[Solved] VPN connected but no internet access. CENTOS ESXi

aaaa2209

Hello,
I set up the OpenVPN server in CentOS 7 (ESXi virtual machine)and have windows XP/7 connected to the server sucessfully. But the client cannot ping outside like 4.2.2.2 and have not internet access.
The client didnot get a normal IP in my eyes. It got something like 192.168.200.6/30 and the gateway isn't 192.168.200.1 but 192.168.200.5. Sometimes it gets 192.168.200.10/30 with a gateway 192.168.200.9.
But I set up as 192.168.200.0/24 in /etc/openvpn/server.conf. Did I miss something?
The server (192.168.200.1) and the client (192.168.200.6) can ping each other.

I mainly follow this link to set up my VPN.
https://www.howtoforge.com/tutorial/how-to-install-openvpn-on-centos-7/

Here is the server config:

[root@static-server tech]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

---------------------------------------------

[root@static-server tech]# vim /etc/sysconfig/iptablesvpn

# Generated by iptables-save v1.4.21 on Wed Mar 30 17:03:43 2016
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 192.168.200.0/24 -o ens32 -j MASQUERADE
COMMIT
# Completed on Wed Mar 30 17:03:43 2016
# Generated by iptables-save v1.4.21 on Wed Mar 30 17:03:43 2016
*filter
:INPUT ACCEPT [6738:611451]
:FORWARD ACCEPT [1191:69744]
:OUTPUT ACCEPT [5479:467681]
COMMIT
# Completed on Wed Mar 30 17:03:43 2016
~

---------------------------------------------

[root@static-server tech]# vim /etc/openvpn/server.conf

#change with your port
port 2016

#You can use udp or tcp
proto udp

# "dev tun" will create a routed IP tunnel.
dev tun

#Certificate Configuration

#ca certificate
ca /etc/openvpn/keys/ca.crt

#Server Certificate
cert /etc/openvpn/keys/server.crt

#Server Key and keep this is secret
key /etc/openvpn/keys/server.key

#See the size a dh key in /etc/openvpn/keys/
dh /etc/openvpn/keys/dh2048.pem

#Internal IP will get when already connect
server 192.168.200.0 255.255.255.0

#this line will redirect all traffic through our OpenVPN
push "redirect-gateway def1"

#Provide DNS servers to the client, you can use goolge DNS
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

#Enable multiple client to connect with same key
duplicate-cn

keepalive 20 60
comp-lzo
persist-key
persist-tun
daemon

#enable log
log-append /var/log/myvpn/openvpn.log

#Log Level
verb 3
~
~

---------------------------------------
[root@static-server keys]# ping 192.168.200.5
PING 192.168.200.5 (192.168.200.5) 56(84) bytes of data.
^C
--- 192.168.200.5 ping statistics ---
14 packets transmitted, 0 received, 100% packet loss, time 12999ms

[root@static-server keys]# ping 192.168.200.6
PING 192.168.200.6 (192.168.200.6) 56(84) bytes of data.
64 bytes from 192.168.200.6: icmp_seq=1 ttl=128 time=2.83 ms
64 bytes from 192.168.200.6: icmp_seq=2 ttl=128 time=5.23 ms
^C
--- 192.168.200.6 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 2.832/4.034/5.236/1.202 ms
[root@static-server keys]#
[root@static-server keys]# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens32: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 00:0c:29:6b:2a:57 brd ff:ff:ff:ff:ff:ff
inet x.31.22.59/24 brd x.38.226.255 scope global ens32
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fe6b:2a57/64 scope link
valid_lft forever preferred_lft forever
3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100
link/none
inet 192.168.200.1 peer 192.168.200.2/32 scope global tun0
valid_lft forever preferred_lft forever

client's setting:

client.ovpn:

client
dev tun
proto udp

#Server IP and Port
remote <server's WAN ip address> 2016

resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ca ca.crt
cert client.crt
key client.key
ns-cert-type server
comp-lzo

----------------------------------------------------------

C:\Documents and Settings\LL>ipconfig

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : CiscoR
Description . . . . . . . . . . . : Intel(R) 82562V-2 10/100 Network Con
nection
Physical Address. . . . . . . . . : 00-1A-A0-9C-1B-82
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.1.76
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.168
DHCP Server . . . . . . . . . . . : 192.168.1.168
DNS Servers . . . . . . . . . . . : 192.168.1.157
8.8.8.8
Lease Obtained. . . . . . . . . . : Thursday, March 31, 2016 12:06:49 AM

Lease Expires . . . . . . . . . . : Friday, April 01, 2016 12:06:49 AM

Ethernet adapter Local Area Connection 2:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : TAP-Win32 Adapter V9
Physical Address. . . . . . . . . : 00-FF-CD-84-0B-24
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.200.6
Subnet Mask . . . . . . . . . . . : 255.255.255.252
Default Gateway . . . . . . . . . : 192.168.200.5
DHCP Server . . . . . . . . . . . : 192.168.200.5
DNS Servers . . . . . . . . . . . : 8.8.8.8
8.8.4.4
Lease Obtained. . . . . . . . . . : Thursday, March 31, 2016 12:31:54 AM

Lease Expires . . . . . . . . . . : Friday, March 31, 2017 12:31:54 AM

C:\Documents and Settings\LL>route print
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 1a a0 9c 1b 82 ...... Intel(R) 82562V-2 10/100 Network Connection - Pa
cket Scheduler Miniport
0x10004 ...00 ff cd 84 0b 24 ...... TAP-Win32 Adapter V9 - Packet Scheduler Mini
port
===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.1.168 192.168.1.76 20
0.0.0.0 128.0.0.0 192.168.200.5 192.168.200.6 1
100.31.22.59 255.255.255.255 192.168.1.168 192.168.1.76 1
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
128.0.0.0 128.0.0.0 192.168.200.5 192.168.200.6 1
192.168.1.0 255.255.255.0 192.168.1.76 192.168.1.76 20
192.168.1.76 255.255.255.255 127.0.0.1 127.0.0.1 20
192.168.1.255 255.255.255.255 192.168.1.76 192.168.1.76 20
192.168.200.1 255.255.255.255 192.168.200.5 192.168.200.6 1
192.168.200.4 255.255.255.252 192.168.200.6 192.168.200.6 30
192.168.200.6 255.255.255.255 127.0.0.1 127.0.0.1 30
192.168.200.255 255.255.255.255 192.168.200.6 192.168.200.6 30
224.0.0.0 240.0.0.0 192.168.1.76 192.168.1.76 20
224.0.0.0 240.0.0.0 192.168.200.6 192.168.200.6 30
255.255.255.255 255.255.255.255 192.168.1.76 192.168.1.76 1
255.255.255.255 255.255.255.255 192.168.200.6 192.168.200.6 1
Default Gateway: 192.168.200.5
===========================================================================
Persistent Routes:
None

C:\Documents and Settings\LL>

C:\Documents and Settings\LL>ping 192.168.200.5

Pinging 192.168.200.5 with 32 bytes of data:

Request timed out.

Ping statistics for 192.168.200.5:
Packets: Sent = 1, Received = 0, Lost = 1 (100% loss),
Control-C
^C
C:\Documents and Settings\LL>ping 192.168.200.1

Pinging 192.168.200.1 with 32 bytes of data:

Reply from 192.168.200.1: bytes=32 time=1ms TTL=64
Reply from 192.168.200.1: bytes=32 time=3ms TTL=64

Ping statistics for 192.168.200.1:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 1ms, Maximum = 3ms, Average = 2ms
Control-C
^C
C:\Documents and Settings\LL>

TIA

Traffic

aaaa2209 wroteThe client didnot get a normal IP in my eyes. It got something like 192.168.200.6/30

See --topology in The Manual v23x

aaaa2209 wroteC:\Documents and Settings\LL>ping 192.168.200.5

Pinging 192.168.200.5 with 32 bytes of data:

Request timed out.

Although this is the correct gateway IP .. it is not pingable by design.

aaaa2209 wroteI set up the OpenVPN server in CentOS 7 (ESXi virtual machine)

aaaa2209 wrote-A POSTROUTING -s 192.168.200.0/24 -o ens32 -j MASQUERADE

aaaa2209 wrote2: ens32: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 00:0c:29:6b:2a:57 brd ff:ff:ff:ff:ff:ff
inet x.31.22.59/24 brd x.38.226.255 scope global ens32

This setup may not MASQUERADE .. Try this instead:

iptables -t nat -A POSTROUTING -s 192.168.200.0/24 -j SNAT --to-source  x.31.22.59

Or may be this:

iptables -t nat -A POSTROUTING -s 192.168.200.0/24 -o ens32 -j SNAT --to-source  x.31.22.59

aaaa2209

Thank you, traffic! Your explanation is very detailed and helpful.

I used the first command it works like a charm.

iptables -t nat -A POSTROUTING -s 192.168.200.0/24 -j SNAT --to-source  x.31.22.59

I didn't test the second command. I know it's something relates to routing/iptables but I cannot fix it with my limited knowledge. Problem solved. Thanks again.

Traffic

Thanks for letting us know the solution 8-)