Help with setting a VPN in VPS

rainyel

I recently bought a VPS and want to setup openvpn in it. After reading HOW To on openvpn, and trying to do my best to understand iptable, I still can't seem to get it right! :cry:

I can connect client1 to my vpn server but I cannot connect to the internet (unless I disable "redirect-gateway def1")

Server

local 69.172.205.41
port 1194
proto udp
dev tun
key /etc/openvpn/keys/server.key
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
dh /etc/openvpn/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
#client-config-dir ccd
#route 192.168.0.102 255.255.255.0
#route 10.9.0.0 255.255.255.0
push "route 192.0.2.0 255.255.255.255"
#push "redirect-gateway def1"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 8.8.8.8"
keepalive 10 120
cipher AES-128-CBC
#comp-lzo
max-clients 1
user nobody
#group nobody
persist-key
persist-tun
status openvpn-status.log
verb 3

Client1

client
dev tun
proto udp
remote 69.172.205.41 1194
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ca ca.crt
cert client1.crt
key client1.key
cipher AES-128-CBC
#comp-lzo
verb 3

route -n

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.0.2.1       0.0.0.0         255.255.255.255 UH    0      0        0 venet0
10.8.0.2        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
0.0.0.0         192.0.2.1       0.0.0.0         UG    0      0        0 venet0

iptables -L -t nat


Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  10.8.0.0/24          anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Could someone enlighten me what I did wrong?

Mimiko

Hello.

I can connect client1 to my vpn server but I cannot connect to the internet (unless I disable "redirect-gateway def1")

Do you want to redirect all internet access of your client thru the OpenVPN tunnel?

push "route 192.0.2.0 255.255.255.255"

Why do you push this strange ip to client for routing thru tunnel?

venet0

What this ethernet is used for?

OpenFPN FAQ has examples of which routes you need to add to linux box.

rainyel

Yes I want to redirect all internet access of my client thru the tunnel and they will each get a static ip address.

As for the push "route 192.0.2.0 255.255.255.255", I am trying all the ip that is listed on Route -n. Stupid I know :oops: but I don't know why it doesn't connect and I figure it must have something to do with the ip routing.

venet0 - I am not sure. I don't even know where 192.0.2.0 is for. It was there when I do route -n

I will read the faq again.

Mimiko

0.0.0.0 192.0.2.1 0.0.0.0 UG 0 0 0 venet0

Is the default gateway of your VLAN router of the client to access internet.

From server's config remove

push "route 192.0.2.0 255.255.255.255"

You don't need to redirect wlan local access of the client to the tunnel.

And add

push "redirect-gateway def1"

to redirect internet access thru the tunnel. This will add two routes to your client routing table to access internet.

Also you will have to configure server's routing table and firewall settings to allow traffic from tun device to 69.172.205.41. Enable ip_forwarding:

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

http://www.openvpn.net/index.php/open-source/documentation/howto.html#redirect

rainyel

I read the link http://www.openvpn.net/index.php/open-source/documentation/howto.html#redirect but I still have problem understanding how to configure my route table and firewall. Never use Linux in my life and I think I am getting more lost at this point. So many guides on the net but they all ask to go to different sh file...

Mimiko

Well, why installing OpenVPN on linux if you dont know how to configure iprouting? :shock:

You can go to the internet on reading about using iproute. Or read other topics on this forum for same problems where there are already examples on how to configure firewall.

rainyel

TT__TT it's not the Linux that's killing me, I have no problem learning a new system (Google is great!). It's the understanding network and it's layers that's killing me! @_@ it's too confusing.

Thanks for your help. I will look into iprouting but I will most likely need your help down the road again. Sorry 🙁

Bebop

rainyel wroteCould someone enlighten me what I did wrong?

You did more steps than necessary. Also, you dont need 'route' or indepth knowledge of how to use it, just to simply setup a tunnel.. so dont worry.

All you need to know is right here:

Starter guides here (Centos) and here (Debian).

And here:

IPTABLES secure Internet tunnel

The 'route' commmand is not needed even once, in any of the guides.

If you need to, start over. If you can, just adapt your current setup to match these guides.

FYI:

your server.conf should look no more complex than this

port 1194
proto udp
dev tun0
server 10.10.1.0 255.255.255.0
topology subnet

push "redirect-gateway def1"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 8.8.8.8"

ca ./ca.crt
cert ./server.crt
key ./server.key 
dh ./dh1024.pem

status    ./openvpn-status.log
log         ./openvpn.log
verb 3

keepalive 10 120
comp-lzo