[Solved] Succefully connected to VPN, nat-hacked, but still no internet

wg_cepi

Hello,

I've successfully installed openvpn on ubuntu 14.04.4 LTS sever. Server sits at 192.168.0.2 so I have forwarded port 1194 on router to it. I have also used nat-hack in order to forward packets.

OK -Connection succeeds
OK - Ping to 10.8.0.1 succeeds
FAIL - Internet connection on client does not work
FAIL - Cant ping 8.8.8.8 and traceroute 8.8.8.8 shows * only

I've attached confs and logs below.

What I've done wrong?
Can you tell me what to do to make internet connection tunneled over VPN work?
Thanks in advance.
client
dev tun
proto udp
sndbuf 0
rcvbuf 0
remote x.x.x.62 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-128-CBC
comp-lzo
setenv opt block-outside-dns
key-direction 1
verb 3

# sudo openvpn client.ovpn
Wed Nov 16 14:57:41 2016 Unrecognized option or missing parameter(s) in cepi.ovpn:14: block-outside-dns (2.3.10)
Wed Nov 16 14:57:41 2016 OpenVPN 2.3.10 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Feb  2 2016
Wed Nov 16 14:57:41 2016 library versions: OpenSSL 1.0.2g  1 Mar 2016, LZO 2.08
Wed Nov 16 14:57:41 2016 Control Channel Authentication: tls-auth using INLINE static key file
Wed Nov 16 14:57:41 2016 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Nov 16 14:57:41 2016 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Nov 16 14:57:41 2016 Socket Buffers: R=[212992->212992] S=[212992->212992]
Wed Nov 16 14:57:41 2016 UDPv4 link local: [undef]
Wed Nov 16 14:57:41 2016 UDPv4 link remote: [AF_INET]x.x.x.62:1194
Wed Nov 16 14:57:41 2016 TLS: Initial packet from [AF_INET]x.x.x.62:1194, sid=824d51fa 8c009000
Wed Nov 16 14:57:42 2016 VERIFY OK: depth=1, CN=ChangeMe
Wed Nov 16 14:57:42 2016 Validating certificate key usage
Wed Nov 16 14:57:42 2016 ++ Certificate has key usage  00a0, expects 00a0
Wed Nov 16 14:57:42 2016 VERIFY KU OK
Wed Nov 16 14:57:42 2016 Validating certificate extended key usage
Wed Nov 16 14:57:42 2016 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Wed Nov 16 14:57:42 2016 VERIFY EKU OK
Wed Nov 16 14:57:42 2016 VERIFY OK: depth=0, CN=server
Wed Nov 16 14:57:42 2016 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Wed Nov 16 14:57:42 2016 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Nov 16 14:57:42 2016 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Wed Nov 16 14:57:42 2016 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Nov 16 14:57:42 2016 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Nov 16 14:57:42 2016 [server] Peer Connection Initiated with [AF_INET]x.x.x.62:1194
Wed Nov 16 14:57:44 2016 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Wed Nov 16 14:57:44 2016 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0'
Wed Nov 16 14:57:44 2016 OPTIONS IMPORT: timers and/or timeouts modified
Wed Nov 16 14:57:44 2016 OPTIONS IMPORT: --ifconfig/up options modified
Wed Nov 16 14:57:44 2016 OPTIONS IMPORT: route options modified
Wed Nov 16 14:57:44 2016 OPTIONS IMPORT: route-related options modified
Wed Nov 16 14:57:44 2016 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Nov 16 14:57:44 2016 ROUTE_GATEWAY 192.168.43.1/255.255.255.0 IFACE=wlo1 HWADDR=20:68:9d:aa:b9:a8
Wed Nov 16 14:57:44 2016 TUN/TAP device tun0 opened
Wed Nov 16 14:57:44 2016 TUN/TAP TX queue length set to 100
Wed Nov 16 14:57:44 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Nov 16 14:57:44 2016 /sbin/ip link set dev tun0 up mtu 1500
Wed Nov 16 14:57:44 2016 /sbin/ip addr add dev tun0 10.8.0.2/24 broadcast 10.8.0.255
Wed Nov 16 14:57:44 2016 /sbin/ip route add x.x.x.62/32 via 192.168.43.1
Wed Nov 16 14:57:44 2016 /sbin/ip route add 0.0.0.0/1 via 10.8.0.1
Wed Nov 16 14:57:44 2016 /sbin/ip route add 128.0.0.0/1 via 10.8.0.1
Wed Nov 16 14:57:44 2016 Initialization Sequence Completed

port 1194
proto udp
dev tun
sndbuf 0
rcvbuf 0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
tls-auth ta.key 0
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem

# sudo iptables-save
*nat
:PREROUTING ACCEPT [1704:114964]
:INPUT ACCEPT [1363:93571]
:OUTPUT ACCEPT [980:59273]
:POSTROUTING ACCEPT [980:59273]
-A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source x.x.x.62
COMMIT

TinCanTech

wg_cepi wroteFAIL - Internet connection on client does not work

Have you enabled IP_Forwarding on the server ?

wg_cepi wroteWed Nov 16 14:57:41 2016 Unrecognized option or missing parameter(s) in cepi.ovpn:14: block-outside-dns (2.3.10)
Wed Nov 16 14:57:41 2016 OpenVPN 2.3.10 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Feb 2 2016

--block-outside-dns is not supported or required on Linux.

You may also want to update to the latest stable release:
https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos

wg_cepi

Yes, ip forwarding is enabled
I will try updating to latest release and remove that unrecognized option

IP tables look good to you?

TinCanTech

wg_cepi wroteIP tables look good to you?

No ..

See:
HOWTO: Routing all client traffic (including web-traffic) through the VPN

wg_cepi

Well it should be ok, SNAT is very similar to MASQUERADE, it just specifies IP address. BTW I've used this script https://github.com/Nyr/openvpn-install to install and configure OpenVPN.

Anyway... I've updated OpenVPN, removed that SNAT from iptables and inserted this command

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

All of the sudden (because I've already used this configuration before), it works...

Thanks for help

wg_cepi

Now I have another problem, should I create new topic?

Problem: When I ask google what is my IP, it says x.x.x.62 which is expected. But, if I make request to server sitting at x.x.x.62, let's say "not.public.com" (which has whitelisted x.x.x.62 IP and local IP addresses 192.168.*.*, 10.8.*.*.) my request is not accepted (because of IP filtering set up on webserver). When I look into access.log, I see lines with original IP (not x.x.x.62, not local, just my public IP before it goes through VPN). Any ideas?

If this should be in new topic, please close this and mark it as solved.

TinCanTech

wg_cepi wroteAll of the sudden (because I've already used this configuration before), it works...

Thanks for help

Thanks for letting me know 8-)

wg_cepi wroteIf this should be in new topic, please close this and mark it as solved.

We can come back to that.

wg_cepi wroteProblem: <time-saver> Any ideas?

If you mean that, when you try to connect to a webserver on your VPN server public IP address it does not go via the VPN then that is correct. Because the VPN server has to have a special route otherwise openvpn would route VPN packets through the VPN which would simply not work. Like uroboros ..

See --redirect-gateway def1 in The Manual v23x .. Read it carefully. (See the documented routing required to make it work)

wg_cepi

I have kinda solved my problem with dnsmasq. I've done the following:

Run dnsmasq and fetch /etc/hosts file or just any other file with domains bound to local IPs
Push that to the client from VPN server with dhcp-option in config
Configure config of client to update its DNS (with update-resolv-conf)

What does it mean?
Before:

I have accessed "not.public.com" in browser
Orignal public IP address (46.x.x.x) shows in access.log of server and server rejects me, because it allows only connection fron 192.168.*.* and 10.8.*.*.

After:

I have accessed "not.public.com" in browser
I have now "modified" DNS records, so my browser knows, that "not.public.com" points to, let's say 192.168.0.2
192.168.0.2 shows in access.log of server and server allows me to enter (because I am in 192.168.*.*)

So, I think we can close this topic and mark it as solved?
Also, thanks for help TinCanTech.