openvpn authenticates but no internet

paule

Hi guys,

My first post here, please be gentle 🙂 . I've got a co-location server configured with a VM that runs pfSense with all the routing enabled, I've got various services on various VMs (including the below) where everything works port mapping wise.

Ive got a VM that runs Ubuntu 18.04.4 LTS (latest update) and openvpn
The VM has IP address 172.16.31.118
NIC = ens160 = 172.16.31.118
internal = tun0 (172.16.35.0/24)

Below the OpenVPN server config:

dev tun
proto udp4
port 443
persist-key
persist-tun
keepalive 10 120
txqueuelen 1000

user ovpn
group ovpn

#LOGGING
verb 3
status /etc/openvpn/status.log
log /etc/openvpn/openvpn.log

ca /etc/certs/CA/common/ca.pem
cert /etc/certs/CA/server/server.pem
key /etc/certs/CA/server/server.key
dh /etc/certs/CA/server/dh4096.pem
tls-crypt /etc/certs/CA/server/ta.key
#crl-verify certs/crl.pem

cipher AES-256-CBC
auth SHA512
tls-version-min 1.2
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256
ncp-ciphers AES-256-GCM:AES-256-CBC

server 172.16.35.0 255.255.255.0
push "redirect-gateway def1"
push "route 172.16.35.0 255.255.255.0"
push "dhcp-option DNS 9.9.9.9"
push "dhcp-option DNS 8.8.8.8"

UPDATE:My iptables look as follows:

# Generated by iptables-save v1.6.1 on Fri Mar 27 16:36:45 2020
*nat
:PREROUTING ACCEPT [357:30009]
:INPUT ACCEPT [26:1482]
:OUTPUT ACCEPT [56:3749]
:POSTROUTING ACCEPT [56:3749]
[0:0] -A POSTROUTING -s 172.16.35.0/24 -o eth0 -j MASQUERADE
[0:0] -A POSTROUTING -s 172.16.35.0/24 -o ens160 -j MASQUERADE
COMMIT
# Completed on Fri Mar 27 16:36:45 2020
# Generated by iptables-save v1.6.1 on Fri Mar 27 16:36:45 2020
*filter
:INPUT ACCEPT [10:734]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [150:31256]
[1:82] -A INPUT -i ens160 -p udp -m state --state NEW -m udp --dport 443 -j ACCEPT
[0:0] -A INPUT -i tun+ -j ACCEPT
[143:11265] -A INPUT -i lo -j ACCEPT
[1037:112561] -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
[0:0] -A INPUT -i tun0 -j ACCEPT
[0:0] -A FORWARD -i ens160 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A FORWARD -i tun0 -o ens160 -j ACCEPT
[0:0] -A FORWARD -i ens160 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A FORWARD -i ens160 -o tun0 -j ACCEPT
[147:11425] -A OUTPUT -o lo -j ACCEPT
COMMIT
# Completed on Fri Mar 27 16:36:45 2020

I am aware that some of them are double, but I am super lost.

I am able to connect to OpenVPN with my script However once the connection is made internet is not working. Internal (pinging other machines etc) does work. Note: it used to work but the machine had a restart, I think I messed up the iptables. Therefor I suspect it must be an iptable related issue. But I am clue-less. :?:

What am I doing wrong here?

Thanks!

TinCanTech

Your interface is named ens160 not eth0 ..

paule

TinCanTech wrote Your interface is named ens160 not eth0 ..

I've got both of them in the iptables?

paule

Updated the iptables No luck:

# Generated by iptables-save v1.6.1 on Fri Mar 27 17:07:38 2020
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
[5:593] -A INPUT -i lo -j ACCEPT
[1084:135539] -A INPUT -j ACCEPT
[0:0] -A INPUT -i tun0 -j ACCEPT
[0:0] -A INPUT -i ens160 -p udp -m state --state NEW -m udp --dport 443 -j ACCEPT
[0:0] -A FORWARD -i tun0 -j ACCEPT
[0:0] -A FORWARD -i tun0 -o ens160 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A FORWARD -i ens160 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
[418:69623] -A OUTPUT -j ACCEPT
COMMIT
# Completed on Fri Mar 27 17:07:38 2020
# Generated by iptables-save v1.6.1 on Fri Mar 27 17:07:38 2020
*nat
:PREROUTING ACCEPT [553:56800]
:INPUT ACCEPT [16:1159]
:OUTPUT ACCEPT [6:664]
:POSTROUTING ACCEPT [6:664]
[0:0] -A POSTROUTING -s 172.16.35.0/24 -o ens160 -j MASQUERADE
COMMIT
# Completed on Fri Mar 27 17:07:38 2020

TiTex

since your server is pushing redirect-gateway option, make sure your DNS servers are reachable, either by using some globally accessible servers, like the ones pushed by your VPN server , or make sure that the ones pushed by your VPN are actually being applied on the client

for linux clients , this should work
https://github.com/jonathanio/update-systemd-resolved

TiTex

also these are not required , since your iptables chains default policies are set to ACCEPT

[5:593] -A INPUT -i lo -j ACCEPT
[1084:135539] -A INPUT -j ACCEPT
[0:0] -A INPUT -i tun0 -j ACCEPT
[0:0] -A INPUT -i ens160 -p udp -m state --state NEW -m udp --dport 443 -j ACCEPT
[0:0] -A FORWARD -i tun0 -j ACCEPT
[0:0] -A FORWARD -i tun0 -o ens160 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A FORWARD -i ens160 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
[418:69623] -A OUTPUT -j ACCEPT

paule

TiTex wrote since your server is pushing redirect-gateway option, make sure your DNS servers are reachable, either by using some globally accessible servers, like the ones pushed by your VPN server , or make sure that the ones pushed by your VPN are actually being applied on the client

for linux clients , this should work
https://github.com/jonathanio/update-systemd-resolved

I tried on my iphone and mac and both get the DNS server pushed (I can see them being added into the systems) yet no success.

paule

TiTex wrote also these are not required , since your iptables chains default policies are set to ACCEPT

[5:593] -A INPUT -i lo -j ACCEPT
[1084:135539] -A INPUT -j ACCEPT
[0:0] -A INPUT -i tun0 -j ACCEPT
[0:0] -A INPUT -i ens160 -p udp -m state --state NEW -m udp --dport 443 -j ACCEPT
[0:0] -A FORWARD -i tun0 -j ACCEPT
[0:0] -A FORWARD -i tun0 -o ens160 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A FORWARD -i ens160 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
[418:69623] -A OUTPUT -j ACCEPT

I assumed, but I am not having any luck...

Where else could I look? Again the VPN connection is established.

TiTex

enable forwarding on your server

sudo sh -c "echo 1 > /proc/sys/net/ipv4/ip_forward"

paule

TiTex wrote enable forwarding on your server

sudo sh -c "echo 1 > /proc/sys/net/ipv4/ip_forward"

This fixed it. THANKS!!!

I will have to make that permanent

paule

Mmm this is not working on my iphone yet for some reason.