No internet access when VPN connected

philios33

Hi

I am having problems with setting up a VPN to my office. The setup I have is extremely simple and is defined below.

AT WORK

Internet --- (81.149.184.36) ROUTER (192.168.1.254) --- Files & VPN Server (192.168.1.100)

AT HOME

Internet --- ROUTER (192.168.0.1) --- Client (192.168.0.5)

Client Config

client
dev tun
proto udp
remote 81.149.184.36 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert pwclient.crt
key pwclient.key
comp-lzo
verb 3

Server Config

port 1194
proto udp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.1.0 255.255.255.0"
push "redirect-gateway def1"
#push "dhcp-option DNS 192.168.1.254"
#push "dhcp-option DNS 10.8.0.1"
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
log /var/log/openvpn.log
log-append /var/log/openvpn.log
verb 3
mode server
tls-server

What I want is simple:
1. To be virtually connected to my work lan via vpn from home (so people can work from home)
2. To route internet access and dns through my home router when necessary
3. To be able to connect to the file shares on the vpn server at work
4. To be able to connect to my work routers http admin configuration pages (not really vital but cant see why it doesnt work)

Problems

Connecting to VPN is fine and accessing my files is fine. As for #2 and #4, I cannot get these to work. If I try to connect to 192.168.1.100 it connects fine, but when I try 192.168.1.254 it doesnt work. Do I need to manually set this up as a route somehow?

As you can see I've been fidling around with the gateway and dns routing commands in the server config but have not been able to get a VPN connection up without losing my internet access at home. With some configs I have dns but no gateway, with others I have a gateway with no dns, and even if I manually set my gateway to point to my local home router ip, it still will not send and receive normal traffic that way. I have also tried NATing traffic through the VPN server to the work router which isnt an ideal solution and doesnt seem to work anyway.

I do get given a 10.* ip address when I connect, and I can ping my home router which suggests that internet traffic should be working.

Is there something I'm doing wrong here. I noticed that the pseudo network it uses has a subnet mask of 255.255.255.252 does that mean that only 1 client can connect to the vpn at a time? I will definately need multiple users connecting at the same time. Sorry for the VPN ignorance. I'm used to using the VPN on Microsoft Servers, but I think this works a little differently.

Thanks for all your help

maikcat

hi there,

try adding a static route for your vpn subnet (10.8.0.0/24) on your work router (192.168.1.254)

cheers,

michael.

philios33

Hi Michael

I am using a BT Business Broadband Router at work. When I try to add:

Subnet IP: 10.8.0.0
Subnet Mask: 255.255.255.0
Gateway IP: 192.168.1.254

It tells me Error, Invalid Configuration. Is the above what you meant? It could be a problem with the router tho. Perhaps its locked down so you cant add routes or something. Also, do I have to disable routing on my router and use bridge mode? If so, I need NAT and DHCP so its not really an option for me.

Thanks

Phil

philios33

Perhaps if I add this route to the server config? Seems a bit silly that openvpn doesnt already add this route tho. Would it just be

route 10.8.0.0 255.255.255.0 192.168.1.254

Thanks

Phil

maikcat

hi philios33,

>It tells me Error, Invalid Configuration. Is the above what you meant?

yeap..

>Also, do I have to disable routing on my router and use bridge mode?

no..doing so means that you need a router to establish your internet connection (and NAT).

there are 3 ways to avoid the static route thing on your router.

1) do NAT on your vpn server (that means that traffic comes from vpn will seems to coming from
the lan ip of vpn server itself)

2) setup a proxy server inside your lan and use it from your vpn clients...

3)replace the BT router with one that does static routes 🙂

cheers,

michael.

maikcat

>Perhaps if I add this route to the server config? Seems a bit silly that openvpn doesnt already add this route tho. Would it just be

>route 10.8.0.0 255.255.255.0 192.168.1.254

no ,dont add this...

the problem is that the router sees packets from your vpn net and probably it
forwards them to internet (because it doesnt know that they come from your vpn server)
thats why the static route is needed.

michael.

philios33

Ah ok. I have tried #1 in the past with no luck. Is this the right thing to do? Because this doesnt seem to work either.

phil@ubuntu:~$ cat /etc/network/interfaces 
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto eth0
#iface eth0 inet dhcp
iface eth0 inet static
address 192.168.1.100
netmask 255.255.255.0
gateway 192.168.1.254

phil@ubuntu:~$ sudo iptables-save
# Generated by iptables-save v1.3.3 on Mon Feb 28 12:58:53 2011
*nat
:PREROUTING ACCEPT [19112:4609087]
:POSTROUTING ACCEPT [17575:4532274]
:OUTPUT ACCEPT [1563:359748]
-A POSTROUTING -s 10.8.0.0/255.255.255.0 -o eth0 -j MASQUERADE 
-A POSTROUTING -s 10.8.0.0/255.255.255.0 -o eth0 -j MASQUERADE 
-A POSTROUTING -s 10.8.0.0/255.255.255.0 -o eth0 -j MASQUERADE 
COMMIT
# Completed on Mon Feb 28 12:58:53 2011
# Generated by iptables-save v1.3.3 on Mon Feb 28 12:58:53 2011
*filter
:INPUT ACCEPT [4873214:3438921517]
:FORWARD ACCEPT [111831:35934249]
:OUTPUT ACCEPT [3939015:863992395]
COMMIT
# Completed on Mon Feb 28 12:58:53 2011
phil@ubuntu:~$

For some reason it doesnt get listed as a rule when i do iptables -L tho

maikcat

please show output of

iptables -L -t nat

michael.

philios33

phil@ubuntu:~$ sudo iptables -L -t nat
Password:
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  10.8.0.0/24          anywhere            
MASQUERADE  all  --  10.8.0.0/24          anywhere            
MASQUERADE  all  --  10.8.0.0/24          anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
phil@ubuntu:~$

I think I did it 3 times by accident cos I didnt think it was saving

maikcat

nat is right...

did you enable ip forwarding?

cheers,

michael.

philios33

No. Sorry I'm a bit of a noob. Didnt know you had to do that. I will check it tonight when I get home and thanks for all your help.

Phil

phil@ubuntu:~$ cat /proc/sys/net/ipv4/ip_forward 
0
phil@ubuntu:~$ vim /etc/sysctl.conf
phil@ubuntu:~$ sudo vim /etc/sysctl.conf
phil@ubuntu:~$ 
phil@ubuntu:~$ sudo sysctl -p /etc/sysctl.conf 
net.ipv4.ip_forward = 1
phil@ubuntu:~$ 
phil@ubuntu:~$ cat /proc/sys/net/ipv4/ip_forward 
1
phil@ubuntu:~$

philios33

Finally its working. Thanks Michael. I also had to comment out the following line on the server side for it to work.

#push "redirect-gateway def1"

Tho, I'm still getting a 255.255.255.252 subnet and no gateway

C:\Users\Phil>ipconfig

Windows IP Configuration


Ethernet adapter Local Area Connection 2:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::5561:3d70:c38e:66ec%14
   IPv4 Address. . . . . . . . . . . : 10.8.0.10
   Subnet Mask . . . . . . . . . . . : 255.255.255.252
   Default Gateway . . . . . . . . . :

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::59e8:1bea:d99c:b471%11
   IPv4 Address. . . . . . . . . . . : 192.168.0.4
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.0.1

and still cannot access 192.168.1.254 (or for that matter, probably any client other than the vpn server). Its not a major problem for now. But I can see problems in the future if we were to say install a NAS file server on the LAN and we wanted to access it through the vpn. I thought thats what the client-to-client directive meant. Could anyone clear up these questions for me?

Thanks

Phil

philios33

Really confused now. My DNS is using 10.8.0.1 (the vpn server), but my other traffic is still going through my local router. I would expect to be told my office ip on whatsmyip but i'm not. This is actually what I wanted, but I cant see how the ipforwarding on the vpn server is actually doing anything if this is the case.

Anyway, it works for now....

maikcat

hi philios33,

>#push "redirect-gateway def1"

by disabling this , *ALL* your traffic goes over your local router

so if you want to access the internet via the vpn you need the above directive.

>and still cannot access 192.168.1.254

if you enabled NAT you will see 192.168.1.254,with NAT disabled you must setup
a static route on your router for the vpn network.

to check if NAT on vpn server works do the following:
try to connect to another server inside your lan (f.e via ssh)
your connection will seems to come from the vpn server itself.

to solve your probs needs step by step troubleshoot so:
to check ip forwarding is ok simply ping (from vpn client) both vpn interface and lan interface,they both should respond.
if you have NAT enabled (on server) try ping (from client) one pc inside your net.
this should also respond
if you have NAT disabled (on server) then the pcs inside your lan must have a static route
for the vpn subnet...

check the above and tell us which worked

cheers,

michael.

philios33

Hi Michael

I will leave the gateway stuff alone, as this is working as intended in my 1st post.

Have setup NAT on the VPN server but it doesnt look like its working.

When connected remotely, can only see myself and the VPN server on the 192.168.1 subnet. Ping to 192.168.1.254 does not work even tho it does work if I ping from inside the LAN. Could this be because PCs on my LAN are using 192.168.1.254 as a gateway anyway???

Not sure what IPs you want me to ping in your other suggestions.

Thanks

Phil

janjust

I'm just picking up on this thread so perhaps you've already tested most of this:

* check 'iptables -t nat -L -n -v' again, just to make sure; is the MASQUERADING rule still there?
* from the VPN client, try pinging the remote endpoint, i.e. 10.8.0.1
* from the VPN client, try pinging 192.168.1.100
* on the server, run

tcpdump -nnl -i eth0 icmp

* now, from the VPN client, try pinging 192.168.1.254

You should see all kinds of traffic fly by - this should give you a clue where things go wrong.

philios33

No I havent tried these. I'm no good with iptables or ipdump.

So heres what I get:

phil@ubuntu:~$ sudo iptables -t nat -L -n -v
Chain PREROUTING (policy ACCEPT 39221 packets, 9884K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 37482 packets, 9816K bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 MASQUERADE  all  --  *      eth0    10.8.0.0/24          0.0.0.0/0
    0     0 MASQUERADE  all  --  *      eth0    10.8.0.0/24          0.0.0.0/0
    0     0 MASQUERADE  all  --  *      eth0    10.8.0.0/24          0.0.0.0/0

Chain OUTPUT (policy ACCEPT 2900 packets, 659K bytes)
 pkts bytes target     prot opt in     out     source               destination
phil@ubuntu:~$

C:\Users\Phil>ping 10.8.0.1

Pinging 10.8.0.1 with 32 bytes of data:
Reply from 10.8.0.1: bytes=32 time=53ms TTL=64
Reply from 10.8.0.1: bytes=32 time=51ms TTL=64
Reply from 10.8.0.1: bytes=32 time=54ms TTL=64

Ping statistics for 10.8.0.1:
    Packets: Sent = 3, Received = 3, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 51ms, Maximum = 54ms, Average = 52ms
Control-C
^C
C:\Users\Phil>ping 192.168.1.100

Pinging 192.168.1.100 with 32 bytes of data:
Reply from 192.168.1.100: bytes=32 time=51ms TTL=64
Reply from 192.168.1.100: bytes=32 time=50ms TTL=64

Ping statistics for 192.168.1.100:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 50ms, Maximum = 51ms, Average = 50ms
Control-C
^C
C:\Users\Phil>

phil@ubuntu:~$ sudo tcpdump -nnl -i eth0 icmp
tcpdump: WARNING: eth0: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
22:25:05.485480 IP 10.8.0.10 > 192.168.1.254: ICMP echo request, id 1, seq 6, length 40
22:25:09.628457 IP 10.8.0.10 > 192.168.1.254: ICMP echo request, id 1, seq 7, length 40

from

C:\Users\Phil>ping 192.168.1.254

Pinging 192.168.1.254 with 32 bytes of data:
Control-C
^C
C:\Users\Phil>ping 192.168.1.254

Pinging 192.168.1.254 with 32 bytes of data:
Control-C
^C
C:\Users\Phil>

Thats no ping response on the VPN client but I get log lines for each ping which I guess means its routing fine. So I'm stumped.

Also, noone commented on my strange subnet that I'm given when I connect to VPN from a client. Its probably nothing but can someone confirm that my subnet is correct please. I would expect 255.255.255.0

Ethernet adapter Local Area Connection 2:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::5561:3d70:c38e:66ec%14
   IPv4 Address. . . . . . . . . . . : 10.8.0.10
   Subnet Mask . . . . . . . . . . . : 255.255.255.252
   Default Gateway . . . . . . . . . :

Thanks a lot

Phil

janjust

phil@ubuntu:~$ sudo tcpdump -nnl -i eth0 icmp
tcpdump: WARNING: eth0: no IPv4 address assigned

woah : this is weird : eth0 does not have an IP address assigned? Can you post the output of

/sbin/ifconfig -a

\
?

Also, noone commented on my strange subnet that I'm given when I connect to VPN from a client. Its probably nothing but can someone confirm that my subnet is correct please. I would expect 255.255.255.0

actually this is normal behavior for OpenVPN if the option 'topology subnet' is NOT used (which is the default). The default operating mode of OpenVPN is to assign miniature /30 networks to each VPN client. A /30 network has a netmask of 255.255.255.252 and can contain 4 IP addresses. The VPN server gets its own miniature /30 address 10.8.0.0 - 10.8.0-3 ; the first VPN client get 10.8.0.4 - 10.8.0.7 , the second gets 10.8.0.8 - 10.8.0.11 .
This miniature block consists of the following addresses:
* 10.8.0.8 - the /30 network address
* 10.8.0.9 - the virtual endpoint address of the Peer2Peer tun adapter; this address is used for routing but cannot be pinged
* 10.8.0.10 - the client VPN address
* 10.8.0.11 - the /30 broadcast address

philios33

I see. Thanks for the information.

Here is the output. Not sure what all the other interfaces are. I might have fiddled with something too much.

phil@ubuntu:/files$ /sbin/ifconfig -a
br0       Link encap:Ethernet  HWaddr 00:08:74:AE:44:7C  
          inet addr:192.168.1.100  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::208:74ff:feae:447c/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:15344281 errors:0 dropped:0 overruns:0 frame:0
          TX packets:12020320 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:1047951338 (999.4 MiB)  TX bytes:1010771522 (963.9 MiB)

eth0      Link encap:Ethernet  HWaddr 00:08:74:AE:44:7C  
          inet6 addr: fe80::208:74ff:feae:447c/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:15615539 errors:0 dropped:0 overruns:0 frame:0
          TX packets:12280145 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:1378264745 (1.2 GiB)  TX bytes:1123126410 (1.0 GiB)
          Base address:0xec80 Memory:ff8e0000-ff900000 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:2616 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2616 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:1424020 (1.3 MiB)  TX bytes:1424020 (1.3 MiB)

sit0      Link encap:IPv6-in-IPv4  
          NOARP  MTU:1480  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

tap0      Link encap:Ethernet  HWaddr 0E:AA:E2:C3:FC:0C  
          inet6 addr: fe80::caa:e2ff:fec3:fc0c/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:1815070 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:498 errors:0 dropped:0 overruns:0 frame:0
          TX packets:424 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:37380 (36.5 KiB)  TX bytes:67221 (65.6 KiB)

phil@ubuntu:/files$ cat /etc/network/interfaces 
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto eth0
#iface eth0 inet dhcp
iface eth0 inet static
address 192.168.1.100
netmask 255.255.255.0
gateway 192.168.1.254

phil@ubuntu:/files$

Thanks

Phil

maikcat

>phil@ubuntu:~$ sudo tcpdump -nnl -i eth0 icmp
tcpdump: WARNING: eth0: no IPv4 address assigned

because you have bridged eth0 to br0

try with br0 instead

can you also issue a

brctl show

michael