Openvpn in a linux container (lxc); connection work but no traffic flows

darksky

I currently have standalone linux box running Openvpn 2.3.14 that is correctly configured and works perfectly. My goal is to move that to a linux container (lxc). I did so, but it isn't working. I can connect to the openvpn server but I cannot get traffic to flow (web pages just time out). What am I missing?

1) Host OS: Arch Linux x86_64 using a netctl driven bridge, br0.
2) LXC: Arch Linux x86_64; I copied the contents of /etc/openvpn/* from the functional system to the lxc's /etc/openvpn.

On the host OS:

% sysctl net.ipv4.conf | grep forward
net.ipv4.conf.all.forwarding = 1
net.ipv4.conf.all.mc_forwarding = 0
net.ipv4.conf.br0.forwarding = 1
net.ipv4.conf.br0.mc_forwarding = 0
net.ipv4.conf.default.forwarding = 1
net.ipv4.conf.default.mc_forwarding = 0
net.ipv4.conf.eth0.forwarding = 1
net.ipv4.conf.eth0.mc_forwarding = 0
net.ipv4.conf.lo.forwarding = 1
net.ipv4.conf.lo.mc_forwarding = 0

% ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master br0 state UP group default qlen 1000
    link/ether b8:27:eb:9b:6b:a9 brd ff:ff:ff:ff:ff:ff
3: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 5e:c1:38:80:f1:23 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.103/24 brd 192.168.1.255 scope global dynamic br0
       valid_lft 84402sec preferred_lft 84402sec
7: vethN1D7E7@if6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br0 state UP group default qlen 1000
    link/ether fe:5f:70:3e:bc:0c brd ff:ff:ff:ff:ff:ff link-netnsid 0

% ip r
default via 192.168.1.1 dev br0 proto dhcp src 192.168.1.103 metric 1024 
192.168.1.0/24 dev br0 proto kernel scope link src 192.168.1.103 
192.168.1.1 dev br0 proto dhcp scope link src 192.168.1.103 metric 1024

# cat /etc/netctl/bridge 
# ln -s /dev/null /etc/udev/rules.d/80-net-setup-link.rules
Description='lxc bridge'
Interface=br0
Connection=bridge
BindsToInterfaces=('eth0')
IP=dhcp

I configured ufw on the host OS per this wiki article:

% sudo  iptables-save
# Generated by iptables-save v1.6.0 on Wed Dec 28 10:26:58 2016
*nat
:PREROUTING ACCEPT [28:4379]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [21:3055]
:POSTROUTING ACCEPT [21:3055]
-A POSTROUTING -s 192.168.1.244/32 -o eth0 -j MASQUERADE
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
COMMIT
# Completed on Wed Dec 28 10:26:58 2016
# Generated by iptables-save v1.6.0 on Wed Dec 28 10:26:58 2016
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:ufw-after-forward - [0:0]
:ufw-after-input - [0:0]
:ufw-after-logging-forward - [0:0]
:ufw-after-logging-input - [0:0]
:ufw-after-logging-output - [0:0]
:ufw-after-output - [0:0]
:ufw-before-forward - [0:0]
:ufw-before-input - [0:0]
:ufw-before-logging-forward - [0:0]
:ufw-before-logging-input - [0:0]
:ufw-before-logging-output - [0:0]
:ufw-before-output - [0:0]
:ufw-logging-allow - [0:0]
:ufw-logging-deny - [0:0]
:ufw-not-local - [0:0]
:ufw-reject-forward - [0:0]
:ufw-reject-input - [0:0]
:ufw-reject-output - [0:0]
:ufw-skip-to-policy-forward - [0:0]
:ufw-skip-to-policy-input - [0:0]
:ufw-skip-to-policy-output - [0:0]
:ufw-track-forward - [0:0]
:ufw-track-input - [0:0]
:ufw-track-output - [0:0]
:ufw-user-forward - [0:0]
:ufw-user-input - [0:0]
:ufw-user-limit - [0:0]
:ufw-user-limit-accept - [0:0]
:ufw-user-logging-forward - [0:0]
:ufw-user-logging-input - [0:0]
:ufw-user-logging-output - [0:0]
:ufw-user-output - [0:0]
-A INPUT -j ufw-before-logging-input
-A INPUT -j ufw-before-input
-A INPUT -j ufw-after-input
-A INPUT -j ufw-after-logging-input
-A INPUT -j ufw-reject-input
-A INPUT -j ufw-track-input
-A FORWARD -j ufw-before-logging-forward
-A FORWARD -j ufw-before-forward
-A FORWARD -j ufw-after-forward
-A FORWARD -j ufw-after-logging-forward
-A FORWARD -j ufw-reject-forward
-A FORWARD -j ufw-track-forward
-A OUTPUT -j ufw-before-logging-output
-A OUTPUT -j ufw-before-output
-A OUTPUT -j ufw-after-output
-A OUTPUT -j ufw-after-logging-output
-A OUTPUT -j ufw-reject-output
-A OUTPUT -j ufw-track-output
-A ufw-after-input -p udp -m udp --dport 137 -j ufw-skip-to-policy-input
-A ufw-after-input -p udp -m udp --dport 138 -j ufw-skip-to-policy-input
-A ufw-after-input -p tcp -m tcp --dport 139 -j ufw-skip-to-policy-input
-A ufw-after-input -p tcp -m tcp --dport 445 -j ufw-skip-to-policy-input
-A ufw-after-input -p udp -m udp --dport 67 -j ufw-skip-to-policy-input
-A ufw-after-input -p udp -m udp --dport 68 -j ufw-skip-to-policy-input
-A ufw-after-input -m addrtype --dst-type BROADCAST -j ufw-skip-to-policy-input
-A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-forward -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A ufw-before-forward -p icmp -m icmp --icmp-type 4 -j ACCEPT
-A ufw-before-forward -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A ufw-before-forward -p icmp -m icmp --icmp-type 12 -j ACCEPT
-A ufw-before-forward -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A ufw-before-forward -j ufw-user-forward
-A ufw-before-input -i lo -j ACCEPT
-A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny
-A ufw-before-input -m conntrack --ctstate INVALID -j DROP
-A ufw-before-input -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A ufw-before-input -p icmp -m icmp --icmp-type 4 -j ACCEPT
-A ufw-before-input -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A ufw-before-input -p icmp -m icmp --icmp-type 12 -j ACCEPT
-A ufw-before-input -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A ufw-before-input -p udp -m udp --sport 67 --dport 68 -j ACCEPT
-A ufw-before-input -j ufw-not-local
-A ufw-before-input -d 224.0.0.251/32 -p udp -m udp --dport 5353 -j ACCEPT
-A ufw-before-input -d 239.255.255.250/32 -p udp -m udp --dport 1900 -j ACCEPT
-A ufw-before-input -j ufw-user-input
-A ufw-before-output -o lo -j ACCEPT
-A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-output -j ufw-user-output
-A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN
-A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN
-A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN
-A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny
-A ufw-not-local -j DROP
-A ufw-skip-to-policy-forward -j ACCEPT
-A ufw-skip-to-policy-input -j DROP
-A ufw-skip-to-policy-output -j ACCEPT
-A ufw-track-forward -p tcp -m conntrack --ctstate NEW -j ACCEPT
-A ufw-track-forward -p udp -m conntrack --ctstate NEW -j ACCEPT
-A ufw-track-output -p tcp -m conntrack --ctstate NEW -j ACCEPT
-A ufw-track-output -p udp -m conntrack --ctstate NEW -j ACCEPT
-A ufw-user-input -s 192.168.1.0/24 -j ACCEPT
-A ufw-user-input -p tcp -m tcp --dport 443 -j ACCEPT
-A ufw-user-input -p udp -m udp --dport 443 -j ACCEPT
-A ufw-user-limit -j REJECT --reject-with icmp-port-unreachable
-A ufw-user-limit-accept -j ACCEPT
-A ufw-user-logging-forward -j RETURN
-A ufw-user-logging-input -j RETURN
-A ufw-user-logging-output -j RETURN
COMMIT
# Completed on Wed Dec 28 10:26:58 2016

Now in the container OS:

# cat /var/lib/lxc/box/config 
lxc.rootfs = /var/lib/lxc/test/rootfs
lxc.utsname = test
lxc.arch = x86_64
lxc.include = /usr/share/lxc/config/archlinux.common.conf
## network
lxc.network.type = veth
lxc.network.flags = up
lxc.network.link = br0
lxc.network.name = eth0
lxc.network.ipv4 = 192.168.1.244/24
lxc.network.ipv4.gateway = 192.168.1.1

## systemd within the lxc
lxc.autodev = 1
lxc.hook.autodev = /var/lib/lxc/test/autodev
lxc.pts = 1024
lxc.kmsg = 0

## for openvpn
lxc.cgroup.devices.allow = c 10:200 rwm

# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
8: eth0@if9: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether d6:2c:5c:d0:48:57 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 192.168.1.244/24 brd 192.168.1.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet 192.168.1.196/24 brd 192.168.1.255 scope global secondary dynamic eth0
       valid_lft 86398sec preferred_lft 86398sec

# ip r
default via 192.168.1.1 dev eth0 
default via 192.168.1.1 dev eth0 proto dhcp src 192.168.1.196 metric 1024 
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.244 
192.168.1.1 dev eth0 proto dhcp scope link src 192.168.1.196 metric 1024

TinCanTech

darksky wrote My goal is to move that to a linux container (lxc). I did so, but it isn't working

As the server is a VPS you need to use the right iptables rule (Use the correct VPN subnet 10.*):

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source 12.34.56.78   # <-- Use your OpenVPN server's real external IP here

darksky

TinCanTech wrote
darksky wrote My goal is to move that to a linux container (lxc). I did so, but it isn't working
As the server is a VPS you need to use the right iptables rule (Use the correct VPN subnet 10.*):
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source 12.34.56.78   # <-- Use your OpenVPN server's real external IP here

Thanks for the reply. I executed that line from the LXC, but it did not change the behavior of openvpn unfortunately. I still can connect to the openvpn server but cannot view web traffic.

TinCanTech

TinCanTech wrote
darksky wrote My goal is to move that to a linux container (lxc). I did so, but it isn't working
As the server is a VPS you need to use the right iptables rule (Use the correct VPN subnet 10.*):
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source 12.34.56.78   # <-- Use your OpenVPN server's real external IP here

darksky wrote I executed that line from the LXC, but it did not change the behavior of openvpn unfortunately

Did you edited that line before your executed it ?

darksky

Of course I did 😃 Replaced with my external IP as you recommended.

TinCanTech

darksky wrote Replaced with my external IP as you recommended

That is not a recommendation .. it is a requirement.

Try clearing all your iptables rules and then try that one line again.

darksky

The problem was with my lxc setup it turns out... the install script was creating eth0 and a secondary veth. I was forwarding the openvpn traffic in my router to the IP I setup. Fixing this gives a functional result. I wrote up a wiki page detailing how to re-create:
https://wiki.archlinux.org/index.php/OpenVPN_(server)_in_Linux_containers

Thank you for the reply.