
COMMIT

I've tried this before but I didn’t understand that the "COMMIT" at the end of the file apply only to the current section and not to the whole file...

Thanks again.