Redirect-Gateway not working

Lazao

Hello,

I'm trying to figure out why the directive push "redirect-gateway def1" is not working in my server. I followed the OpenVPN documentation but didn't manage to make it working unfortunately.

First of all, here are the server/client configurations:

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /var/log/openvpn/ipp.txt
push "route 10.8.0.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
keepalive 10 120
tls-crypt ta.key 0
key-direction 0
cipher AES-256-CBC
auth SHA256
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
verb 3
explicit-exit-notify 1

dev tun
proto udp
remote serverip 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
remote-cert-tls server
key-direction 1
cipher AES-256-CBC
auth SHA256
comp-lzo
verb 3
push "redirect-gateway def1"
<ca>
</ca>
<cert>
</cert>
<key>
</key>
<tls-crypt>
</tls-crypt>

interfaces configuration:

ubuntu@ip-172-31-22-XX:~$ ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 9001
        inet 172.31.22.XX  netmask 255.255.240.0  broadcast 172.31.31.255
        inet6 fe80::8dd:1bff:fe44:4dc0  prefixlen 64  scopeid 0x20<link>
        ether 0a:dd:1b:44:4d:c0  txqueuelen 1000  (Ethernet)
        RX packets 53974  bytes 46601742 (46.6 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 25000  bytes 5878276 (5.8 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 10.8.0.1  netmask 255.255.255.255  destination 10.8.0.2
        inet6 fe80::ef80:3549:3556:914f  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
        RX packets 382  bytes 68030 (68.0 KB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 507  bytes 394677 (394.6 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

ubuntu@ip-172-31-22-XX:~$ route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         ip-172-31-16-1. 0.0.0.0         UG    100    0        0 eth0
10.8.0.0        ip-10-8-0-2.eu- 255.255.255.0   UG    0      0        0 tun0
ip-10-8-0-2.eu- 0.0.0.0         255.255.255.255 UH    0      0        0 tun0
172.31.16.0     0.0.0.0         255.255.240.0   U     0      0        0 eth0
ip-172-31-16-1. 0.0.0.0         255.255.255.255 UH    100    0        0 eth0
ubuntu@ip-172-31-22-XX:~$

And finally iptables configuration:

ubuntu@ip-172-31-22-XX:~$ sudo sysctl -p
net.ipv4.ip_forward = 1
ubuntu@ip-172-31-22-XX:~$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ubuntu@ip-172-31-22-XX:~$ sudo iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  ip-10-8-0-0.eu-west-3.compute.internal/24  anywhere             
ubuntu@ip-172-31-22-XX:~$

If my understanding is right, def1 directive will tell OpenVPN server to reach 0.0.0.0 using the first entry in the routing table, which is 172.31.16.1
and iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE will NAT the client traffic to the internet.
I can access to the internet using 172.31.16.1 as a default gateway.

I understand this is probably firewall related but I can't figure out why.

TinCanTech

Try using iptables-save to list your rules.

Lazao

Here is the output:

ubuntu@ip-172-31-26-XX:~$ sudo iptables-save
# Generated by iptables-save v1.6.1 on Fri Dec 27 20:31:26 2019
*nat
:PREROUTING ACCEPT [714:47220]
:INPUT ACCEPT [161:9277]
:OUTPUT ACCEPT [139:11305]
:POSTROUTING ACCEPT [139:11305]
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
COMMIT
# Completed on Fri Dec 27 20:31:26 2019
# Generated by iptables-save v1.6.1 on Fri Dec 27 20:31:26 2019
*filter
:INPUT ACCEPT [10655:1698832]
:FORWARD ACCEPT [7260:10674440]
:OUTPUT ACCEPT [14093:12102189]
-A FORWARD -s 10.8.0.0/24 -i tun0 -j ACCEPT
COMMIT
# Completed on Fri Dec 27 20:31:26 2019

TinCanTech

Is ip_forwarding enabled ?

Lazao

Yes it is.

ubuntu@ip-172-31-26-XX:~$ sudo sysctl -p
net.ipv4.ip_forward = 1

300000

can you try this to see if it works or not
reset iptables to defaul.

iptables-save | awk '/^[*]/ { print $1 }
/^:[A-Z]+ [^-]/ { print $1 " ACCEPT" ; }
/COMMIT/ { print $0; }' | iptables-restore

just nat it , we dont need s 10.8.0.0/24 in command.

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Lazao

Unfortunately that didn't help:

ubuntu@ip-172-31-26-XX:~# sudo iptables -L -n -v -t nat | grep -A 2 POSTROUTING
Chain POSTROUTING (policy ACCEPT 62 packets, 6200 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  350 24368 MASQUERADE  all  --  *      eth0    0.0.0.0/0            0.0.0.0/0           
root@ip-172-31-26-XX:~#

bytes column increases each time I try to reach any website from the client.

I also printed logs on the client side:

2019-12-28 12:57:07 1

2019-12-28 12:57:07 ----- OpenVPN Start -----
OpenVPN core 3.git::2ae73415 ios arm64 64-bit PT_PROXY built on Dec  2 2019 14:44:28

2019-12-28 12:57:07 OpenVPN core 3.git::2ae73415 ios arm64 64-bit PT_PROXY built on Dec  2 2019 14:44:28

2019-12-28 12:57:07 Frame=512/2048/512 mssfix-ctrl=1250

2019-12-28 12:57:07 UNUSED OPTIONS
4 [resolv-retry] [infinite] 
5 [nobind] 
6 [user] [nobody] 
7 [group] [nogroup] 
8 [persist-key] 
9 [persist-tun] 
13 [auth-nocache] 
14 [verb] [3] 

2019-12-28 12:57:07 EVENT: RESOLVE

2019-12-28 12:57:07 Contacting [64:ff9b::*:1194/UDP via UDP

2019-12-28 12:57:07 EVENT: WAIT

2019-12-28 12:57:07 Connecting to [*SERVER NAME*]:1194 (64:ff9b::*) via UDPv6

2019-12-28 12:57:07 EVENT: CONNECTING

2019-12-28 12:57:07 Tunnel Options:V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-client

2019-12-28 12:57:07 Creds: UsernameEmpty/PasswordEmpty

2019-12-28 12:57:07 Peer Info:
IV_GUI_VER=net.openvpn.connect.ios 3.1.1-2819
IV_VER=3.git::2ae73415
IV_PLAT=ios
IV_NCP=2
IV_TCPNL=1
IV_PROTO=2
IV_AUTO_SESS=1


2019-12-28 12:57:08 VERIFY OK : depth=1
cert. version     : 3
serial number     : 5A:1B:6E:9F:1B:FF:CE:76:5C:C1:5C:70:00:8B:91:E4:AB:31:0E:2F
issuer name       : C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA, ??=EasyRSA, emailAddress=me@myhost.mydomain
subject name      : C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA, ??=EasyRSA, emailAddress=me@myhost.mydomain
issued  on        : 2019-12-27 12:24:48
expires on        : 2029-12-24 12:24:48
signed using      : RSA with SHA-256
RSA key size      : 2048 bits
basic constraints : CA=true


2019-12-28 12:57:08 VERIFY OK : depth=0
cert. version     : 3
serial number     : 01
issuer name       : C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA, ??=EasyRSA, emailAddress=me@myhost.mydomain
subject name      : C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=server, ??=EasyRSA, emailAddress=me@myhost.mydomain
issued  on        : 2019-12-27 12:26:36
expires on        : 2029-12-24 12:26:36
signed using      : RSA with SHA-256
RSA key size      : 2048 bits
basic constraints : CA=false
subject alt name  : server
cert. type        : SSL Server
key usage         : Digital Signature, Key Encipherment
ext key usage     : TLS Web Server Authentication


2019-12-28 12:57:08 SSL Handshake: TLSv1.2/TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384

2019-12-28 12:57:08 Session is ACTIVE

2019-12-28 12:57:08 EVENT: GET_CONFIG

2019-12-28 12:57:08 Sending PUSH_REQUEST to server...

2019-12-28 12:57:08 OPTIONS:
0 [redirect-gateway] [def1] 
1 [block-outside-dns] 
2 [dhcp-option] [DNS] [8.8.8.8] 
3 [dhcp-option] [DNS] [8.8.4.4] 
4 [route-gateway] [10.8.0.1] 
5 [topology] [subnet] 
6 [ping] [10] 
7 [ping-restart] [120] 
8 [ifconfig] [10.8.0.4] [255.255.255.0] 
9 [peer-id] [0] 
10 [cipher] [AES-256-GCM] 


2019-12-28 12:57:08 PROTOCOL OPTIONS:
  cipher: AES-256-GCM
  digest: SHA512
  compress: NONE
  peer ID: 0

2019-12-28 12:57:08 EVENT: ASSIGN_IP

2019-12-28 12:57:08 NIP: preparing TUN network settings

2019-12-28 12:57:08 NIP: init TUN network settings with endpoint: 64:ff9b::*

2019-12-28 12:57:08 NIP: adding IPv4 address to network settings 10.8.0.4/255.255.255.0

2019-12-28 12:57:08 NIP: adding (included) IPv4 route 10.8.0.0/24

2019-12-28 12:57:08 NIP: redirecting all IPv4 traffic to TUN interface

2019-12-28 12:57:08 NIP: adding DNS 8.8.8.8

2019-12-28 12:57:08 NIP: adding DNS 8.8.4.4

2019-12-28 12:57:08 Connected via NetworkExtensionTUN

2019-12-28 12:57:08 EVENT: CONNECTED *SERVER NAME*:1194 (64:ff9b::*IP*) via /UDPv6 on NetworkExtensionTUN/10.8.0.4/ gw=[/]

I'm connected using IPv6 stack, don't know if it might be the issue.
Also found that: gw=[/] Does that mean there is no gateway?

300000

we do know you connected ip6 stack and you try to put everything on ipv4 on iptables what do you expect? no way , if you want to try ipv6 you need full ipv6 on server config not ipv4 as you post on you server,try to connect ipv4 first to see ipv4 works or not after that try new ipv6 later and update all serer config with ipv6 address.

Lazao

Same rules are applied on ip6tables.
But even with "IPV4-ONLY TUNNEL" option forced on the client, it didn't work.

Lazao

A quick update on this.
I figured out that when I tried to access to the VPN server using LTE connection, UDPv6 seems to be forced somehow.

So, I decided to force v4 in both server/client configurations using proto udp4.
Unfortunately, it didn't help.

Then, I forced the configuration in the OpenVPN Connect IOS app using IPv4-Only Tunnel option.
It didn't help neither.

Unfortunately, I cannot disable IPv6 on my IOS device at a system level. The only way for me to make everything working is to create a Cellular profile (using Apple Configurator) that matches my carrier defaults settings, but forcing IPv4 protocol.

I guess the other option is to properly configure IPv6 on the OpenVPN server. I follow this documentation: https://community.openvpn.net/openvpn/wiki/IPv6 but it didn't work neither.

300000

push "redirect-gateway def1" remove from client , this for server only .

Lazao

It's ignored anyway.

TinCanTech

Can the client, while connected to the VPN, ping the server at 10.8.0.1 and google at 8.8.8.8 ?

stringpark

Having the same trouble here as well (I think). I don't want to distract, but didn't want to create a new thread if it is indeed the exact same issue. So, newbie here trying to set up a client-to-server config with the server being an edgerouter. Followed the instructions in https://www.youtube.com/watch?v=LTBE8YiPhkg and it works great on a PC, iPhone, and Android when connected over external WiFi (including an LTE Wifi hotspot), but when the iPhone or Android are connected directly over LTE (without the hotspot), the client shows connected in the app, but I can't talk to any devices on my home network. As @Lazao mentioned, I'm pretty sure it's an issue of the client being assigned an IPv6 address from the mobile carrier (shows IPv6 when googling "my ip"), but I hardly know what to do about it.

TinCanTech

@stringpark .. definitely not the same thing.

stringpark

Ok, thx. Will start a new post. 👍

TinCanTech

On closer inspection, your issue could be related, even the same but I don't understand why that video helped. Maybe if you present your solution here clearly it would help.