Can't reach the internet behind my OpenVZ server

merlinsilk

I have been searching far and wide and have not been able to connect through the internet at large beyond my server.

My setup is as follows:
- a VPN running on OpenVZ host somewhere in England with CentOS 7 and running csf (configserver and firewall) and not firewalld.

- a windows 8.1 machine in the US that connects to the server and that I want to access the internet (appearing to be from England.

My server config is:
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log-append openvpn.log
verb 3

and my client config is
client
dev tun
proto udp
remote x.x.x.x 1194
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo
verb 3
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\client.crt"
key "C:\\Program Files\\OpenVPN\\config\\client.key"
log-append openvpn.log

I am able to establish the connection from my windows box to the VPS (which has TUN support enabled on the host).

But trying to reach any destination on the internet fails. DNS queries fail and I can't even ping the IP of the VPS.

I know that I probably will have to establish a routing from the VPN server to the NIC that would connect me to the internet but this is where the guides and tutorials I devoured failed.

I had found the following command
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
to do the routing but that did not make a difference.
Looking at my ifconfig I found that eth0 would not be the right thing for my server's setup:
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 0 (Local Loopback)
RX packets 12 bytes 1312 (1.2 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 12 bytes 1312 (1.2 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1500
inet 10.8.0.1 netmask 255.255.255.255 destination 10.8.0.2
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 100 (UNSPEC)
RX packets 423 bytes 29138 (28.4 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

venet0: flags=211<UP,BROADCAST,POINTOPOINT,RUNNING,NOARP> mtu 1500
inet 127.0.0.1 netmask 255.255.255.255 broadcast 0.0.0.0 destination 127.0.0.1
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 0 (UNSPEC)
RX packets 103607 bytes 120633721 (115.0 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 75175 bytes 8096468 (7.7 MiB)
TX errors 0 dropped 87 overruns 0 carrier 0 collisions 0

venet0:0: flags=211<UP,BROADCAST,POINTOPOINT,RUNNING,NOARP> mtu 1500
inet 193.104.35.83 netmask 255.255.255.255 broadcast 193.104.35.83 destination 193.104.35.83
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 0 (UNSPEC)

venet0:1: flags=211<UP,BROADCAST,POINTOPOINT,RUNNING,NOARP> mtu 1500
inet 193.104.35.84 netmask 255.255.255.255 broadcast 193.104.35.84 destination 193.104.35.84
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 0 (UNSPEC)

Not sure which of the interfaces I should use instead of eth0: venet0, venet0:0, or venet0:1 - - I tried them all but one of them made a difference.

I am also not sure if I could use that iptable command with csf running instead of iptables. The command is accepted and it appear to persist to the next reboot.

My hosting provider was unable to hep, so I hope somebody here has some insight.

Thanks, Merlin

Traffic

Presuming that your logs show no errors ..

This:

merlinsilk wroteiptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

probably does not work on your OpenVZ server.

Try this instead:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source 12.34.56.78   # <-- Use your OpenVPN server's real external IP here

merlinsilk

Thanks traffic,

unfortunately that did not do the job.
I did some more digging, trying to understand how those tunnels actually work, but I haven't found a good clue what might be the cause that this is not working.
I got wireshark and listened on tun0 and there is a lot of packets arriving when my windows box is connected, mostly packages trying to reach the google DNS servers at 8.8.8.8 and 8.8.4.4.
Is there a way to find out - some log or things similar to wireshark (or itself) - to understand why these iptables commands don't do what they are supposed to do?
Where I am still hazy is if these iptables are really seen - just because I am running csf and not an iptables daemon - guess I am having some fundamental knowledge hole there.
Thanks - Merlin

Traffic

merlinsilk wroteunfortunately that did not do the job

I can only take your word on that ...

I suggest you ask the provider if this setup is supported and why iptables is not doing what it should.

merlinsilk

Thanks, traffic!
I had tried the provider and had actually asked them for help though THEY should know,right?
But he told me that he himself is not familiar with OpenVPN, but hat another client is indeed running it, so I can only assume the VPSs are configured properly.

I was actually just not sure if the additional iptables command takes hold or not. I was not sure that it did indeed not work. I guess I was unsure of how csf and iptables are related. After much more reading I think that a command of iptables just adds to the rules that csf establishes, so that should not have been a problem.
(my uncertainty still is though, how to permanently ADD a command like that
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source 12.34.56.78
but this is secondary after first getting it to work at all.)

I learned about the csf -l command and with that I am getting

Chain INPUT (policy DROP 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 ACCEPT     tcp  --  !lo    *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8889 limit: avg 30/min burst 5
2       13  1050 ACCEPT     tcp  --  !lo    *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8888 limit: avg 30/min burst 5
3        0     0 ACCEPT     tcp  --  !lo    *       8.8.4.4              0.0.0.0/0            tcp dpt:53
4        0     0 ACCEPT     udp  --  !lo    *       8.8.4.4              0.0.0.0/0            udp dpt:53
5        0     0 ACCEPT     tcp  --  !lo    *       8.8.4.4              0.0.0.0/0            tcp spt:53
6       39  3023 ACCEPT     udp  --  !lo    *       8.8.4.4              0.0.0.0/0            udp spt:53
7        0     0 ACCEPT     tcp  --  !lo    *       8.8.8.8              0.0.0.0/0            tcp dpt:53
8        0     0 ACCEPT     udp  --  !lo    *       8.8.8.8              0.0.0.0/0            udp dpt:53
9        0     0 ACCEPT     tcp  --  !lo    *       8.8.8.8              0.0.0.0/0            tcp spt:53
10     603 63932 ACCEPT     udp  --  !lo    *       8.8.8.8              0.0.0.0/0            udp spt:53
11   91488  108M LOCALINPUT  all  --  !lo    *       0.0.0.0/0            0.0.0.0/0           
12       0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
13   88188  108M INVALID    tcp  --  !lo    *       0.0.0.0/0            0.0.0.0/0           
14   87814  108M ACCEPT     all  --  !lo    *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
15       0     0 ACCEPT     tcp  --  !lo    *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:20
16       6   280 ACCEPT     tcp  --  !lo    *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:21
...
36       0     0 ACCEPT     icmp --  !lo    *       0.0.0.0/0            0.0.0.0/0            icmptype 11
37       9   687 ACCEPT     icmp --  !lo    *       0.0.0.0/0            0.0.0.0/0            icmptype 3
38    1759  166K LOGDROPIN  all  --  !lo    *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy DROP 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 ACCEPT     tcp  --  *      !lo     0.0.0.0/0            0.0.0.0/0            tcp spt:8889 limit: avg 30/min burst 5
2       13  1929 ACCEPT     tcp  --  *      !lo     0.0.0.0/0            0.0.0.0/0            tcp spt:8888 limit: avg 30/min burst 5
3        0     0 ACCEPT     tcp  --  *      !lo     0.0.0.0/0            8.8.4.4              tcp dpt:53
4       39  2838 ACCEPT     udp  --  *      !lo     0.0.0.0/0            8.8.4.4              udp dpt:53
...
41       0     0 ACCEPT     icmp --  *      !lo     0.0.0.0/0            0.0.0.0/0            icmptype 3
42       0     0 LOGDROPOUT  all  --  *      !lo     0.0.0.0/0            0.0.0.0/0           

Chain ALLOWIN (1 references)
num   pkts bytes target     prot opt in     out     source               destination         

Chain ALLOWOUT (1 references)
num   pkts bytes target     prot opt in     out     source               destination         

Chain BFB (1 references)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 DROP       all  --  *      *       159.8.41.180         0.0.0.0/0           
2        0     0 DROP       all  --  *      *       181.214.92.181       0.0.0.0/0           
...
1155     0     0 DROP       all  --  *      *       182.18.132.48        0.0.0.0/0           

Chain DENYIN (1 references)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 DROP       all  --  !lo    *       187.163.162.242      0.0.0.0/0           
2        0     0 DROP       all  --  !lo    *       112.90.237.89        0.0.0.0/0           
...
118     24  1464 DROP       all  --  !lo    *       59.11.218.248        0.0.0.0/0           

Chain DENYOUT (1 references)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 LOGDROPOUT  all  --  *      !lo     0.0.0.0/0            187.163.162.242     
2        0     0 LOGDROPOUT  all  --  *      !lo     0.0.0.0/0            112.90.237.89       
...
118     20  3504 LOGDROPOUT  all  --  *      !lo     0.0.0.0/0            59.11.218.248       

Chain INVALID (2 references)
num   pkts bytes target     prot opt in     out     source               destination         
1       66  3295 INVDROP    all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID
2        0     0 INVDROP    tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp flags:0x3F/0x00
...
10       4   168 INVDROP    tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp flags:!0x17/0x02 state NEW

Chain INVDROP (10 references)
num   pkts bytes target     prot opt in     out     source               destination         
1       70  3463 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain LOCALINPUT (1 references)
num   pkts bytes target     prot opt in     out     source               destination         
1    91488  108M ALLOWIN    all  --  !lo    *       0.0.0.0/0            0.0.0.0/0           
2    91488  108M DENYIN     all  --  !lo    *       0.0.0.0/0            0.0.0.0/0           
3    90834  108M BFB        all  --  !lo    *       0.0.0.0/0            0.0.0.0/0           

Chain LOCALOUTPUT (1 references)
num   pkts bytes target     prot opt in     out     source               destination         
1    66575 6141K ALLOWOUT   all  --  *      !lo     0.0.0.0/0            0.0.0.0/0           
2    66575 6141K DENYOUT    all  --  *      !lo     0.0.0.0/0            0.0.0.0/0           

Chain LOGDROPIN (1 references)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:67
2        0     0 DROP       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:67
...
21       0     0 LOG        icmp --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 30/min burst 5 LOG flags 0 level 4 prefix "Firewall: *ICMP_IN Blocked* "
22    1256  140K DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain LOGDROPOUT (119 references)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp flags:0x17/0x02 limit: avg 30/min burst 5 LOG flags 8 level 4 prefix "Firewall: *TCP_OUT Blocked* "
2        0     0 LOG        udp  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 30/min burst 5 LOG flags 8 level 4 prefix "Firewall: *UDP_OUT Blocked* "
3        0     0 LOG        icmp --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 30/min burst 5 LOG flags 8 level 4 prefix "Firewall: *ICMP_OUT Blocked* "
4       20  3504 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain PREROUTING (policy ACCEPT 2469 packets, 200K bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 REDIRECT   tcp  --  !lo    *       187.163.162.242      0.0.0.0/0            multiport dports 80,2082,2095 redir ports 8888
2        0     0 REDIRECT   tcp  --  !lo    *       187.163.162.242      0.0.0.0/0            multiport dports 21 redir ports 8889
...
236      0     0 REDIRECT   tcp  --  !lo    *       59.11.218.248        0.0.0.0/0            multiport dports 21 redir ports 8889

Chain POSTROUTING (policy ACCEPT 214 packets, 13629 bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 SNAT       all  --  *      *       10.8.0.0/24          0.0.0.0/0            to:193.104.35.83          

Chain OUTPUT (policy ACCEPT 214 packets, 13629 bytes)
num   pkts bytes target     prot opt in     out     source               destination

does that look correct or is there a glaring outpoint?
Thanks - Merlin

Traffic

I do not debug iptables (unless you hire me)

Just (save and) delete all your current rules and add the NAT rule above ..