I have installed openvpn using Angristan (
https://github.com/angristan/openvpn-install ) on Openvz 7 running debian 10 . So most of the configuration things were handled by it. It created a client config file (myClient.ovpn) which I downloaded on client.
On client (which is linux mint 20.3), I am testing connecting using :
openvpn --client --config myClient.ovpn
It connects fine, I can now ping the vpn gateway ie. (from client):
ping 10.8.0.1
But I can't ping google or anything else, it is clearly routing issue I can't find fault with my limited knowledge :
ping 8.8.8.8
Gives nothing.
Dns is working properly as if I use ping yahoo.com then it resolves to yahoo IP but again can't ping.
$ ping yahoo.com
PING yahoo.com (74.6.143.25) 56(84) bytes of data.
--- yahoo.com ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3154ms
Since I have been asked to provide details as per the topic:
Server Details :
Openvpn version:
~# openvpn --version
OpenVPN 2.4.7 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 28 2021
library versions: OpenSSL 1.1.1d 10 Sep 2019, LZO 2.10
Originally developed by James Yonan
uname -a
~#uname -a
Linux mySerer.domainHost.com 4.19.0 #1 SMP Tue Aug 25 11:59:26 MSK 2020 x86_64 GNU/Linux
Note: Its a openvz 7 based vps
Server config:
cat /etc/openvpn/server.conf
port 2220
proto udp
dev tun
user nobody
group nogroup
persist-key
persist-tun
keepalive 10 120
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
push "redirect-gateway def1 bypass-dhcp"
dh none
ecdh-curve prime256v1
tls-crypt tls-crypt.key
crl-verify crl.pem
ca ca.crt
cert server_JCJHDggypybdTuKJ.crt
key server_JCJHDggypybdTuKJ.key
auth SHA256
cipher AES-128-GCM
ncp-ciphers AES-128-GCM
tls-server
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
client-config-dir /etc/openvpn/ccd
status /var/log/openvpn/status.log
verb 4
Server logs (at verb 4)
Fri Mar 25 20:49:40 2022 us=209532 Current Parameter Settings:
Fri Mar 25 20:49:40 2022 us=209572 config = '/etc/openvpn/server.conf'
Fri Mar 25 20:49:40 2022 us=209580 mode = 1
Fri Mar 25 20:49:40 2022 us=209585 persist_config = DISABLED
Fri Mar 25 20:49:40 2022 us=209590 persist_mode = 1
Fri Mar 25 20:49:40 2022 us=209595 show_ciphers = DISABLED
Fri Mar 25 20:49:40 2022 us=209600 show_digests = DISABLED
Fri Mar 25 20:49:40 2022 us=209605 show_engines = DISABLED
Fri Mar 25 20:49:40 2022 us=209610 genkey = DISABLED
Fri Mar 25 20:49:40 2022 us=209615 key_pass_file = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=209620 show_tls_ciphers = DISABLED
Fri Mar 25 20:49:40 2022 us=209625 connect_retry_max = 0
Fri Mar 25 20:49:40 2022 us=209630 Connection profiles [0]:
Fri Mar 25 20:49:40 2022 us=209635 proto = udp
Fri Mar 25 20:49:40 2022 us=209640 local = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=209645 local_port = '2220'
Fri Mar 25 20:49:40 2022 us=209650 remote = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=209655 remote_port = '2220'
Fri Mar 25 20:49:40 2022 us=209660 remote_float = DISABLED
Fri Mar 25 20:49:40 2022 us=209664 bind_defined = DISABLED
Fri Mar 25 20:49:40 2022 us=209669 bind_local = ENABLED
Fri Mar 25 20:49:40 2022 us=209674 bind_ipv6_only = DISABLED
Fri Mar 25 20:49:40 2022 us=209679 connect_retry_seconds = 5
Fri Mar 25 20:49:40 2022 us=209684 connect_timeout = 120
Fri Mar 25 20:49:40 2022 us=209689 socks_proxy_server = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=209694 socks_proxy_port = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=209699 tun_mtu = 1500
Fri Mar 25 20:49:40 2022 us=209704 tun_mtu_defined = ENABLED
Fri Mar 25 20:49:40 2022 us=209708 link_mtu = 1500
Fri Mar 25 20:49:40 2022 us=209713 link_mtu_defined = DISABLED
Fri Mar 25 20:49:40 2022 us=209718 tun_mtu_extra = 0
Fri Mar 25 20:49:40 2022 us=209723 tun_mtu_extra_defined = DISABLED
Fri Mar 25 20:49:40 2022 us=209728 mtu_discover_type = -1
Fri Mar 25 20:49:40 2022 us=209733 fragment = 0
Fri Mar 25 20:49:40 2022 us=209738 mssfix = 1450
Fri Mar 25 20:49:40 2022 us=209743 explicit_exit_notification = 0
Fri Mar 25 20:49:40 2022 us=209748 Connection profiles END
Fri Mar 25 20:49:40 2022 us=209753 remote_random = DISABLED
Fri Mar 25 20:49:40 2022 us=209758 ipchange = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=209763 dev = 'tun'
Fri Mar 25 20:49:40 2022 us=209768 dev_type = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=209772 dev_node = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=209777 lladdr = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=209782 topology = 3
Fri Mar 25 20:49:40 2022 us=209787 ifconfig_local = '10.8.0.1'
Fri Mar 25 20:49:40 2022 us=209792 ifconfig_remote_netmask = '255.255.255.0'
Fri Mar 25 20:49:40 2022 us=209797 ifconfig_noexec = DISABLED
Fri Mar 25 20:49:40 2022 us=209802 ifconfig_nowarn = DISABLED
Fri Mar 25 20:49:40 2022 us=209807 ifconfig_ipv6_local = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=209812 ifconfig_ipv6_netbits = 0
Fri Mar 25 20:49:40 2022 us=209817 ifconfig_ipv6_remote = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=209821 shaper = 0
Fri Mar 25 20:49:40 2022 us=209826 mtu_test = 0
Fri Mar 25 20:49:40 2022 us=209831 mlock = DISABLED
Fri Mar 25 20:49:40 2022 us=209841 keepalive_ping = 10
Fri Mar 25 20:49:40 2022 us=209850 keepalive_timeout = 120
Fri Mar 25 20:49:40 2022 us=209855 inactivity_timeout = 0
Fri Mar 25 20:49:40 2022 us=209860 ping_send_timeout = 10
Fri Mar 25 20:49:40 2022 us=209865 ping_rec_timeout = 240
Fri Mar 25 20:49:40 2022 us=209870 ping_rec_timeout_action = 2
Fri Mar 25 20:49:40 2022 us=209877 ping_timer_remote = DISABLED
Fri Mar 25 20:49:40 2022 us=209882 remap_sigusr1 = 0
Fri Mar 25 20:49:40 2022 us=209887 persist_tun = ENABLED
Fri Mar 25 20:49:40 2022 us=209892 persist_local_ip = DISABLED
Fri Mar 25 20:49:40 2022 us=209897 persist_remote_ip = DISABLED
Fri Mar 25 20:49:40 2022 us=209902 persist_key = ENABLED
Fri Mar 25 20:49:40 2022 us=209906 passtos = DISABLED
Fri Mar 25 20:49:40 2022 us=209911 resolve_retry_seconds = 1000000000
Fri Mar 25 20:49:40 2022 us=209916 resolve_in_advance = DISABLED
Fri Mar 25 20:49:40 2022 us=209924 username = 'nobody'
Fri Mar 25 20:49:40 2022 us=209930 groupname = 'nogroup'
Fri Mar 25 20:49:40 2022 us=209934 chroot_dir = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=209939 cd_dir = '/etc/openvpn'
Fri Mar 25 20:49:40 2022 us=209944 writepid = '/run/openvpn/server.pid'
Fri Mar 25 20:49:40 2022 us=209949 up_script = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=209954 down_script = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=209959 down_pre = DISABLED
Fri Mar 25 20:49:40 2022 us=209963 up_restart = DISABLED
Fri Mar 25 20:49:40 2022 us=209968 up_delay = DISABLED
Fri Mar 25 20:49:40 2022 us=209973 daemon = ENABLED
Fri Mar 25 20:49:40 2022 us=209979 inetd = 0
Fri Mar 25 20:49:40 2022 us=209988 log = ENABLED
Fri Mar 25 20:49:40 2022 us=209995 suppress_timestamps = DISABLED
Fri Mar 25 20:49:40 2022 us=210003 machine_readable_output = DISABLED
Fri Mar 25 20:49:40 2022 us=210008 nice = 0
Fri Mar 25 20:49:40 2022 us=210013 verbosity = 4
Fri Mar 25 20:49:40 2022 us=210018 mute = 0
Fri Mar 25 20:49:40 2022 us=210023 gremlin = 0
Fri Mar 25 20:49:40 2022 us=210028 status_file = '/var/log/openvpn/status.log'
Fri Mar 25 20:49:40 2022 us=210033 status_file_version = 1
Fri Mar 25 20:49:40 2022 us=210038 status_file_update_freq = 10
Fri Mar 25 20:49:40 2022 us=210043 occ = ENABLED
Fri Mar 25 20:49:40 2022 us=210048 rcvbuf = 0
Fri Mar 25 20:49:40 2022 us=210052 sndbuf = 0
Fri Mar 25 20:49:40 2022 us=210057 mark = 0
Fri Mar 25 20:49:40 2022 us=210062 sockflags = 0
Fri Mar 25 20:49:40 2022 us=210067 fast_io = DISABLED
Fri Mar 25 20:49:40 2022 us=210072 comp.alg = 0
Fri Mar 25 20:49:40 2022 us=210077 comp.flags = 0
Fri Mar 25 20:49:40 2022 us=210082 route_script = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=210087 route_default_gateway = '10.8.0.2'
Fri Mar 25 20:49:40 2022 us=210092 route_default_metric = 0
Fri Mar 25 20:49:40 2022 us=210097 route_noexec = DISABLED
Fri Mar 25 20:49:40 2022 us=210102 route_delay = 0
Fri Mar 25 20:49:40 2022 us=210107 route_delay_window = 30
Fri Mar 25 20:49:40 2022 us=210113 route_delay_defined = DISABLED
Fri Mar 25 20:49:40 2022 us=210117 route_nopull = DISABLED
Fri Mar 25 20:49:40 2022 us=210122 route_gateway_via_dhcp = DISABLED
Fri Mar 25 20:49:40 2022 us=210127 allow_pull_fqdn = DISABLED
Fri Mar 25 20:49:40 2022 us=210132 management_addr = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=210137 management_port = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=210142 management_user_pass = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=210147 management_log_history_cache = 250
Fri Mar 25 20:49:40 2022 us=210152 management_echo_buffer_size = 100
Fri Mar 25 20:49:40 2022 us=210157 management_write_peer_info_file = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=210164 management_client_user = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=210169 management_client_group = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=210174 management_flags = 0
Fri Mar 25 20:49:40 2022 us=210179 shared_secret_file = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=210184 key_direction = not set
Fri Mar 25 20:49:40 2022 us=210189 ciphername = 'AES-128-GCM'
Fri Mar 25 20:49:40 2022 us=210194 ncp_enabled = ENABLED
Fri Mar 25 20:49:40 2022 us=210199 ncp_ciphers = 'AES-128-GCM'
Fri Mar 25 20:49:40 2022 us=210204 authname = 'SHA256'
Fri Mar 25 20:49:40 2022 us=210209 prng_hash = 'SHA1'
Fri Mar 25 20:49:40 2022 us=210213 prng_nonce_secret_len = 16
Fri Mar 25 20:49:40 2022 us=210218 keysize = 0
Fri Mar 25 20:49:40 2022 us=210223 engine = DISABLED
Fri Mar 25 20:49:40 2022 us=210228 replay = ENABLED
Fri Mar 25 20:49:40 2022 us=210233 mute_replay_warnings = DISABLED
Fri Mar 25 20:49:40 2022 us=210238 replay_window = 64
Fri Mar 25 20:49:40 2022 us=210243 replay_time = 15
Fri Mar 25 20:49:40 2022 us=210248 packet_id_file = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=210253 use_iv = ENABLED
Fri Mar 25 20:49:40 2022 us=210258 test_crypto = DISABLED
Fri Mar 25 20:49:40 2022 us=210263 tls_server = ENABLED
Fri Mar 25 20:49:40 2022 us=210268 tls_client = DISABLED
Fri Mar 25 20:49:40 2022 us=210276 key_method = 2
Fri Mar 25 20:49:40 2022 us=210281 ca_file = 'ca.crt'
Fri Mar 25 20:49:40 2022 us=210286 ca_path = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=210291 dh_file = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=210296 cert_file = 'server_JCJHDggypybdTuKJ.crt'
Fri Mar 25 20:49:40 2022 us=210301 extra_certs_file = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=210306 priv_key_file = 'server_JCJHDggypybdTuKJ.key'
Fri Mar 25 20:49:40 2022 us=210311 pkcs12_file = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=210316 cipher_list = 'TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256'
Fri Mar 25 20:49:40 2022 us=210321 cipher_list_tls13 = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=210326 tls_cert_profile = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=210331 tls_verify = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=210336 tls_export_cert = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=210341 verify_x509_type = 0
Fri Mar 25 20:49:40 2022 us=210345 verify_x509_name = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=210350 crl_file = 'crl.pem'
Fri Mar 25 20:49:40 2022 us=210355 ns_cert_type = 0
Fri Mar 25 20:49:40 2022 us=210360 remote_cert_ku[i] = 0
Fri Mar 25 20:49:40 2022 us=210365 remote_cert_ku[i] = 0
Fri Mar 25 20:49:40 2022 us=210370 remote_cert_ku[i] = 0
Fri Mar 25 20:49:40 2022 us=210375 remote_cert_ku[i] = 0
Fri Mar 25 20:49:40 2022 us=210380 remote_cert_ku[i] = 0
Fri Mar 25 20:49:40 2022 us=210385 remote_cert_ku[i] = 0
Fri Mar 25 20:49:40 2022 us=210390 remote_cert_ku[i] = 0
Fri Mar 25 20:49:40 2022 us=210395 remote_cert_ku[i] = 0
Fri Mar 25 20:49:40 2022 us=210401 remote_cert_ku[i] = 0
Fri Mar 25 20:49:40 2022 us=210410 remote_cert_ku[i] = 0
Fri Mar 25 20:49:40 2022 us=210420 remote_cert_ku[i] = 0
Fri Mar 25 20:49:40 2022 us=210429 remote_cert_ku[i] = 0
Fri Mar 25 20:49:40 2022 us=210438 remote_cert_ku[i] = 0
Fri Mar 25 20:49:40 2022 us=210448 remote_cert_ku[i] = 0
Fri Mar 25 20:49:40 2022 us=210455 remote_cert_ku[i] = 0
Fri Mar 25 20:49:40 2022 us=210460 remote_cert_ku[i] = 0
Fri Mar 25 20:49:40 2022 us=210465 remote_cert_eku = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=210471 ssl_flags = 192
Fri Mar 25 20:49:40 2022 us=210478 tls_timeout = 2
Fri Mar 25 20:49:40 2022 us=210484 renegotiate_bytes = -1
Fri Mar 25 20:49:40 2022 us=210489 renegotiate_packets = 0
Fri Mar 25 20:49:40 2022 us=210493 renegotiate_seconds = 3600
Fri Mar 25 20:49:40 2022 us=210498 handshake_window = 60
Fri Mar 25 20:49:40 2022 us=210503 transition_window = 3600
Fri Mar 25 20:49:40 2022 us=210508 single_session = DISABLED
Fri Mar 25 20:49:40 2022 us=210513 push_peer_info = DISABLED
Fri Mar 25 20:49:40 2022 us=210518 tls_exit = DISABLED
Fri Mar 25 20:49:40 2022 us=210523 tls_auth_file = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=210528 tls_crypt_file = 'tls-crypt.key'
Fri Mar 25 20:49:40 2022 us=210533 pkcs11_protected_authentication = DISABLED
Fri Mar 25 20:49:40 2022 us=210538 pkcs11_protected_authentication = DISABLED
Fri Mar 25 20:49:40 2022 us=210543 pkcs11_protected_authentication = DISABLED
Fri Mar 25 20:49:40 2022 us=210548 pkcs11_protected_authentication = DISABLED
Fri Mar 25 20:49:40 2022 us=210553 pkcs11_protected_authentication = DISABLED
Fri Mar 25 20:49:40 2022 us=210558 pkcs11_protected_authentication = DISABLED
Fri Mar 25 20:49:40 2022 us=210562 pkcs11_protected_authentication = DISABLED
Fri Mar 25 20:49:40 2022 us=210567 pkcs11_protected_authentication = DISABLED
Fri Mar 25 20:49:40 2022 us=210572 pkcs11_protected_authentication = DISABLED
Fri Mar 25 20:49:40 2022 us=210577 pkcs11_protected_authentication = DISABLED
Fri Mar 25 20:49:40 2022 us=210582 pkcs11_protected_authentication = DISABLED
Fri Mar 25 20:49:40 2022 us=210587 pkcs11_protected_authentication = DISABLED
Fri Mar 25 20:49:40 2022 us=210592 pkcs11_protected_authentication = DISABLED
Fri Mar 25 20:49:40 2022 us=210597 pkcs11_protected_authentication = DISABLED
Fri Mar 25 20:49:40 2022 us=210601 pkcs11_protected_authentication = DISABLED
Fri Mar 25 20:49:40 2022 us=210606 pkcs11_protected_authentication = DISABLED
Fri Mar 25 20:49:40 2022 us=210614 pkcs11_private_mode = 00000000
Fri Mar 25 20:49:40 2022 us=210620 pkcs11_private_mode = 00000000
Fri Mar 25 20:49:40 2022 us=210625 pkcs11_private_mode = 00000000
Fri Mar 25 20:49:40 2022 us=210629 pkcs11_private_mode = 00000000
Fri Mar 25 20:49:40 2022 us=210634 pkcs11_private_mode = 00000000
Fri Mar 25 20:49:40 2022 us=210639 pkcs11_private_mode = 00000000
Fri Mar 25 20:49:40 2022 us=210644 pkcs11_private_mode = 00000000
Fri Mar 25 20:49:40 2022 us=210649 pkcs11_private_mode = 00000000
Fri Mar 25 20:49:40 2022 us=210654 pkcs11_private_mode = 00000000
Fri Mar 25 20:49:40 2022 us=210658 pkcs11_private_mode = 00000000
Fri Mar 25 20:49:40 2022 us=210663 pkcs11_private_mode = 00000000
Fri Mar 25 20:49:40 2022 us=210668 pkcs11_private_mode = 00000000
Fri Mar 25 20:49:40 2022 us=210673 pkcs11_private_mode = 00000000
Fri Mar 25 20:49:40 2022 us=210677 pkcs11_private_mode = 00000000
Fri Mar 25 20:49:40 2022 us=210682 pkcs11_private_mode = 00000000
Fri Mar 25 20:49:40 2022 us=210687 pkcs11_private_mode = 00000000
Fri Mar 25 20:49:40 2022 us=210692 pkcs11_cert_private = DISABLED
Fri Mar 25 20:49:40 2022 us=210697 pkcs11_cert_private = DISABLED
Fri Mar 25 20:49:40 2022 us=210702 pkcs11_cert_private = DISABLED
Fri Mar 25 20:49:40 2022 us=210707 pkcs11_cert_private = DISABLED
Fri Mar 25 20:49:40 2022 us=210711 pkcs11_cert_private = DISABLED
Fri Mar 25 20:49:40 2022 us=210716 pkcs11_cert_private = DISABLED
Fri Mar 25 20:49:40 2022 us=210721 pkcs11_cert_private = DISABLED
Fri Mar 25 20:49:40 2022 us=210726 pkcs11_cert_private = DISABLED
Fri Mar 25 20:49:40 2022 us=210731 pkcs11_cert_private = DISABLED
Fri Mar 25 20:49:40 2022 us=210736 pkcs11_cert_private = DISABLED
Fri Mar 25 20:49:40 2022 us=210741 pkcs11_cert_private = DISABLED
Fri Mar 25 20:49:40 2022 us=210745 pkcs11_cert_private = DISABLED
Fri Mar 25 20:49:40 2022 us=210750 pkcs11_cert_private = DISABLED
Fri Mar 25 20:49:40 2022 us=210755 pkcs11_cert_private = DISABLED
Fri Mar 25 20:49:40 2022 us=210760 pkcs11_cert_private = DISABLED
Fri Mar 25 20:49:40 2022 us=210765 pkcs11_cert_private = DISABLED
Fri Mar 25 20:49:40 2022 us=210770 pkcs11_pin_cache_period = -1
Fri Mar 25 20:49:40 2022 us=210775 pkcs11_id = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=210780 pkcs11_id_management = DISABLED
Fri Mar 25 20:49:40 2022 us=210785 server_network = 10.8.0.0
Fri Mar 25 20:49:40 2022 us=210791 server_netmask = 255.255.255.0
Fri Mar 25 20:49:40 2022 us=210796 server_network_ipv6 = ::
Fri Mar 25 20:49:40 2022 us=210801 server_netbits_ipv6 = 0
Fri Mar 25 20:49:40 2022 us=210807 server_bridge_ip = 0.0.0.0
Fri Mar 25 20:49:40 2022 us=210812 server_bridge_netmask = 0.0.0.0
Fri Mar 25 20:49:40 2022 us=210817 server_bridge_pool_start = 0.0.0.0
Fri Mar 25 20:49:40 2022 us=210822 server_bridge_pool_end = 0.0.0.0
Fri Mar 25 20:49:40 2022 us=210827 push_entry = 'dhcp-option DNS 208.67.222.222'
Fri Mar 25 20:49:40 2022 us=210832 push_entry = 'dhcp-option DNS 208.67.220.220'
Fri Mar 25 20:49:40 2022 us=210842 push_entry = 'redirect-gateway def1 bypass-dhcp'
Fri Mar 25 20:49:40 2022 us=210848 push_entry = 'route-gateway 10.8.0.1'
Fri Mar 25 20:49:40 2022 us=210853 push_entry = 'topology subnet'
Fri Mar 25 20:49:40 2022 us=210858 push_entry = 'ping 10'
Fri Mar 25 20:49:40 2022 us=210862 push_entry = 'ping-restart 120'
Fri Mar 25 20:49:40 2022 us=210867 ifconfig_pool_defined = ENABLED
Fri Mar 25 20:49:40 2022 us=210873 ifconfig_pool_start = 10.8.0.2
Fri Mar 25 20:49:40 2022 us=210878 ifconfig_pool_end = 10.8.0.253
Fri Mar 25 20:49:40 2022 us=210884 ifconfig_pool_netmask = 255.255.255.0
Fri Mar 25 20:49:40 2022 us=210889 ifconfig_pool_persist_filename = 'ipp.txt'
Fri Mar 25 20:49:40 2022 us=210894 ifconfig_pool_persist_refresh_freq = 600
Fri Mar 25 20:49:40 2022 us=210899 ifconfig_ipv6_pool_defined = DISABLED
Fri Mar 25 20:49:40 2022 us=210904 ifconfig_ipv6_pool_base = ::
Fri Mar 25 20:49:40 2022 us=210909 ifconfig_ipv6_pool_netbits = 0
Fri Mar 25 20:49:40 2022 us=210917 n_bcast_buf = 256
Fri Mar 25 20:49:40 2022 us=210922 tcp_queue_limit = 64
Fri Mar 25 20:49:40 2022 us=210927 real_hash_size = 256
Fri Mar 25 20:49:40 2022 us=210932 virtual_hash_size = 256
Fri Mar 25 20:49:40 2022 us=210937 client_connect_script = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=210942 learn_address_script = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=210947 client_disconnect_script = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=210952 client_config_dir = '/etc/openvpn/ccd'
Fri Mar 25 20:49:40 2022 us=210957 ccd_exclusive = DISABLED
Fri Mar 25 20:49:40 2022 us=210962 tmp_dir = '/tmp'
Fri Mar 25 20:49:40 2022 us=210967 push_ifconfig_defined = DISABLED
Fri Mar 25 20:49:40 2022 us=210972 push_ifconfig_local = 0.0.0.0
Fri Mar 25 20:49:40 2022 us=210977 push_ifconfig_remote_netmask = 0.0.0.0
Fri Mar 25 20:49:40 2022 us=210982 push_ifconfig_ipv6_defined = DISABLED
Fri Mar 25 20:49:40 2022 us=210988 push_ifconfig_ipv6_local = ::/0
Fri Mar 25 20:49:40 2022 us=210993 push_ifconfig_ipv6_remote = ::
Fri Mar 25 20:49:40 2022 us=210998 enable_c2c = DISABLED
Fri Mar 25 20:49:40 2022 us=211003 duplicate_cn = DISABLED
Fri Mar 25 20:49:40 2022 us=211008 cf_max = 0
Fri Mar 25 20:49:40 2022 us=211013 cf_per = 0
Fri Mar 25 20:49:40 2022 us=211018 max_clients = 1024
Fri Mar 25 20:49:40 2022 us=211023 max_routes_per_client = 256
Fri Mar 25 20:49:40 2022 us=211028 auth_user_pass_verify_script = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=211033 auth_user_pass_verify_script_via_file = DISABLED
Fri Mar 25 20:49:40 2022 us=211038 auth_token_generate = DISABLED
Fri Mar 25 20:49:40 2022 us=211043 auth_token_lifetime = 0
Fri Mar 25 20:49:40 2022 us=211048 port_share_host = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=211052 port_share_port = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=211061 client = DISABLED
Fri Mar 25 20:49:40 2022 us=211070 pull = DISABLED
Fri Mar 25 20:49:40 2022 us=211078 auth_user_pass_file = '[UNDEF]'
Fri Mar 25 20:49:40 2022 us=211088 OpenVPN 2.4.7 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 28 2021
Fri Mar 25 20:49:40 2022 us=211101 library versions: OpenSSL 1.1.1d 10 Sep 2019, LZO 2.10
Fri Mar 25 20:49:40 2022 us=323168 ECDH curve prime256v1 added
Fri Mar 25 20:49:40 2022 us=323310 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Fri Mar 25 20:49:40 2022 us=323338 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Mar 25 20:49:40 2022 us=323360 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Fri Mar 25 20:49:40 2022 us=323380 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Mar 25 20:49:40 2022 us=323399 TLS-Auth MTU parms [ L:1621 D:1156 EF:94 EB:0 ET:0 EL:3 ]
Fri Mar 25 20:49:40 2022 us=327278 TUN/TAP device tun0 opened
Fri Mar 25 20:49:40 2022 us=327372 Note: Cannot set tx queue length on tun0: Operation not permitted (errno=1)
Fri Mar 25 20:49:40 2022 us=327422 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Fri Mar 25 20:49:40 2022 us=327470 /sbin/ip link set dev tun0 up mtu 1500
Fri Mar 25 20:49:40 2022 us=349287 /sbin/ip addr add dev tun0 10.8.0.1/24 broadcast 10.8.0.255
Fri Mar 25 20:49:40 2022 us=377986 Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
Fri Mar 25 20:49:40 2022 us=378235 Could not determine IPv4/IPv6 protocol. Using AF_INET
Fri Mar 25 20:49:40 2022 us=378257 Socket Buffers: R=[212992->212992] S=[212992->212992]
Fri Mar 25 20:49:40 2022 us=378269 UDPv4 link local (bound): [AF_INET][undef]:2220
Fri Mar 25 20:49:40 2022 us=378275 UDPv4 link remote: [AF_UNSPEC]
Fri Mar 25 20:49:40 2022 us=378284 GID set to nogroup
Fri Mar 25 20:49:40 2022 us=378295 UID set to nobody
Fri Mar 25 20:49:40 2022 us=378308 MULTI: multi_init called, r=256 v=256
Fri Mar 25 20:49:40 2022 us=378333 IFCONFIG POOL: base=10.8.0.2 size=252, ipv6=0
Fri Mar 25 20:49:40 2022 us=378343 ifconfig_pool_read(), in='myUser-b,10.8.0.2', TODO: IPv6
Fri Mar 25 20:49:40 2022 us=378356 succeeded -> ifconfig_pool_set()
Fri Mar 25 20:49:40 2022 us=378364 IFCONFIG POOL LIST
Fri Mar 25 20:49:40 2022 us=378370 myUser-b,10.8.0.2
Fri Mar 25 20:49:40 2022 us=378413 Initialization Sequence Completed
Fri Mar 25 20:49:45 2022 us=340770 MULTI: multi_create_instance called
Fri Mar 25 20:49:45 2022 us=340886 X.X.X.X:49859 Re-using SSL/TLS context
Fri Mar 25 20:49:45 2022 us=341105 X.X.X.X:49859 Control Channel MTU parms [ L:1621 D:1156 EF:94 EB:0 ET:0 EL:3 ]
Fri Mar 25 20:49:45 2022 us=341128 X.X.X.X:49859 Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
Fri Mar 25 20:49:45 2022 us=341173 X.X.X.X:49859 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1549,tun-mtu 1500,proto UDPv4,cipher AES-128-GCM,auth [null-digest],keysize 128,key-method 2,tls-server'
Fri Mar 25 20:49:45 2022 us=341188 X.X.X.X:49859 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1549,tun-mtu 1500,proto UDPv4,cipher AES-128-GCM,auth [null-digest],keysize 128,key-method 2,tls-client'
Fri Mar 25 20:49:45 2022 us=341221 X.X.X.X:49859 TLS: Initial packet from [AF_INET]X.X.X.X:49859, sid=622a9183 525c3f6b
Fri Mar 25 20:49:45 2022 us=673869 X.X.X.X:49859 VERIFY OK: depth=1, CN=cn_HN7YPrEcEBvaiUdl
Fri Mar 25 20:49:45 2022 us=674137 X.X.X.X:49859 VERIFY OK: depth=0, CN=myUser-b
Fri Mar 25 20:49:45 2022 us=674529 X.X.X.X:49859 peer info: IV_VER=2.5.1
Fri Mar 25 20:49:45 2022 us=674554 X.X.X.X:49859 peer info: IV_PLAT=linux
Fri Mar 25 20:49:45 2022 us=674568 X.X.X.X:49859 peer info: IV_PROTO=6
Fri Mar 25 20:49:45 2022 us=674581 X.X.X.X:49859 peer info: IV_NCP=2
Fri Mar 25 20:49:45 2022 us=674594 X.X.X.X:49859 peer info: IV_CIPHERS=AES-256-GCM:AES-128-GCM
Fri Mar 25 20:49:45 2022 us=674606 X.X.X.X:49859 peer info: IV_LZ4=1
Fri Mar 25 20:49:45 2022 us=674618 X.X.X.X:49859 peer info: IV_LZ4v2=1
Fri Mar 25 20:49:45 2022 us=674631 X.X.X.X:49859 peer info: IV_LZO=1
Fri Mar 25 20:49:45 2022 us=674643 X.X.X.X:49859 peer info: IV_COMP_STUB=1
Fri Mar 25 20:49:45 2022 us=674656 X.X.X.X:49859 peer info: IV_COMP_STUBv2=1
Fri Mar 25 20:49:45 2022 us=674668 X.X.X.X:49859 peer info: IV_TCPNL=1
Fri Mar 25 20:49:45 2022 us=762410 X.X.X.X:49859 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 256 bit EC, curve: prime256v1
Fri Mar 25 20:49:45 2022 us=762452 X.X.X.X:49859 [myUser-b] Peer Connection Initiated with [AF_INET]X.X.X.X:49859
Fri Mar 25 20:49:45 2022 us=762483 myUser-b/X.X.X.X:49859 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
Fri Mar 25 20:49:45 2022 us=762513 myUser-b/X.X.X.X:49859 MULTI: Learn: 10.8.0.2 -> myUser-b/X.X.X.X:49859
Fri Mar 25 20:49:45 2022 us=762522 myUser-b/X.X.X.X:49859 MULTI: primary virtual IP for myUser-b/X.X.X.X:49859: 10.8.0.2
Fri Mar 25 20:49:46 2022 us=802173 myUser-b/X.X.X.X:49859 PUSH: Received control message: 'PUSH_REQUEST'
Fri Mar 25 20:49:46 2022 us=802232 myUser-b/X.X.X.X:49859 SENT CONTROL [myUser-b]: 'PUSH_REPLY,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,redirect-gateway def1 bypass-dhcp,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-128-GCM' (status=1)
Fri Mar 25 20:49:46 2022 us=802256 myUser-b/X.X.X.X:49859 Data Channel MTU parms [ L:1549 D:1450 EF:49 EB:406 ET:0 EL:3 ]
Fri Mar 25 20:49:46 2022 us=802335 myUser-b/X.X.X.X:49859 Outgoing Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key
Fri Mar 25 20:49:46 2022 us=802349 myUser-b/X.X.X.X:49859 Incoming Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key
Networking / IP info :
~# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: venet0: <BROADCAST,POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default
link/void
inet 127.0.0.1/32 scope host venet0
valid_lft forever preferred_lft forever
inet Y.Y.Y.Y/32 brd Y.Y.Y.Y scope global venet0:0
valid_lft forever preferred_lft forever
inet6 2402:x:x:x:x::dc37/80 scope global
valid_lft forever preferred_lft forever
inet6 ::2/128 scope global
valid_lft forever preferred_lft forever
7: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 500
link/none
inet 10.8.0.1/24 brd 10.8.0.255 scope global tun0
valid_lft forever preferred_lft forever
inet6 fe80::505f:b97:1101:5f33/64 scope link stable-privacy
valid_lft forever preferred_lft forever
On server (iptables rules)
iptables -t nat -L -n -v
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE all -- * venet0 10.8.0.0/24 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
# Warning: iptables-legacy tables present, use iptables-legacy to see them
On server, ip route:
ip route
default dev venet0 scope link
10.8.0.0/24 dev tun0 proto kernel scope link src 10.8.0.1
Forward status:
sysctl -a | grep forwarding
net.ipv4.conf.all.forwarding = 1
net.ipv4.conf.all.mc_forwarding = 0
net.ipv4.conf.default.forwarding = 1
net.ipv4.conf.default.mc_forwarding = 0
net.ipv4.conf.lo.forwarding = 1
net.ipv4.conf.lo.mc_forwarding = 0
net.ipv4.conf.tun0.forwarding = 1
net.ipv4.conf.tun0.mc_forwarding = 0
net.ipv4.conf.venet0.forwarding = 1
net.ipv4.conf.venet0.mc_forwarding = 0
net.ipv6.conf.all.forwarding = 0
net.ipv6.conf.all.mc_forwarding = 0
net.ipv6.conf.default.forwarding = 0
net.ipv6.conf.default.mc_forwarding = 0
net.ipv6.conf.lo.forwarding = 0
net.ipv6.conf.lo.mc_forwarding = 0
net.ipv6.conf.tun0.forwarding = 0
net.ipv6.conf.tun0.mc_forwarding = 0
net.ipv6.conf.venet0.forwarding = 0
net.ipv6.conf.venet0.mc_forwarding = 0
Client SIDE
cat myClient.ovpn
client
proto udp
explicit-exit-notify
remote X.X.X.X 2220
dev tun
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
verify-x509-name server_JCJHDggypybdTuKJ name
auth SHA256
auth-nocache
cipher AES-128-GCM
tls-client
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
ignore-unknown-option block-outside-dns
setenv opt block-outside-dns # Prevent Windows 10 DNS leak
verb 3
<ca>
-----BEGIN CERTIFICATE-----
CERT REMOVED
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
CERT REMOVED
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
KEY REMOVED
-----END PRIVATE KEY-----
</key>
<tls-crypt>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
KEY REMOVED
-----END OpenVPN Static key V1-----
</tls-crypt>
Log file :
(can't figure out where is client's log file, hence attaching data which is shown when I connect)
sudo openvpn --client --config myVPN.ovpn
2022-03-25 20:49:44 Unrecognized option or missing or extra parameter(s) in myVPN.ovpn:19: block-outside-dns (2.5.1)
2022-03-25 20:49:44 OpenVPN 2.5.1 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on May 14 2021
2022-03-25 20:49:44 library versions: OpenSSL 1.1.1k 25 Mar 2021, LZO 2.10
2022-03-25 20:49:44 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2022-03-25 20:49:44 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2022-03-25 20:49:44 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2022-03-25 20:49:44 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2022-03-25 20:49:44 TCP/UDP: Preserving recently used remote address: [AF_INET]Y.Y.Y.Y:2220
2022-03-25 20:49:44 Socket Buffers: R=[212992->212992] S=[212992->212992]
2022-03-25 20:49:44 UDP link local: (not bound)
2022-03-25 20:49:44 UDP link remote: [AF_INET]Y.Y.Y.Y:2220
2022-03-25 20:49:44 TLS: Initial packet from [AF_INET]Y.Y.Y.Y:2220, sid=03ab298b 4bbd4b64
2022-03-25 20:49:44 VERIFY OK: depth=1, CN=cn_HN7YPrEcEBvaiUdl
2022-03-25 20:49:44 VERIFY KU OK
2022-03-25 20:49:44 Validating certificate extended key usage
2022-03-25 20:49:44 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2022-03-25 20:49:44 VERIFY EKU OK
2022-03-25 20:49:44 VERIFY X509NAME OK: CN=server_JCJHDggypybdTuKJ
2022-03-25 20:49:44 VERIFY OK: depth=0, CN=server_JCJHDggypybdTuKJ
2022-03-25 20:49:44 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 256 bit EC, curve: prime256v1
2022-03-25 20:49:44 [server_JCJHDggypybdTuKJ] Peer Connection Initiated with [AF_INET]Y.Y.Y.Y:2220
2022-03-25 20:49:45 SENT CONTROL [server_JCJHDggypybdTuKJ]: 'PUSH_REQUEST' (status=1)
2022-03-25 20:49:45 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,redirect-gateway def1 bypass-dhcp,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-128-GCM'
2022-03-25 20:49:45 OPTIONS IMPORT: timers and/or timeouts modified
2022-03-25 20:49:45 OPTIONS IMPORT: --ifconfig/up options modified
2022-03-25 20:49:45 OPTIONS IMPORT: route options modified
2022-03-25 20:49:45 OPTIONS IMPORT: route-related options modified
2022-03-25 20:49:45 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2022-03-25 20:49:45 OPTIONS IMPORT: peer-id set
2022-03-25 20:49:45 OPTIONS IMPORT: adjusting link_mtu to 1624
2022-03-25 20:49:45 OPTIONS IMPORT: data channel crypto options modified
2022-03-25 20:49:45 Outgoing Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key
2022-03-25 20:49:45 Incoming Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key
2022-03-25 20:49:45 net_route_v4_best_gw query: dst 0.0.0.0
2022-03-25 20:49:45 net_route_v4_best_gw result: via 192.168.224.1 dev eth0
2022-03-25 20:49:45 ROUTE_GATEWAY 192.168.224.1/255.255.240.0 IFACE=eth0 HWADDR=00:15:5d:e5:c7:9d
2022-03-25 20:49:45 TUN/TAP device tun0 opened
2022-03-25 20:49:45 net_iface_mtu_set: mtu 1500 for tun0
2022-03-25 20:49:45 net_iface_up: set tun0 up
2022-03-25 20:49:45 net_addr_v4_add: 10.8.0.2/24 dev tun0
2022-03-25 20:49:45 net_route_v4_add: Y.Y.Y.Y/32 via 192.168.224.1 dev [NULL] table 0 metric -1
2022-03-25 20:49:45 net_route_v4_add: 0.0.0.0/1 via 10.8.0.1 dev [NULL] table 0 metric -1
2022-03-25 20:49:45 net_route_v4_add: 128.0.0.0/1 via 10.8.0.1 dev [NULL] table 0 metric -1
2022-03-25 20:49:45 Initialization Sequence Completed
route after connecting to VPN:
[code]
$ route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 10.8.0.1 128.0.0.0 UG 0 0 0 tun0
default CLIENT-HOSTNAME 0.0.0.0 UG 0 0 0 eth0
10.8.0.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0
128.0.0.0 10.8.0.1 128.0.0.0 UG 0 0 0 tun0
SERVER-HOSTNAME CLIENT-HOSTNAME 255.255.255.255 UGH 0 0 0 eth0
192.168.224.0 0.0.0.0 255.255.240.0 U 0 0 0 eth0
Route before connecting to VPN:
$ route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default CLIENT-HOSTNAME 0.0.0.0 UG 0 0 0 eth0
192.168.224.0 0.0.0.0 255.255.240.0 U 0 0 0 eth0
[/code]
Ping from client (to vpn gateway) :
PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.
64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=80.8 ms
64 bytes from 10.8.0.1: icmp_seq=2 ttl=64 time=81.4 ms
64 bytes from 10.8.0.1: icmp_seq=3 ttl=64 time=82.7 ms
^C
--- 10.8.0.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 80.771/81.601/82.658/0.786 ms
Hence, VPN lan is working but internet is not working on client after connecting to VPN. Let me know if anything else is needed.
