client connect to openvpn server but no internet

4pr3nd1z

Hello friends, here again requesting a little of your help.
I have been following some tutorials to install OpenVPN and I have succeeded, keep in mind that this is my first foray into the VPN world.

But, I have been presented with the following problem.
I have started the Openvpn server on PC1 with IPLAN 192.168.0.10 /gateway 192.168.0.1/mask 255.255.255.0
IP VPN 10.8.0.1

Router LAN IP 192.168.0.1 / Public IP 200.221.128.3
DMZ 192.168.0.10

another PC2 with LAN IP 192.168.0.20
IP VPN 10.8.0.2
although PC2 obtains internet through a wifi hotspot to access the public ip 200.221.128.3:1194 of the openvpn server on PC1 with IPLAN 192.168.0.10

having the vpn client started, there is a ping between both ip vpn 10.8.0.1 and 10.8.0.2
but I do not have access to the internet, I cannot get the PC2 client to obtain the public IP of PC1 when consulting the page https://www.whatismyip.com/

I have come to take into account the commands contained in this script: https://raw.githubusercontent.com/Angristan/openvpn-install/master/openvpn-install.sh

but my head is a bit confused, for this reason I ask for your guidance. I leave attached to this post the server and client configuration files.

sysctl -p
net.ipv4.ip_forward = 1

port 1194
proto udp
dev tun
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/server-openvpn.crt
key /etc/openvpn/server/server-openvpn.key
dh /etc/openvpn/server/dh2048.pem
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.0.0 255.255.255.0"
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.4.4"
push "dhcp-option DNS 8.8.8.8"
client-to-client
keepalive 10 120
tls-crypt /etc/openvpn/server/ta.key 0
remote-cert-tls client
cipher AES-256-GCM
tls-ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384:TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256
ecdh-curve secp521r1
tls-version-min 1.2
reneg-sec 0
auth SHA512
;compress lz4-v2
;push "compress lz4-v2"
comp-lzo
max-clients 5
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
explicit-exit-notify 1

client
dev tun
proto udp
remote 200.221.128.3 1194
#remote 192.168.0.10 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
mute-replay-warnings
ca /etc/openvpn/client/ca.crt
cert /etc/openvpn/client/client1-openvpn.crt
key /etc/openvpn/client/client1-openvpn.key
remote-cert-tls server
tls-crypt /etc/openvpn/client/ta.key 1
cipher AES-256-GCM
auth SHA512
auth-nocache
;compress lz4-v2
tls-ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384:TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256
comp-lzo
verb 3

If you need to know the result of any command like route -n or another, tell me and I'll put it.

Thank you very much in advance for your guidance.

TinCanTech

4pr3nd1z wrote my head is a bit confused

As is your network.

Here I have network-A and there I have identical network-A ..

4pr3nd1z

In theory, the configuration of the wlp3s0 interface on PC2 takes the following value

to differentiate the public IP of both PC1(ADSL) and PC2 (use a 4g hotspot)

in client
ip addr

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: enp2s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
    link/ether ff:00:00:00:ff:00 brd ff:ff:ff:ff:ff:ff
3: wlp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 00:00:ff:00:00:ff brd ff:ff:ff:ff:ff:ff
    inet 192.168.43.249/24 brd 192.168.43.255 scope global dynamic noprefixroute wlp3s0
       valid_lft 3522sec preferred_lft 3522sec
4: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 500
    link/none 
    inet 10.8.0.2/24 scope global tun0
       valid_lft forever preferred_lft forever

in server
ip addr

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether ff:00:00:00:ff:00 brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.10/24 brd 192.168.0.255 scope global enp3s0
       valid_lft forever preferred_lft forever
8: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 500
    link/none 
    inet 10.8.0.1/24 scope global tun0
       valid_lft forever preferred_lft forever

and router/modem
Ip lan 192.168.0.1 /255.255.255.0
Wan

TinCanTech

You will still have a network conflict if you try to route your remote LAN over the VPN.

There is a simple rule, Never use 192.168.0.0/24 (or any other common subnet) on your server LAN.
And try to avoid them on your client LAN, at all costs.

4pr3nd1z

TinCanTech wrote You will still have a network conflict if you try to route your remote LAN over the VPN.

There is a simple rule, Never use 192.168.0.0/24 (or any other common subnet) on your server LAN.
And try to avoid them on your client LAN, at all costs.

thanks for helping; TinCanTech

I read; AvoidRoutingConflicts

After reading several forum topics about some configurations to make my openvpn server work, I've ended up dizzy.
I'm sure it's a routing problem, I don't have much knowledge about iptables.
I leave exposed the following data, in case someone lends me his help. From now on, I'm grateful.
I have applied the following steps, but without positive results.
- I have changed the IPs within the LAN.
- I have modified some configurations in the file server.conf and client.conf
- I have disabled ufw on server and client1

it's something i'm not seeing

root@ovpnclient:~# ip route

0.0.0.0/1 via 10.8.1.1 dev tun0 
default via 192.168.10.1 dev wlp3s0 proto dhcp metric 600 
10.8.1.0/24 dev tun0 proto kernel scope link src 10.8.1.2 
128.0.0.0/1 via 10.8.1.1 dev tun0 
169.254.0.0/16 dev wlp3s0 scope link metric 1000 
123.123.123.123 via 192.168.10.1 dev wlp3s0 
192.168.10.0/24 dev wlp3s0 proto kernel scope link src 192.168.10.5 metric 600

root@ovpnserver:~# ip route

default via 192.168.10.1 dev enp3s0 onlink 
10.8.1.0/24 dev tun0 proto kernel scope link src 10.8.1.1 
192.168.10.0/24 dev enp3s0 proto kernel scope link src 192.168.10.10

port 1194
proto udp
dev tun
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/server.crt
key /etc/openvpn/server/server.key
dh /etc/openvpn/server/dh2048.pem
server 10.8.1.0 255.255.255.0
ifconfig-pool-persist ipp.txt
;push "route 192.168.10.0 255.255.255.0"
;push "route 192.168.20.0 255.255.255.0"
;push "route 192.168.0.0 255.255.255.0"
;push "route 192.168.0.1 255.255.255.0"
;push "route 10.8.0.0 255.255.255.0"
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.4.4"
push "dhcp-option DNS 8.8.8.8"
client-to-client
keepalive 10 120
tls-crypt /etc/openvpn/server/ta.key 0
remote-cert-tls client
cipher AES-256-GCM
tls-ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384:TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256
ecdh-curve secp521r1
tls-version-min 1.2
reneg-sec 0
auth SHA512
comp-lzo
max-clients 5
user nobody
group nogroup
persist-key
persist-tun
status /etc/openvpn/openvpn-status.log
verb 3
explicit-exit-notify 1

client
dev tun
proto udp
remote myIP.duckdns.org 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
mute-replay-warnings
ca /etc/openvpn/client/ca.crt
cert /etc/openvpn/client/client1.crt
key /etc/openvpn/client/client1.key
remote-cert-tls server
tls-crypt /etc/openvpn/client/ta.key 1
cipher AES-256-GCM
auth SHA512
auth-nocache
tls-ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384:TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256
comp-lzo
verb 3
redirect-gateway def1

Ref.:
https://forums.openvpn.net/viewforum.php?f=7
https://superuser.com/questions/624743/setting-up-bridged-openvpn-server-with-single-public-ip-nic
https://rodolfoarce.com/tutoriales/openvpn/

TinCanTech

Hey, sorry but I got distracted by your client subnet and the way you described your problem.

After review:

4pr3nd1z wrote having the vpn client started, there is a ping between both ip vpn 10.8.0.1 and 10.8.0.2
but I do not have access to the internet, I cannot get the PC2 client to obtain the public IP of PC1 when consulting the page https://www.whatismyip.com/

Then you probably need to read this:
https://community.openvpn.net/openvpn/wiki/HOWTO#Routingallclienttrafficincludingweb-trafficthroughtheVPN

4pr3nd1z

TinCanTech wrote https://community.openvpn.net/openvpn/wiki/HOWTO#Routingallclienttrafficincludingweb-trafficthroughtheVPN

hello, here again.-
I have come to realize my mission, I was right... it was configuration problems with routing.-

I just want to thank you for the good predisposition in helping me with some orientations.-

Linux is an exciting world where you learn the true meaning of technology. And not just click the next button, next... without knowing what you're doing.-

😃