Can connect to OpenVPN, but can't access web

dain

Dear forum dwellers,

I have been trying to solve this problem for weeks and despite reading a lot of blog and forum posts, I haven't found a solution yet.

I have a Synology box running OpenVPN behind a stock NowTV Hub Two router (port 1194 manually forwarded).

This is where I am now:

When connecting using Tunnelblick on the Mac

Can connect to OpenVPN
Can ping Synology
Can SSH into Synology
Can ping back my connected Mac

Websites don’t load, even when using IP (trying 1.1.1.1)
Strangely this also includes Synology’s own web interface which is on the VPN (172.18.0.1:5000)

Tried with and without Set DNS / WINS, also tried manually setting DNS in Mac OS Network preferences

When connecting using OpenVPN Connect on Android

Works perfectly over 4G, can load websites and connect to Synology’s web UI :shock:
Doesn’t work at all over WiFi, same problem as Mac

These are my config files:

push "route 172.18.0.0 255.255.255.0"
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.4.4"
push "dhcp-option DNS 8.8.8.8"
dev tun
management 127.0.0.1 1195
server 172.18.0.0 255.255.255.0
dh /var/packages/VPNCenter/target/etc/openvpn/keys/dh3072.pem
ca /var/packages/VPNCenter/target/etc/openvpn/keys/ca.crt
cert /var/packages/VPNCenter/target/etc/openvpn/keys/server.crt
key /var/packages/VPNCenter/target/etc/openvpn/keys/server.key
max-clients 5
persist-tun
persist-key
verb 3
log-append /var/log/openvpn.log
keepalive 10 60
reneg-sec 0
plugin /var/packages/VPNCenter/target/lib/radiusplugin.so /var/packages/VPNCenter/target/etc/openvpn/radiusplugin.cnf
client-cert-not-required
username-as-common-name
duplicate-cn
status /tmp/ovpn_status_2_result 30
status-version 2
proto udp6
cipher AES-256-CBC
port 1194
auth SHA512

dev tun
tls-client
remote xxx 1194
redirect-gateway def1
pull
proto udp
script-security 2
reneg-sec 0
cipher AES-256-CBC
auth SHA512

auth-user-pass
<ca>
-----BEGIN CERTIFICATE-----
xxx
-----END CERTIFICATE-----
</ca>

TinCanTech

Please start here:
https://openvpn.net/community-resources/how-to/#redirect

dain

Thanks for the reply TinCanTech!

I had a good read of the link you posted and as far as I understood basically I need to make sure to NAT the VPN client traffic to the internet.

But then doing some further research (for example see this Synology forum post) this should already be set up and looking at the output below it does look like to be the case:

$ sudo iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
DEFAULT_POSTROUTING  all  --  anywhere             anywhere

Chain DEFAULT_POSTROUTING (1 references)
target     prot opt source               destination
MASQUERADE  all  --  172.18.0.0/24        anywhere

What I don't understand is that how it is possible that the whole setup works perfectly when I connect on my phone over 4G, but won't let me access anything either on the internet or even the VPN network when using Wifi.

Also, how come I can connect to my Synology box (the OpenVPN server) via SSH, but not to its web UI on the same IP (even though I'm using the VPN IP for both, so the route to the internet shouldn't matter)?

Is there anything else I can do to diagnose the issue?

dain

This was random, my problem was that my broadband provider NowTV is offering a free safe browsing service called Broadband Buddy, which is quite commendable, but apparently it was blocking traffic over VPN. As soon as I turned that off my VPN started working!

Credit goes to the kind soul who shared this info on this forum: http://forums.thinkbroadband.com/dslrouter/4596986-ditching-nowtv-router-for-hg612rt-ac68u.html