[Solved] Clients can access OpenVPN servers LAN Side but no internet over ppp0

tiuz

Hello,

I have re-setup my Gateway/OpenVPN LAN Server due to a hardware failure of the old machine. Most of the configs where restored from a backup. But i have some trouble with the OpenVPN Clients getting internet connection. All OpenVPN clients can connect to machines in the Servers LAN, but no response from any internet service. Here is what i have got:

The server has two physical network devices eth0 and eth1
eth0 points to an adsl modem, internet connection is manually established with the pptp command on the server.
eth1 points to the local LAN (192.168.0.0/24)
After an internet-connection is established i have a virtual device called ppp0
And of course there is tun0

192.168.0.0/24 is used for the local LAN
192.168.1.0/24 is used for OpenVPN

A DNS server is running on the server too, where i added 192.168.1.0/24 (used for OpenVPN) to the config so that the LAN clients can be accessed with host names instead of using the IP-addresses.

Server config file:--------------------------------
mode server
proto udp
port 11941
dev tun
management 127.0.0.1 44000 management.pwd
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
push "route 192.168.0.0 255.255.255.0"
push "dhcp-option DNS 192.168.0.1"
push "redirect-gateway def1"
server 192.168.1.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
-------------------------------

These are the iptables-rules i am using:---------------------------
/sbin/iptables -t filter -P INPUT DROP
/sbin/iptables -t filter -P FORWARD DROP
/sbin/iptables -t filter -P OUTPUT ACCEPT
/sbin/iptables -t filter -A INPUT -i tun0 -j ACCEPT
/sbin/iptables -t filter -A INPUT -i ppp0 -p udp -m udp --dport 11941 -j ACCEPT
/sbin/iptables -t filter -A INPUT -i lo -j ACCEPT
/sbin/iptables -t filter -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -t filter -A INPUT -i ppp0 -m limit --limit 30/sec -j LOG --log-p
refix "iptables drop: " --log-level 7
/sbin/iptables -t filter -A INPUT -i eth1 -j ACCEPT
/sbin/iptables -t filter -A INPUT -s 127.0.0.1/32 -i ppp0 -j DROP
/sbin/iptables -t filter -A INPUT -i ppp0 -j DROP
/sbin/iptables -t filter -A INPUT -s 10.0.0.138/32 -i eth0 -j ACCEPT
/sbin/iptables -t filter -A INPUT -i tun0 -m limit --limit 30/sec -j LOG --log-p
refix "iptables drop: " --log-level 7
/sbin/iptables -t filter -A FORWARD -m string --string "twitter" --algo bm --to
65535 -j DROP
/sbin/iptables -t filter -A FORWARD -m string --string "facebook" --algo bm --to
65535 -j DROP
/sbin/iptables -t filter -A FORWARD -i eth1 -j ACCEPT
/sbin/iptables -t filter -A FORWARD -o eth1 -j ACCEPT
/sbin/iptables -t filter -A FORWARD -s 192.168.1.0/24 -d 192.168.0.0/24 -i tun0
-o eth1 -j ACCEPT
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P INPUT ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j REDIRECT
--to-ports 8080
/sbin/iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 110 -j REDIREC
T --to-ports 8110
/sbin/iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
-------------------------------------------------------------------
I did a tcpdump -i tun0 on the server when i tried to connect to a webservice on an OpenVPN client to see if there´s anything, here is a short output:

21:21:51.745951 IP 192.168.1.10.56170 > tiz-korg-pub.kernel.org.http: Flags [S],
seq 2887280385, win 65535, options [mss 1368,sackOK,eol], length 0
21:22:06.627473 IP 192.168.1.10.56240 > rt132bb131-145-84.routit.net.https: Flag
s [S], seq 11081433, win 65535, options [mss 1368,nop,wscale 5,nop,nop,TS val 75
1723633 ecr 0,sackOK,eol], length 0
21:22:06.633000 IP 192.168.1.10.56242 > rt132bb131-145-84.routit.net.https: Flag
s [S], seq 1697790338, win 65535, options [mss 1368,nop,wscale 5,nop,nop,TS val
751723703 ecr 0,sackOK,eol], length 0
21:22:06.702211 IP 192.168.1.10.56240 > rt132bb131-145-84.routit.net.https: Flag
s [S], seq 11081433, win 65535, options [mss 1368,nop,wscale 5,nop,nop,TS val 75
1724634 ecr 0,sackOK,eol], length 0
21:22:06.773487 IP 192.168.1.10.56242 > rt132bb131-145-84.routit.net.https: Flag
s [S], seq 1697790338, win 65535, options [mss 1368,nop,wscale 5,nop,nop,TS val
751724704 ecr 0,sackOK,eol], length 0
21:22:07.377681 IP 192.168.1.10.56170 > tiz-korg-pub.kernel.org.http: Flags [S],
seq 2887280385, win 65535, options [mss 1368,sackOK,eol], length 0
21:22:07.723345 IP 192.168.1.10.56240 > rt132bb131-145-84.routit.net.https: Flag
s [S], seq 11081433, win 65535, options [mss 1368,nop,wscale 5,nop,nop,TS val 75
1725634 ecr 0,sackOK,eol], length 0
-------------------------------------------------------------
So the client tries to connect but for a reason i don´t know he doesn´t get anything back from the server.
It´s been a while since i dealt with iptables but i am sure i missed something here.

Thanks for any help here,

tz,

Traffic

tiuz wrotedue to a hardware failure of the old machine. Most of the configs where restored from a backup

Nice .. I wonder if my backups are suitably up to date .. *gulp*

tiuz wroteI did a tcpdump -i tun0 on the server

You appear to be quite familiar with the tools .. try tcpdump -i ppp0 .. are your 192.168.x.0 networks NAT'ed ?

FYI: 192.168.0/1.0/24 are probably the two worst networks you can select ..

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

:arrow: Never use 192.168.0.0/24 or 192.168.1.0/24 (or other common subnets) for your OpenVPN Server LAN :!:

You are advised to change your server LAN to a more unique RFC1918 compliant subnet. f.e 192.168.143.0/24

tiuz

The Backup i used was 5 days old (a complete system backup), only most of the hardware changed, network cards, CPU, Mainboard, but everything works as expected, well anything but the OpenVPN clients can´t reach the internet. And i didn´t change anything in the configs since the backup - that´s the weird thing.

I know the 192.168x.0/24 isn´t that optimal but openvpn clients connect via an USB UMTS Modem and never use free WLAN´s or hotspots.

The 192.168.0.0/24 subnet is NAT'ed

I have been trying iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -j MASQUERADE
as well but this has no effect.

tcpdump on ppp0 shows this output when an openvpn client tries to connect to an internetservice. So it looks like traffic is outbound correct but nothing comes back then...
-----------------------------------
13:15:36.417095 IP 089144225232.atnat0034.highway.a1.net.15284 > ip52-75.comteam.at.11941: UDP, length 85
13:15:36.417527 IP ip52-75.comteam.at.11941 > 089144225232.atnat0034.highway.a1.net.15284: UDP, length 53
13:15:36.424481 IP 089144225232.atnat0034.highway.a1.net.15284 > ip52-75.comteam.at.11941: UDP, length 85
13:15:41.312736 IP 089144225232.atnat0034.highway.a1.net.15284 > ip52-75.comteam.at.11941: UDP, length 101
13:15:41.744104 IP 089144225232.atnat0034.highway.a1.net.15284 > ip52-75.comteam.at.11941: UDP, length 101
13:15:42.176795 IP 089144225232.atnat0034.highway.a1.net.15284 > ip52-75.comteam.at.11941: UDP, length 85
13:15:42.704448 IP 089144225232.atnat0034.highway.a1.net.15284 > ip52-75.comteam.at.11941: UDP, length 85
13:15:42.742414 IP 089144225232.atnat0034.highway.a1.net.15284 > ip52-75.comteam.at.11941: UDP, length 101
13:15:43.792051 IP 089144225232.atnat0034.highway.a1.net.15284 > ip52-75.comteam.at.11941: UDP, length 101
13:15:44.768680 IP 089144225232.atnat0034.highway.a1.net.15284 > ip52-75.comteam.at.11941: UDP, length 101
13:15:45.777025 IP 089144225232.atnat0034.highway.a1.net.15284 > ip52-75.comteam.at.11941: UDP, length 101
13:15:46.242153 IP 195-154-50-139.rev.poneytelecom.eu.61719 > ip52-75.comteam.at.ssh: Flags [SEW], seq 2399241662, win 8192, options [mss 1420,nop,wscale 8,nop,nop,sackOK], length 0
13:15:46.243770 IP ip52-75.comteam.at.52835 > mail1.comteam.at.domain: 16017+ [1au] PTR? 139.50.154.195.in-addr.arpa. (56)
13:15:46.350220 IP mail1.comteam.at.domain > ip52-75.comteam.at.52835: 16017 1/2/5 PTR 195-154-50-139.rev.poneytelecom.eu. (238)
13:15:46.969863 IP ip52-75.comteam.at.11941 > 089144225232.atnat0034.highway.a1.net.15284: UDP, length 53
13:15:47.824998 IP 089144225232.atnat0034.highway.a1.net.15284 > ip52-75.comteam.at.11941: UDP, length 101
13:15:49.825798 IP 089144225232.atnat0034.highway.a1.net.15284 > ip52-75.comteam.at.11941: UDP, length 85
13:15:51.840254 IP 089144225232.atnat0034.highway.a1.net.15284 > ip52-75.comteam.at.11941: UDP, length 85
13:15:56.988671 IP 089144225232.atnat0034.highway.a1.net.15284 > ip52-75.comteam.at.11941: UDP, length 101
13:15:56.988674 IP 089144225232.atnat0034.highway.a1.net.15284 > ip52-75.comteam.at.11941: UDP, length 101
13:15:56.988768 IP 089144225232.atnat0034.highway.a1.net.15284 > ip52-75.comteam.at.11941: UDP, length 85
13:15:56.989052 IP ip52-75.comteam.at.11941 > 089144225232.atnat0034.highway.a1.net.15284: UDP, length 53
13:15:57.401715 IP 089144225232.atnat0034.highway.a1.net.15284 > ip52-75.comteam.at.11941: UDP, length 101
13:15:57.438368 IP 089144225232.atnat0034.highway.a1.net.15284 > ip52-75.comteam.at.11941: UDP, length 101
13:15:58.410148 IP 089144225232.atnat0034.highway.a1.net.15284 > ip52-75.comteam.at.11941: UDP, length 101
13:15:58.418245 IP 089144225232.atnat0034.highway.a1.net.15284 > ip52-75.comteam.at.11941: UDP, length 101
13:15:59.458078 IP 089144225232.atnat0034.highway.a1.net.15284 > ip52-75.comteam.at.11941: UDP, length 101
13:15:59.490249 IP 089144225232.atnat0034.highway.a1.net.15284 > ip52-75.comteam.at.11941: UDP, length 101
13:15:59.874676 IP 089144225232.atnat0034.highway.a1.net.15284 > ip52-75.comteam.at.11941: UDP, length 85
13:16:00.450204 IP 089144225232.atnat0034.highway.a1.net.15284 > ip52-75.comteam.at.11941: UDP, length 101
13:16:00.483003 IP 089144225232.atnat0034.highway.a1.net.15284 > ip52-75.comteam.at.11941: UDP, length 101
13:16:01.442326 IP 089144225232.atnat0034.highway.a1.net.15284 > ip52-75.comteam.at.11941: UDP, length 101
13:16:01.475033 IP 089144225232.atnat0034.highway.a1.net.15284 > ip52-75.comteam.at.11941: UDP, length 101
13:16:03.477391 IP 089144225232.atnat0034.highway.a1.net.15284 > ip52-75.comteam.at.11941: UDP, length 101
13:16:03.484004 IP 089144225232.atnat0034.highway.a1.net.15284 > ip52-75.comteam.at.11941: UDP, length 101
13:16:04.029330 IP 089144225232.atnat0034.highway.a1.net.15284 > ip52-75.comteam.at.11941: UDP, length 85
13:16:06.171588 IP ip52-75.comteam.at.11941 > 089144225232.atnat0034.highway.a1.net.15284: UDP, length 53
13:16:07.480652 IP 089144225232.atnat0034.highway.a1.net.15284 > ip52-75.comteam.at.11941: UDP, length 85
13:16:07.486470 IP 089144225232.atnat0034.highway.a1.net.15284 > ip52-75.comteam.at.11941: UDP, length 85
----------------------------------------------------------

I tested the local LAN with 192.168.140.0/24 and the OpenVPN with 10.5.5.0/24 subnets today just to see if there is anything different, but i have the same result with these, LAN-Subnet is reachable from openvpn clients but no internet services...

Traffic

tiuz wroteThe server has two physical network devices eth0 and eth1
eth0 points to an adsl modem, internet connection is manually established with the pptp command on the server.
eth1 points to the local LAN (192.168.0.0/24)
After an internet-connection is established i have a virtual device called ppp0

because ppp0 is a virtual device, this may not work as expected:

tiuz wrote/sbin/iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

Instead,try something like this:

iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -j SNAT --to-source public.ip.address

Not being that familiar with your network it is difficult to say for sure ..

tiuz

because ppp0 is a virtual device, this may not work as expected:
Instead,try something like this:

iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -j SNAT --to-source public.ip.address

Not being that familiar with your network it is difficult to say for sure ..

Tested iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -j SNAT --to-source with the public ip i got when ppp0 is established.

But this has no effect at all.

I found out that outbound traffic from tun0 to any internet service never leaves ppp0, using tcpdump -i ppp0 just shows the normal "connection-checking" traffic from and to my provider" So i was wrong before when i thought traffic from OpenVPN clients would outbound to ppp0, but it doesn´t - it just get´s in at tun0 and don´t pass ppp0.

Traffic

Please post details of route -n from the server when ppp0 is down and up.

tiuz

Traffic wrotePlease post details of route -n from the server when ppp0 is down and up.

This is the routing table with ppp0 is down:
------------------------------------------------
Kernel-IP-Routentabelle
Ziel Router Genmask Flags Metric Ref Use Iface
10.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 eth0
10.0.0.138 0.0.0.0 255.255.255.255 UH 0 0 0 eth0
192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1
192.168.1.0 192.168.1.2 255.255.255.0 UG 0 0 0 tun0
192.168.1.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
-----------------------------------------------
And this is the table when ppp0 is up:
----------------------------------------------
Kernel-IP-Routentabelle
Ziel Router Genmask Flags Metric Ref Use Iface
0.0.0.0 0.0.0.0 0.0.0.0 U 0 0 0 ppp0
10.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 eth0
10.0.0.138 0.0.0.0 255.255.255.255 UH 0 0 0 eth0
88.151.78.202 0.0.0.0 255.255.255.255 UH 0 0 0 ppp0
192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1
192.168.1.0 192.168.1.2 255.255.255.0 UG 0 0 0 tun0
192.168.1.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
-----------------------------------------------------

Today i deleted/flushed all iptables rules and just added
-t nat -A PREROUTING -j ACCEPT
-t nat -A POSTROUTING -j ACCEPT
and POSTROUTING -i ppp0 -j MASQUERADE

and then everything worked as expected, all OpenVPN clients where able to access internet services so it´s definitely not the OpenVPN config but iptables which causes problems here...

Traffic

tiuz wroteand POSTROUTING -i ppp0 -j MASQUERADE

"dash i" .. this is wrong ..

Delete all iptables rules and add this only:

iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

tiuz

Traffic wrote
tiuz wroteand POSTROUTING -i ppp0 -j MASQUERADE
"dash i"

.. this is wrong ..

A right, i meant -o ppp0 sorry :-)

Delete all iptables rules and add this only:

iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

Right with this rule everything works as expected, well except that my connection to the "world" on the router is now open like a barn door :-) Will have to correct that

Thanks,

tz

Traffic

tiuz wrotewith this rule everything works as expected

Thanks for letting us know it works 8-)

tiuz wrotemy connection to the "world" on the router is now open like a barn door

It is as open as a standard NAT router and openvpn server works as required ..
How you follow up configuring your firewall is entirely up to you.