No access to Internet through sever

pier314

Hello,
I can connect to the VPN Server installed on a remote server (ping is OK) but I can't have access to Internet through the VPN.

The server is running on Debian 10:

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /var/log/openvpn/ipp.txt
client-config-dir ccd
route 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
tls-auth ta.key 0
cipher AES-256-CBC
auth SHA256
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
log /var/log/openvpn/openvpn.log
log-append /var/log/openvpn/openvpn.log
verb 4
explicit-exit-notify 1

In the ccd/ directory, I have only one client file :

ifconfig-push 10.8.0.7 10.8.0.8
iroute 192.168.1.0 255.255.255.0

On the client side (running on Manjaro):

client
dev tun
proto udp
remote X.X.X.X 1194 # where X.X.X.X is my actual server IP address
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
remote-cert-tls server
tls-auth ta.key 1
cipher AES-256-CBC
auth SHA256
verb 4

IP forwarding is enabled (net.ipv4.ip_forward=1).
The log file looks as follows :

Sat Dec 28 07:01:39 2019 us=170753 Could not determine IPv4/IPv6 protocol. Using AF_INET
Sat Dec 28 07:01:39 2019 us=170863 Socket Buffers: R=[212992->212992] S=[212992->212992]
Sat Dec 28 07:01:39 2019 us=170938 UDPv4 link local (bound): [AF_INET][undef]:1194
Sat Dec 28 07:01:39 2019 us=171036 UDPv4 link remote: [AF_UNSPEC]
Sat Dec 28 07:01:39 2019 us=171106 GID set to nogroup
Sat Dec 28 07:01:39 2019 us=171188 UID set to nobody
Sat Dec 28 07:01:39 2019 us=171257 MULTI: multi_init called, r=256 v=256
Sat Dec 28 07:01:39 2019 us=171382 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Sat Dec 28 07:01:39 2019 us=171487 IFCONFIG POOL LIST
Sat Dec 28 07:01:39 2019 us=171743 Initialization Sequence Completed
Sat Dec 28 07:03:03 2019 us=83343 MULTI: multi_create_instance called
Sat Dec 28 07:03:03 2019 us=83577 90.70.11.137:34689 Re-using SSL/TLS context
Sat Dec 28 07:03:03 2019 us=84043 90.70.11.137:34689 Control Channel MTU parms [ L:1621 D:1172 EF:78 EB:0 ET:0 EL:3 ]
Sat Dec 28 07:03:03 2019 us=84155 90.70.11.137:34689 Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
Sat Dec 28 07:03:03 2019 us=84351 90.70.11.137:34689 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1569,tun-mtu 1500,proto UDPv4,keydir 0,cipher AES-256-CBC,auth SHA256,keysize 256,tls-auth,key-method 2,tls-server'
Sat Dec 28 07:03:03 2019 us=84439 90.70.11.137:34689 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1569,tun-mtu 1500,proto UDPv4,keydir 1,cipher AES-256-CBC,auth SHA256,keysize 256,tls-auth,key-method 2,tls-client'
Sat Dec 28 07:03:03 2019 us=99079 90.70.11.137:34689 TLS: Initial packet from [AF_INET]90.70.11.137:34689, sid=b9209c8b 3a41ccf0
Sat Dec 28 07:03:03 2019 us=355778 90.70.11.137:34689 VERIFY OK: depth=1, CN=Easy-RSA CA
Sat Dec 28 07:03:03 2019 us=356759 90.70.11.137:34689 VERIFY OK: depth=0, CN=clientpa
Sat Dec 28 07:03:03 2019 us=359890 90.70.11.137:34689 peer info: IV_VER=2.4.8
Sat Dec 28 07:03:03 2019 us=360006 90.70.11.137:34689 peer info: IV_PLAT=linux
Sat Dec 28 07:03:03 2019 us=360063 90.70.11.137:34689 peer info: IV_PROTO=2
Sat Dec 28 07:03:03 2019 us=360124 90.70.11.137:34689 peer info: IV_NCP=2
Sat Dec 28 07:03:03 2019 us=360187 90.70.11.137:34689 peer info: IV_LZ4=1
Sat Dec 28 07:03:03 2019 us=360245 90.70.11.137:34689 peer info: IV_LZ4v2=1
Sat Dec 28 07:03:03 2019 us=360300 90.70.11.137:34689 peer info: IV_LZO=1
Sat Dec 28 07:03:03 2019 us=360357 90.70.11.137:34689 peer info: IV_COMP_STUB=1
Sat Dec 28 07:03:03 2019 us=360417 90.70.11.137:34689 peer info: IV_COMP_STUBv2=1
Sat Dec 28 07:03:03 2019 us=360481 90.70.11.137:34689 peer info: IV_TCPNL=1
Sat Dec 28 07:03:03 2019 us=459543 90.70.11.137:34689 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
Sat Dec 28 07:03:03 2019 us=459696 90.70.11.137:34689 [client] Peer Connection Initiated with [AF_INET]90.70.11.137:34689
Sat Dec 28 07:03:03 2019 us=459870 client/90.70.11.137:34689 OPTIONS IMPORT: reading client specific options from: ccd/clientpa
Sat Dec 28 07:03:03 2019 us=460247 client/90.70.11.137:34689 MULTI: Learn: 10.8.0.7 -> client/90.70.11.137:34689
Sat Dec 28 07:03:03 2019 us=460329 client/90.70.11.137:34689 MULTI: primary virtual IP for client/90.70.11.137:34689: 10.8.0.7
Sat Dec 28 07:03:03 2019 us=460405 client/90.70.11.137:34689 MULTI: internal route 192.168.1.0/24 -> client/90.70.11.137:34689
Sat Dec 28 07:03:03 2019 us=460489 client/90.70.11.137:34689 MULTI: Learn: 192.168.1.0/24 -> client/90.70.11.137:34689
Sat Dec 28 07:03:04 2019 us=491908 client/90.70.11.137:34689 PUSH: Received control message: 'PUSH_REQUEST'
Sat Dec 28 07:03:04 2019 us=492168 client/90.70.11.137:34689 SENT CONTROL [client]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.7 10.8.0.8,peer-id 0,cipher AES-256-GCM' (status=1)
Sat Dec 28 07:03:04 2019 us=492845 client/90.70.11.137:34689 Data Channel: using negotiated cipher 'AES-256-GCM'
Sat Dec 28 07:03:04 2019 us=492978 client/90.70.11.137:34689 Data Channel MTU parms [ L:1549 D:1450 EF:49 EB:406 ET:0 EL:3 ]
Sat Dec 28 07:03:04 2019 us=493442 client/90.70.11.137:34689 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Sat Dec 28 07:03:04 2019 us=493555 client/90.70.11.137:34689 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Sat Dec 28 07:03:05 2019 us=622585 client/90.70.11.137:34689 MULTI: Learn: 192.168.1.16 -> client/90.70.11.137:34689

From the client side, here is the output of ifconfig :

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 10.8.0.7  netmask 255.255.255.255  destination 10.8.0.8
        inet6 fe80::8938:4d99:18d0:63c0  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
        RX packets 1  bytes 48 (48.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 114  bytes 8588 (8.3 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

And from the server side, the ifconfig output is :

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 10.8.0.1  netmask 255.255.255.255  destination 10.8.0.2
        inet6 fe80::dab5:78f1:8c01:6451  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
        RX packets 222  bytes 14080 (13.7 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 6  bytes 288 (288.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Even when I disable the firewall (sudo ufw disable), I can't reach any Web site.

I have been searching across forums for tips and made several attempts to change my configs, but to no avail.

Any help would be welcomed !

TinCanTech

pier314 wrote In the ccd/ directory, I have only one client file :

ifconfig-push 10.8.0.7 10.8.0.8
iroute 192.168.1.0 255.255.255.0

Your --ifconfig-push addresses are invalid ..

pier314

I have changed the ifconfig-push addresses as follows :
ifconfig-push 10.8.0.7 255.255.255.0

But still to no avail : I can't access the Internet through the openvpn server :oops:

TinCanTech

pier314 wrote I have changed the ifconfig-push addresses as follows :
ifconfig-push 10.8.0.7 255.255.255.0

Which is still invalid for your setup ..

pier314

Hi,
I have followed the instructions (or I think I have) of the HowTo Page https://community.openvpn.net/openvpn/wiki/HOWTO#Creatingconfigurationfilesforserverandclients ; and I also tried to use the "topology subnet" (https://community.openvpn.net/openvpn/wiki/Concepts-Addressing).
But the result is always the same : "Initialization Sequence Completed", I'm connected to the OpenVpn server but I can't browse through it on Internet.

My current server.conf file is (other lines are unchanged) :

[olog]
server 10.8.0.0 255.255.255.0
route 10.8.1.0 255.255.255.0
client-config-dir ccd
[/olog]
while the client file in the ccd directory is simply
[olog]
ifconfig-push 10.8.1.1 10.8.1.2
[/olog]
(the iroute line has been removed)

By the way, the last messages of the log file is "MULTI: bad source address from client..."

Could you please either directly show me what is wrong in the config file or give me a link to a WIKI that is 1°) up to date and 2°) that handles server and client that are both on Linux ?
Thanks in advance.

TinCanTech

pier314 wrote My current server.conf file is (other lines are unchanged) :

[olog]
server 10.8.0.0 255.255.255.0
route 10.8.1.0 255.255.255.0
client-config-dir ccd
[/olog]
while the client file in the ccd directory is simply
[olog]
ifconfig-push 10.8.1.1 10.8.1.2
[/olog]
(the iroute line has been removed)

And it is still invalid ..

Did you read the Howto yet ?

pier314

Yes, I had read the HowTo, especially the section "Configuring client-specific rules and access policies", that says :

" In the server configuration file, define the Employee IP address pool:
server 10.8.0.0 255.255.255.0
Add routes for the System Administrator and Contractor IP ranges:
route 10.8.1.0 255.255.255.0
route 10.8.2.0 255.255.255.0
Because we will be assigning fixed IP addresses for specific System Administrators and Contractors, we will use a client configuration directory:
client-config-dir ccd
Now place special configuration files in the ccd subdirectory to define the fixed IP address for each non-Employee VPN client.
ccd/sysadmin1
ifconfig-push 10.8.1.1 10.8.1.2"

That is exactly what I copied in my config files (except of course for the name "sysadmin1" that have been replaced by my client name).

When you says it is still invalid, I suppose you are refering to something else but, in the HowTo page, I don't see anything helpful. Any hints ?

TinCanTech

TinCanTech wrote
pier314 wrote My current server.conf file is (other lines are unchanged) :

[olog]
server 10.8.0.0 255.255.255.0
route 10.8.1.0 255.255.255.0
client-config-dir ccd
[/olog]
while the client file in the ccd directory is simply
[olog]
ifconfig-push 10.8.1.1 10.8.1.2
[/olog]
(the iroute line has been removed)
And it is still invalid ..

Sorry, this is actually correct for --topology net30, I forgot about the extra route.

pier314 wrote give me a link to a WIKI that is 1°) up to date and 2°) that handles server and client that are both on Linux ?

https://community.openvpn.net/openvpn/wiki/HOWTO#Routingallclienttrafficincludingweb-trafficthroughtheVPN

Pippin

I'm not so sure this is correct:

ifconfig-push 10.8.1.1 10.8.1.2

Try:

ifconfig-push 10.8.1.2 10.8.1.1

pier314

I have tried this change : ifconfig-push 10.8.1.2 10.8.1.1
But same situation as previously : ping is OK, but no access to Internet through the VPN server and always the "bad source address from client [192.168.1.16], packet dropped" message in the log file.
Any other clue to solve this issue ?

TinCanTech

pier314 wrote and always the "bad source address from client [192.168.1.16], packet dropped" message in the log file.

You can safely ignore that, it is just a packet from the client LAN IP.

pier314 wrote Any other clue to solve this issue ?

Try this: http://pekster.sdf.org/misc/redirect.png