(Solved) OpenVPN does not allow me to resolve host

GeoffatMM

I have two servers, both set up (bar names) identically. Both are on VPS, one uses the host dhcp setting for interfaces and dns, the other uses its own dns server and network interface settings.

I have duplicated iptables.up.rules on both server so I am reasonably confident that is not the issue. From my client Mac I can connect to both VPN servers. One works perfectly, the other does not as it stops all internet traffic with the occasional message (on whatsmyip for example) cannot resolve host.

I think my OpenVPN setup is fine and it is an underlying network issue causing the problem but I am not experienced enough to find or even understand it! So I am posting the problematic details to see if anyone can offer some guidance.

port 1194
proto udp
dev tun0
ca keys/xorexca/ca.crt
cert keys/xorexca/xorexserverkey.crt
key keys/xorexca/xorexserverkey.key
dh keys/xorexca/dh2048.pem
topology subnet
server 10.10.0.0 255.255.255.0
crl-verify keys/xorexca/crl.pem
cipher AES-256-CBC
user nobody
group nogroup
status servers/xorexVPN/logs/openvpn-status.log
log-append servers/xorexVPN/logs/openvpn.log
verb 2
mute 20
max-clients 100
keepalive 10 120
client-config-dir /etc/openvpn/servers/xorexVPN/ccd
comp-lzo
persist-key
persist-tun
ccd-exclusive
topology subnet
auth sha512
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
push "redirect-gateway def1 bypass-dhcp"

Server log:

Sat May  9 23:57:13 2020 event_wait : Interrupted system call (code=4)
Sat May  9 23:57:13 2020 Closing TUN/TAP interface
Sat May  9 23:57:13 2020 /sbin/ip addr del dev tun0 10.10.0.1/24
RTNETLINK answers: Operation not permitted
Sat May  9 23:57:13 2020 Linux ip addr del failed: external program exited with error status: 2
Sat May  9 23:57:13 2020 SIGTERM[hard,] received, process exiting
Sat May  9 23:57:28 2020 us=737393 Current Parameter Settings:
Sat May  9 23:57:28 2020 us=737438   config = '/etc/openvpn/xorexVPN.conf'
Sat May  9 23:57:28 2020 us=737651   mode = 1
Sat May  9 23:57:28 2020 us=737663   persist_config = DISABLED
Sat May  9 23:57:28 2020 us=737670   persist_mode = 1
Sat May  9 23:57:28 2020 us=737677   show_ciphers = DISABLED
Sat May  9 23:57:28 2020 us=737684   show_digests = DISABLED
Sat May  9 23:57:28 2020 us=737691   show_engines = DISABLED
Sat May  9 23:57:28 2020 us=737698   genkey = DISABLED
Sat May  9 23:57:28 2020 us=737705   key_pass_file = '[UNDEF]'
Sat May  9 23:57:28 2020 us=737712   show_tls_ciphers = DISABLED
Sat May  9 23:57:28 2020 us=737719   connect_retry_max = 0
Sat May  9 23:57:28 2020 us=737726 Connection profiles [0]:
Sat May  9 23:57:28 2020 us=737733   proto = udp
Sat May  9 23:57:28 2020 us=737740   local = '[UNDEF]'
Sat May  9 23:57:28 2020 us=737747   local_port = '1194'
Sat May  9 23:57:28 2020 us=737754   remote = '[UNDEF]'
Sat May  9 23:57:28 2020 us=737761   remote_port = '1194'
Sat May  9 23:57:28 2020 us=737768   remote_float = DISABLED
Sat May  9 23:57:28 2020 us=737774   bind_defined = DISABLED
Sat May  9 23:57:28 2020 us=737781 NOTE: --mute triggered...
Sat May  9 23:57:28 2020 us=737795 269 variation(s) on previous 20 message(s) suppressed by --mute
Sat May  9 23:57:28 2020 us=737803 OpenVPN 2.4.7 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 20 2019
Sat May  9 23:57:28 2020 us=737816 library versions: OpenSSL 1.1.1g  21 Apr 2020, LZO 2.10
Sat May  9 23:57:28 2020 us=740392 Diffie-Hellman initialized with 2048 bit key
Sat May  9 23:57:28 2020 us=742741 TLS-Auth MTU parms [ L:1622 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Sat May  9 23:57:28 2020 us=744072 TUN/TAP device tun0 opened
Sat May  9 23:57:28 2020 us=744146 TUN/TAP TX queue length set to 100
Sat May  9 23:57:28 2020 us=744182 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Sat May  9 23:57:28 2020 us=744211 /sbin/ip link set dev tun0 up mtu 1500
Sat May  9 23:57:28 2020 us=750007 /sbin/ip addr add dev tun0 10.10.0.1/24 broadcast 10.10.0.255
Sat May  9 23:57:28 2020 us=760064 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
Sat May  9 23:57:28 2020 us=765391 Could not determine IPv4/IPv6 protocol. Using AF_INET
Sat May  9 23:57:28 2020 us=765440 Socket Buffers: R=[212992->212992] S=[212992->212992]
Sat May  9 23:57:28 2020 us=765515 UDPv4 link local (bound): [AF_INET][undef]:1194
Sat May  9 23:57:28 2020 us=765530 UDPv4 link remote: [AF_UNSPEC]
Sat May  9 23:57:28 2020 us=765547 GID set to nogroup
Sat May  9 23:57:28 2020 us=765566 UID set to nobody
Sat May  9 23:57:28 2020 us=765588 MULTI: multi_init called, r=256 v=256
Sat May  9 23:57:28 2020 us=765641 IFCONFIG POOL: base=10.10.0.2 size=252, ipv6=0
Sat May  9 23:57:28 2020 us=765771 Initialization Sequence Completed

client
proto udp
dev tun
ca ca.crt
dh dh2048.pem
cert xorex.crt
key xorex.key
remote xxx.xxx.xxx.xxx 1194
cipher AES-256-CBC
verb 2
mute 20
keepalive 10 120
comp-lzo
persist-key
persist-tun
float
resolv-retry infinite
nobind
auth sha512

Client log:
(NB: I did not know where to add the verb 4 statement or which client log you need . This is from the OpenVPN client but I cannot see how to edit the config file through the client app)

10/05/2020, 00:07:18 OpenVPN core 3.git::2ae73415 mac x86_64 64-bit PT_PROXY built on Oct 29 2019 08:19:07
⏎10/05/2020, 00:07:18 Frame=512/2048/512 mssfix-ctrl=1250
⏎10/05/2020, 00:07:18 EVENT: RESOLVE ⏎10/05/2020, 00:07:18 UNUSED OPTIONS
4 [dh] [-----BEGIN DH PARAMETERS----- MIIBCAKCAQEAqxcc2KpF991QSXa5tXwQ7+...] 
9 [verb] [2] 
10 [mute] [20] 
13 [persist-key] 
14 [persist-tun] 
16 [resolv-retry] [infinite] 
17 [nobind] 
⏎10/05/2020, 00:07:18 Contacting xxx.xxx.xxx.xxx:1194 via UDP
⏎10/05/2020, 00:07:18 Connecting to [xxx.xxx.xxx.xxx]:1194 (xxx.xxx.xxx.xxx) via UDPv4
⏎10/05/2020, 00:07:18 EVENT: WAIT ⏎10/05/2020, 00:07:18 Tunnel Options:V4,dev-type tun,link-mtu 1602,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-client
⏎10/05/2020, 00:07:18 Creds: UsernameEmpty/PasswordEmpty
⏎10/05/2020, 00:07:18 Peer Info:
IV_GUI_VER=OCmacOS_3.1.0-890
IV_VER=3.git::2ae73415
IV_PLAT=mac
IV_NCP=2
IV_TCPNL=1
IV_PROTO=2
IV_LZO_STUB=1
IV_COMP_STUB=1
IV_COMP_STUBv2=1
IV_AUTO_SESS=1

⏎10/05/2020, 00:07:18 EVENT: CONNECTING ⏎10/05/2020, 00:07:18 SSL Handshake: TLSv1.2/TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384
⏎10/05/2020, 00:07:18 Session is ACTIVE
⏎10/05/2020, 00:07:18 Sending PUSH_REQUEST to server...
⏎10/05/2020, 00:07:18 EVENT: GET_CONFIG ⏎10/05/2020, 00:07:18 OPTIONS:
0 [dhcp-option] [DNS] [8.8.8.8] 
1 [dhcp-option] [DNS] [8.8.4.4] 
2 [redirect-gateway] [def1] [bypass-dhcp] 
3 [route-gateway] [10.10.0.1] 
4 [topology] [subnet] 
5 [ping] [10] 
6 [ping-restart] [120] 
7 [ifconfig] [10.10.0.2] [255.255.255.0] 
8 [peer-id] [0] 
9 [cipher] [AES-256-GCM] 

⏎10/05/2020, 00:07:18 PROTOCOL OPTIONS:
  cipher: AES-256-GCM
  digest: SHA512
  compress: LZO_STUB
  peer ID: 0
⏎10/05/2020, 00:07:18 TunPersist: short-term connection scope
⏎10/05/2020, 00:07:18 TunPersist: new tun context
⏎10/05/2020, 00:07:18 EVENT: ASSIGN_IP ⏎10/05/2020, 00:07:18 CAPTURED OPTIONS:
Session Name: xxx.xxx.xxx.xxx
Layer: OSI_LAYER_3
MTU: 1500
Remote Address: xxx.xxx.xxx.xxx
Tunnel Addresses:
  10.10.0.2/24 -> 10.10.0.1
Reroute Gateway: IPv4=1 IPv6=0 flags=[ ENABLE REROUTE_GW DEF1 BYPASS_DHCP IPv4 ]
Block IPv6: no
Add Routes:
Exclude Routes:
DNS Servers:
  8.8.8.8
  8.8.4.4
Search Domains:

⏎10/05/2020, 00:07:19 SetupClient: transmitting tun setup list to /var/run/ovpnagent.sock
{
	"config" : 
	{
		"iface_name" : "",
		"layer" : "OSI_LAYER_3",
		"tun_prefix" : false
	},
	"pid" : 514,
	"tun" : 
	{
		"adapter_domain_suffix" : "",
		"block_ipv6" : false,
		"dns_servers" : 
		[
			{
				"address" : "8.8.8.8",
				"ipv6" : false
			},
			{
				"address" : "8.8.4.4",
				"ipv6" : false
			}
		],
		"layer" : 3,
		"mtu" : 1500,
		"remote_address" : 
		{
			"address" : "xxx.xxx.xxx.xxx",
			"ipv6" : false
		},
		"reroute_gw" : 
		{
			"flags" : 307,
			"ipv4" : true,
			"ipv6" : false
		},
		"route_metric_default" : -1,
		"session_name" : "xxx.xxx.xxx.xxx",
		"tunnel_address_index_ipv4" : 0,
		"tunnel_address_index_ipv6" : -1,
		"tunnel_addresses" : 
		[
			{
				"address" : "10.10.0.2",
				"gateway" : "10.10.0.1",
				"ipv6" : false,
				"metric" : -1,
				"net30" : false,
				"prefix_length" : 24
			}
		]
	}
}
POST unix://[/var/run/ovpnagent.sock]/tun-setup : 200 OK
{
	"iface_name" : "utun5",
	"layer" : "OSI_LAYER_3",
	"tun_prefix" : true
}
/sbin/ifconfig utun5 down
/sbin/ifconfig utun5 10.10.0.2 10.10.0.1 netmask 255.255.255.0 mtu 1500 up
/sbin/route add -net 10.10.0.0 -netmask 255.255.255.0 10.10.0.2
add net 10.10.0.0: gateway 10.10.0.2
/sbin/route add -net xxx.xxx.xxx.xxx -netmask 255.255.255.255 10.0.0.1
add net xxx.xxx.xxx.xxx: gateway 10.0.0.1
/sbin/route add -net 0.0.0.0 -netmask 128.0.0.0 10.10.0.1
add net 0.0.0.0: gateway 10.10.0.1
/sbin/route add -net 128.0.0.0 -netmask 128.0.0.0 10.10.0.1
add net 128.0.0.0: gateway 10.10.0.1
MacDNSAction: FLAGS=F RD=1 SO=5000 DNS=8.8.8.8,8.8.4.4 DOM= ADS=
open utun5 SUCCEEDED
⏎10/05/2020, 00:07:19 Connected via utun5
⏎10/05/2020, 00:07:19 LZO-ASYM init swap=0 asym=1
⏎10/05/2020, 00:07:19 Comp-stub init swap=0
⏎10/05/2020, 00:07:19 EVENT: CONNECTED xxx.xxx.xxx.xxx:1194 (xxx.xxx.xxx.xxx) via /UDPv4 on utun5/10.10.0.2/ gw=[10.10.0.1/]⏎10/05/2020, 00:07:58 MacLifeCycle NET_IFACE en0
⏎10/05/2020, 00:07:58 MacLifeCycle NET_STATE 1 status=ReachableViaWiFi flags=-R -------
⏎10/05/2020, 00:07:58 MacLifeCycle NET_IFACE en0
⏎10/05/2020, 00:07:58 SetupClient: transmitting tun destroy request to /var/run/ovpnagent.sock
GET unix://[/var/run/ovpnagent.sock]/tun-destroy : 200 OK
/sbin/route delete -net 10.10.0.0 -netmask 255.255.255.0 10.10.0.2
delete net 10.10.0.0: gateway 10.10.0.2
/sbin/route delete -net xxx.xxx.xxx.xxx -netmask 255.255.255.255 10.0.0.1
delete net 51.75.171.43: gateway 10.0.0.1
/sbin/route delete -net 0.0.0.0 -netmask 128.0.0.0 10.10.0.1
delete net 0.0.0.0: gateway 10.10.0.1
/sbin/route delete -net 128.0.0.0 -netmask 128.0.0.0 10.10.0.1
delete net 128.0.0.0: gateway 10.10.0.1
/sbin/ifconfig utun5 down
MacDNSAction: FLAGS=F
⏎10/05/2020, 00:07:58 Raw stats on disconnect:
  BYTES_IN : 3821
  BYTES_OUT : 29091
  PACKETS_IN : 13
  PACKETS_OUT : 290
  TUN_BYTES_IN : 20687
  TUN_PACKETS_IN : 279
⏎10/05/2020, 00:07:58 Performance stats on disconnect:
  CPU usage (microseconds): 149390026
  Tunnel compression ratio (downlink): inf
  Network bytes per CPU second: 220
  Tunnel bytes per CPU second: 138
⏎10/05/2020, 00:07:58 EVENT: DISCONNECTED ⏎

iptables.up.rules:

# Generated by webmin
*filter
:INPUT_ZONES_SOURCE - [0:0]
:FWDO_public - [0:0]
:FORWARD ACCEPT [0:0]
:INPUT_ZONES - [0:0]
:OUTPUT_direct - [0:0]
:FORWARD_IN_ZONES - [0:0]
:FWDI_public - [0:0]
:FORWARD_OUT_ZONES - [0:0]
:INPUT_direct - [0:0]
:FORWARD_IN_ZONES_SOURCE - [0:0]
:INPUT ACCEPT [0:0]
:FWDO_public_log - [0:0]
:IN_public - [0:0]
:FWDI_public_allow - [0:0]
:FWDI_public_deny - [0:0]
:FORWARD_OUT_ZONES_SOURCE - [0:0]
:OUTPUT ACCEPT [0:0]
:FWDO_public_deny - [0:0]
:FWDO_public_allow - [0:0]
:IN_public_log - [0:0]
:IN_public_allow - [0:0]
:FORWARD_direct - [0:0]
:FWDI_public_log - [0:0]
:IN_public_deny - [0:0]
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -j INPUT_direct
-A INPUT -j INPUT_ZONES_SOURCE
-A INPUT -j INPUT_ZONES
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i lo -j ACCEPT
-A FORWARD -j FORWARD_direct
-A FORWARD -j FORWARD_IN_ZONES_SOURCE
-A FORWARD -j FORWARD_IN_ZONES
-A FORWARD -j FORWARD_OUT_ZONES_SOURCE
-A FORWARD -j FORWARD_OUT_ZONES
-A FORWARD -m conntrack --ctstate INVALID -j DROP
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A OUTPUT -j OUTPUT_direct
-A INPUT_direct -p tcp -m multiport -m set -j REJECT --reject-with icmp-port-unreachable --dports 22  --match-set f2b-sshd src 
-A INPUT_direct -p tcp -m multiport -m set -j REJECT --reject-with icmp-port-unreachable --dports 10000  --match-set f2b-webmin-auth src 
-A INPUT_ZONES -i eth0  -g IN_public
-A INPUT_ZONES  -g IN_public
-A FORWARD_IN_ZONES -i eth0  -g FWDI_public
-A FORWARD_IN_ZONES  -g FWDI_public
-A FORWARD_OUT_ZONES -o eth0  -g FWDO_public
-A FORWARD_OUT_ZONES  -g FWDO_public
-A IN_public -j IN_public_log
-A IN_public -j IN_public_deny
-A IN_public -j IN_public_allow
-A IN_public -p icmp -j ACCEPT
-A IN_public_allow -p tcp -m tcp -m conntrack --dport 22 --ctstate NEW,UNTRACKED -j ACCEPT
-A IN_public_allow -p tcp -m tcp -m conntrack --dport 25 --ctstate NEW,UNTRACKED -j ACCEPT
-A IN_public_allow -p tcp -m tcp -m conntrack --dport 465 --ctstate NEW,UNTRACKED -j ACCEPT
-A IN_public_allow -p tcp -m tcp -m conntrack --dport 21 --ctstate NEW,UNTRACKED -j ACCEPT
-A IN_public_allow -p tcp -m tcp -m conntrack --dport 110 --ctstate NEW,UNTRACKED -j ACCEPT
-A IN_public_allow -p tcp -m tcp -m conntrack --dport 995 --ctstate NEW,UNTRACKED -j ACCEPT
-A IN_public_allow -p tcp -m tcp -m conntrack --dport 143 --ctstate NEW,UNTRACKED -j ACCEPT
-A IN_public_allow -p tcp -m tcp -m conntrack --dport 993 --ctstate NEW,UNTRACKED -j ACCEPT
-A IN_public_allow -p tcp -m tcp -m conntrack --dport 80 --ctstate NEW,UNTRACKED -j ACCEPT
-A IN_public_allow -p tcp -m tcp -m conntrack --dport 443 --ctstate NEW,UNTRACKED -j ACCEPT
-A IN_public_allow -p udp -m udp -m conntrack --dport 1194 --ctstate NEW,UNTRACKED -j ACCEPT
-A IN_public_allow -p tcp -m tcp -m conntrack --dport 587 --ctstate NEW,UNTRACKED -j ACCEPT
-A IN_public_allow -p tcp -m tcp -m conntrack --dport 53 --ctstate NEW,UNTRACKED -j ACCEPT
-A IN_public_allow -p tcp -m tcp -m conntrack --dport 20 --ctstate NEW,UNTRACKED -j ACCEPT
-A IN_public_allow -p tcp -m tcp -m conntrack --dport 2222 --ctstate NEW,UNTRACKED -j ACCEPT
-A IN_public_allow -p tcp -m tcp -m conntrack --dport 10000:10100 --ctstate NEW,UNTRACKED -j ACCEPT
-A IN_public_allow -p tcp -m tcp -m conntrack --dport 20000 --ctstate NEW,UNTRACKED -j ACCEPT
-A IN_public_allow -p udp -m udp -m conntrack --dport 53 --ctstate NEW,UNTRACKED -j ACCEPT
-A FWDI_public -j FWDI_public_log
-A FWDI_public -j FWDI_public_deny
-A FWDI_public -j FWDI_public_allow
-A FWDI_public -p icmp -j ACCEPT
-A FWDO_public -j FWDO_public_log
-A FWDO_public -j FWDO_public_deny
-A FWDO_public -j FWDO_public_allow
COMMIT
# Completed
# Generated by webmin
*mangle
:PREROUTING_ZONES_SOURCE - [0:0]
:PRE_public - [0:0]
:PRE_public_deny - [0:0]
:INPUT_direct - [0:0]
:FORWARD_direct - [0:0]
:POSTROUTING_direct - [0:0]
:PREROUTING_ZONES - [0:0]
:OUTPUT_direct - [0:0]
:OUTPUT ACCEPT [0:0]
:PREROUTING_direct - [0:0]
:POSTROUTING ACCEPT [0:0]
:PRE_public_log - [0:0]
:PREROUTING ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:PRE_public_allow - [0:0]
:INPUT ACCEPT [0:0]
-A PREROUTING -j PREROUTING_direct
-A PREROUTING -j PREROUTING_ZONES_SOURCE
-A PREROUTING -j PREROUTING_ZONES
-A INPUT -j INPUT_direct
-A FORWARD -j FORWARD_direct
-A OUTPUT -j OUTPUT_direct
-A POSTROUTING -j POSTROUTING_direct
-A PREROUTING_ZONES -i eth0  -g PRE_public
-A PREROUTING_ZONES  -g PRE_public
-A PRE_public -j PRE_public_log
-A PRE_public -j PRE_public_deny
-A PRE_public -j PRE_public_allow
COMMIT
# Completed
# Generated by webmin
*nat
:POSTROUTING_direct - [0:0]
:PREROUTING_direct - [0:0]
:POST_public_allow - [0:0]
:PRE_public_allow - [0:0]
:POSTROUTING_ZONES_SOURCE - [0:0]
:POSTROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:PREROUTING_ZONES_SOURCE - [0:0]
:POST_public_log - [0:0]
:POST_public - [0:0]
:OUTPUT ACCEPT [0:0]
:PRE_public_log - [0:0]
:PRE_public - [0:0]
:PREROUTING ACCEPT [0:0]
:PREROUTING_ZONES - [0:0]
:POSTROUTING_ZONES - [0:0]
:POST_public_deny - [0:0]
:OUTPUT_direct - [0:0]
:PRE_public_deny - [0:0]
-A PREROUTING -j PREROUTING_direct
-A PREROUTING -j PREROUTING_ZONES_SOURCE
-A PREROUTING -j PREROUTING_ZONES
-A POSTROUTING -j POSTROUTING_direct
-A POSTROUTING -j POSTROUTING_ZONES_SOURCE
-A POSTROUTING -j POSTROUTING_ZONES
-A POSTROUTING -s 10.10.0.0 -o eth0 -j MASQUERADE
-A OUTPUT -j OUTPUT_direct
-A PREROUTING_ZONES -i eth0  -g PRE_public
-A PREROUTING_ZONES    -g PRE_public
-A POSTROUTING_ZONES -o eth0  -g POST_public
-A POSTROUTING_ZONES    -g POST_public
-A PRE_public -j PRE_public_log
-A PRE_public -j PRE_public_deny
-A PRE_public -j PRE_public_allow
-A POST_public -j POST_public_log
-A POST_public -j POST_public_deny
-A POST_public -j POST_public_allow
COMMIT
# Completed

GeoffatMM

I did some tests with tcpdump and it appears that my vpn server cannot access port 22, ssh? On trace route, my client gets straight to the server (10.10.0.1) but then it stops and the tcpdump presumably shows why? Is this a firewall issue?

TinCanTech

GeoffatMM wrote Is this a firewall issue?

Scrolling through your post ... 149 lines of iptables sounds exactly like :roll:

FYI: BBCode [ oconf=config ] is useful .. but [ olog ] is utter crap. Report that to a mod for me :twisted:

GeoffatMM

Update:
I have ripped up the iptables and stripped it back to allow everything in and out and masquerade for the Open VPN setting 10.8.0.1.
Generated a new CA, VPN and client using port 1195. Connects to server OK. Does not allow access to the internet when connected so I do not think the IP tables is the issue. Compared client log files of success (10.10.0.0) and fail (10.8.0.0) bearing in mind they are going to different servers the only difference (ignoring the IP differences) was in the last few lines (the messages are the same but the order is different):

Failed gives:

open utun5 SUCCEEDED
⏎10/05/2020, 16:37:37 EVENT: CONNECTED xxx.xxx.xxx.xx1:1195 (xxx.xxx.xxx.xx1) via /UDPv4 on utun5/10.8.0.2/ gw=[10.8.0.1/]⏎10/05/2020, 16:37:37 Connected via utun5
⏎10/05/2020, 16:37:37 LZO-ASYM init swap=0 asym=1
⏎10/05/2020, 16:37:37 Comp-stub init swap=0
⏎

Succeeded gives:

open utun5 SUCCEEDED
⏎10/05/2020, 16:36:45 Connected via utun5
⏎10/05/2020, 16:36:45 LZO-ASYM init swap=0 asym=1
⏎10/05/2020, 16:36:45 Comp-stub init swap=0
⏎10/05/2020, 16:36:45 EVENT: CONNECTED xxx.xxx.xxx.xx2:1194 (xxx.xxx.xxx.xx2) via /UDPv4 on utun5/10.10.0.2/ gw=[10.10.0.1/]⏎

I also tried pushing my own dns server which it accepted and logged but it made no difference.

Can anyone offer me some help? Do you need some information from the server itself?

TinCanTech

GeoffatMM wrote I have ripped up the iptables and stripped it back to allow everything in and out and masquerade for the Open VPN setting 10.8.0.1.

I bet you did that incorrectly, as you did previously, see:

GeoffatMM wrote -A POSTROUTING -s 10.10.0.0 -o eth0 -j MASQUERADE

That should be:

-A POSTROUTING -s 10.10.0.0/24 -o eth0 -j MASQUERADE

in the NAT table.

GeoffatMM

Update:

TinCan Tech, thanks for the input but 10.10 was on one server and 10.8 the other to make sure I knew which was which in the logs.

By adding my own dns server IP address to the push options, I was able to see and interact with my server but I still could not get out to the wider internet. Read through the help guides and once again tried to sort the iptables. When I saved them with iptables save, I saw that the list did not reflect what webmin was telling me so once again ripped it up and rebuilt this time I added specific tun instructions. Also found that bind on webmin had disabled recursion but it was still operating. Deleted it completely from the conf file then rebooted and suddenly it stared to wrk so I am not sure which bit it was but I suspect it was the tun allowances in the tables that solved it.

This can now be closed.