xddq
Hey guys,
I have been struggling the last 4 days trying to set up an OpenVPN Access Server. I finally made the connection between my server machine and my client machine work. When I am trying to ping anything now from the client, it will fail. I am thinking this must be a routing issue, but I am quite novice with this topic and barely understand the commands. I will now try to describe my setup clearly and am hoping for some smart and also kind people to help me out.
Setup:
Machine 1: Default ubuntu image with docker installed. In the container the udp port 41194(host os) is mapped to 1194(container os) to establish a connection. Interfaces: enp0s3 -> nat network in virtualbox, static ip 192.168.222.5 and is through this network connected to machine2.
docker_gwbridge -> docker bridge from host to container(I think eth1 from the iptables rule does route to this bridge since it has the same subnet) . enp0s8 -> virtualbox nat adapter on host os.
Machine 2: base ubuntu image with openvpn package installed running $ sudo openvpn client.ovpn.
Interfaces: enp0s3 -> nat network in virtualbox. Does have static ip 192.168.222.4 and is through this network connected to machine1.
That's it. No more adapters and no connection to the internet. Only to machine 1.
After connecting to the server I did expect to be able to ping stuff like google.com etc. But I can't even ping 192.168.222.5 anymore. (Even after disconnecting from the vpn again) But that does get reverted after a reboot, I think that is somewhat of a virtualbox issue.
The only ip stuff I adapted:
-net.ipv4.ip_forward=1 # set in sysctl
# nat all vpn traffic to the internet. I did put this into ufw.before and enabled ufw with rules: deny any in, allow any out, alow any routing.
# and i did open the udp port 1194 which maps to 41194 on host os.
# Here eth1 is the interface I get when using ip route get 172.217.16.195 (google) inside the container
*nat
:POSTROUTING ACCEPT [0.0]
-A POSTROUTING -s 10.8.0.0/8 -o eth1 -j MASQUERADE
COMMIT
I do get a warning when running openvpn on the server:
sysctl: setting key "net.ipv4.conf.all.send_redirects": Read-only file system
sysctl: setting key "net.ipv4.conf.default.send_redirects": Read-only file system
sysctl: setting key "net.ipv4.conf.default.send_redirects": Read-only file system
Maybe this is what causes the issue? Which values should I assign these to? In docker I have to set them before running the container.
my server.ovpn:
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
tls-crypt tls-crypt.key
auth SHA512
tls-version-min 1.2
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256
ncp-ciphers AES-256-GCM:AES-256-CBC
dh dh2048.pem
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 1.0.0.1"
keepalive 10 60
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log-append openvpn.log
verb 6
explicit-exit-notify 1
my client.ovpn
client
dev tun
proto udp
remote 192.168.222.5 41194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
tls-crypt tls-crypt.key
auth SHA512
remote-cert-tls server
verb 6
<ca>
..
</ca>
<cert>
..
</cert>
<key>
...
</key>
<tls-crypt>
...
</tls-crypt>
Any suggestions or help is really appreciated, I'm slowly but surely becoming insane 😃
