Multiple instance OpenVPN via OpenVZ -- Centos 5.5

kennz

Hi,

Good day.

I would like to seek your assistance pertaining to the current situation I am involved in.
I am new at openvpn and is hoping that you can help me shed light in my issue.

I have setup two openvpn instances on 1 linux box. Right now my issue is that I am unable to gain internet connection on the second instance but the 1st instance works perfectly.

Basically I have two WAN IP address in one VPS box:

( I'll mask them )
222.222.222.1 - current working VPN connection
222.222.222.2 - VPN is established but no internet connection.

I would like to seek help on how to get the 2nd instance work with the internet connection.

Below are my config files and iptables -L -v results.

____________________________________________________________________

Server Conf1

local 222.222.222.1 --- WAN IP ( this is not the true IP address )
port 9300
proto udp
dev tun
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh1024.pem
ifconfig-pool-persist ipp.txt
plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so /etc/pam.d/login
client-cert-not-required
username-as-common-name
auth-nocache
server 10.9.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 95.156.194.2"
push "dhcp-option DNS 8.8.8.8"
keepalive 5 30
comp-lzo
persist-key
persist-tun
status server-tcp.log
verb 3

Client Conf1

client
dev tun
proto udp
remote 222.222.222.1 9200
lport 53
resolv-retry infinite
bind
ca vpn/ca.crt
route-method exe
route-delay 2
persist-key
persist-tun
comp-lzo
verb 3
reneg-sec 0
auth-user-pass vpn/acct.txt

____________________________________________________________________

Server conf2 - instance two
local 222.222.222.2 --- WAN IP ( this is not the true IP address )
port 9300
proto udp
dev tun
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh1024.pem
ifconfig-pool-persist ipp.txt
plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so /etc/pam.d/login
client-cert-not-required
username-as-common-name
auth-nocache
server 10.10.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 95.156.194.2"
push "dhcp-option DNS 8.8.8.8"
keepalive 5 30
comp-lzo
persist-key
persist-tun
status server-tcp.log
verb 3

Client conf2.

client
dev tun
proto udp
remote 222.222.222.1 9200
lport 53
resolv-retry infinite
bind
ca vpn/ca.crt
route-method exe
route-delay 2
persist-key
persist-tun
comp-lzo
verb 3
reneg-sec 0
auth-user-pass vpn/acct.txt

____________________________________________________________________

Chain INPUT (policy ACCEPT 16936 packets, 1462K bytes)
pkts bytes target prot opt in out source destination
4 176 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
277K 115M ACCEPT udp -- any any anywhere anywhere udp dpt:wap-wsp
0 0 ACCEPT all -- lo any anywhere anywhere
14330 18M ACCEPT tcp -- any any anywhere anywhere tcp flags:ACK/ACK
46 5802 ACCEPT udp -- any any anywhere anywhere udp spt:domain dpts:1024:65535
0 0 ACCEPT icmp -- any any anywhere anywhere icmp echo-reply
57 6159 ACCEPT icmp -- any any anywhere anywhere icmp destination-unreachable
0 0 ACCEPT icmp -- any any anywhere anywhere icmp source-quench
0 0 ACCEPT icmp -- any any anywhere anywhere icmp time-exceeded
0 0 ACCEPT icmp -- any any anywhere anywhere icmp parameter-problem
0 0 ACCEPT icmp -- any any anywhere anywhere icmp echo-request
0 0 ACCEPT udp -- any any anywhere anywhere udp dpts:traceroute:33523
0 0 ACCEPT all -- lo any anywhere anywhere
0 0 ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:wap-wsp
21 882 ACCEPT udp -- any any anywhere anywhere udp dpt:https
0 0 ACCEPT tcp -- any any anywhere anywhere tcp flags:ACK/ACK
0 0 ACCEPT udp -- any any anywhere anywhere udp spt:domain dpts:wap-wsp:65535
0 0 ACCEPT icmp -- any any anywhere anywhere icmp echo-reply
0 0 ACCEPT icmp -- any any anywhere anywhere icmp destination-unreachable
0 0 ACCEPT icmp -- any any anywhere anywhere icmp source-quench
0 0 ACCEPT icmp -- any any anywhere anywhere icmp time-exceeded
0 0 ACCEPT icmp -- any any anywhere anywhere icmp parameter-problem
0 0 ACCEPT icmp -- any any anywhere anywhere icmp echo-request
0 0 ACCEPT udp -- any any anywhere anywhere udp dpts:traceroute:33523

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
470K 259M ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
56878 4153K ACCEPT all -- any any 10.9.0.0/24 anywhere
44 2730 REJECT all -- any any anywhere anywhere reject-with icmp-port-unreachable
0 0 ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
0 0 ACCEPT all -- any any 10.10.0.0/24 anywhere

Chain OUTPUT (policy ACCEPT 245K packets, 166M bytes)
pkts bytes target prot opt in out source destination

Your assistance is highly appreciated.

Thank you.
Your

kennz

Btw.

The clients are mostly mobile devices.

Ping to google DNS does replies destination host unreachable.
Ping to the server 222.222.222.2 does not reply.
Ping to the main ip vent0 - 222.222.222.1

There is handshake as I can see that the connection is established.

Server logs have the following information
Aug 9 21:35:06 server1 openvpn[3339]: kennz/x.x.x.x:696 MULTI: bad source address from client [115.115.113.103], packet dropped

Please help. Thank you

Mimiko

Hello.

In forwarding table

ACCEPT all -- any any 10.10.0.0/24 anywhere

appears after Regecting all packets, so nothing from second VPN is forwarding. Change the order. Regect must be the last.

Also you must route all clients from 10.10.0.0/24 to WAN2:

route add -net 10.10.0.0 netmask 255.255.255.0 gw 222.222.222.2 dev [ethWAN2]

kennz

I have added the said statement.
Route add -net 10.10.0.0 netmask 255.255.255.0 gw 222.222.222.2 dev [ethWAN2]

On the server conf 2. Still can't access the net.

Should I flush the iptables and start again?

Hmm. Or should I add the lines on each on the client conf. Btw vnet0 is set to 222.222.222.1 if that helps.

Thanks.

Mimiko

Yes you have to flush iptables. Also you have to masquarade traffic.
Show routing table from server.

kennz

Woot. Flushed iptables and did the test.

Its works now. Will remove the add route on the server to check if it still works.

I was suspecting that it was the iptables.

Btw, I removed the reject.

kennz

I removed the manual route and now it works.

Now I have to learn how to secure this server a little bit at a time.

Thanks much for the support.

Praises, hugs and what not. You made my day!!!