OpenVPN leaks user's IP to one server only

JohnSwartz

I'm having the weirdest problem with OpenVPN.

I super basic OpenVPN installation done exactly as outlined in https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-ubuntu-14-04

I've 3 separate HTTP servers each running Nginx with basic auth. My goal is eventually to replace basic auth with IP filtering.

However the problem is that one of the server keeps receiving my own IP instead of VPN's. Other two servers gets VPN's IP and so does every other IP checking site I've tried. All servers have same Nginx configuration and there's nothing special about that one server.

Initially we thought it might be due subnets because all the servers, including VPN, were in the same datacenter. I cloned VPN server to another datacenter to make sure it's not in the same subnet but the problem persists.

I've tried every trick I could find from ServerVault and from here.

server.conf

port 1194
proto udp

dev tun

ca ca.crt
cert server.crt

dh dh2048.pem

server 10.8.0.0 255.255.255.0

ifconfig-pool-persist ipp.txt

push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"

keepalive 10 120

comp-lzo

user nobody
group nogroup

persist-key
persist-tun

status openvpn-status.log

log openvpn.log

verb 5

Traffic

Please post your server & client logs at --verb 4

JohnSwartz

This was just solved.

As always, the problem was ridiculously simple when you knew where to look. Somebody suggested me to check out traceroute for each server and from that I noticed that with this one particular server everything went straight to user's gateway instead of VPN and this was because Tunnelblick hadn't properly removed earlier routes it had injected into routing tables. And those routes were there because this particular server was used to test OpenVPN earlier.