I configured the server and in the client I used the default vpn manager in ubuntu to connect to the server. The connection is established correctly, but the client is not able to go to the internet. Firefox doesn't open any Web page. Would you please help me for the server configuration so clients will be able to use Web Traffic as well? The server has a fix IP address. Below you have the content of the configuration file. [quote] local 173.98.88.213 port 1194 proto udp ;dev tap dev tun0 ca ca.crt cert server.crt key server.key # This file should be kept secret dh dh1024.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "redirect-gateway def1 bypass-dhcp" push "route 173.98.88.0 255.255.255.0" keepalive 10 120 comp-lzo user nobody group nogroup persist-key persist-tun status openvpn-status.log verb 3 [/quote] Regards

Dear Mimilko, Thank you for your reply. I appreciate it. I removed that line and as well as bypass option. I also added [code]push "dhcp-option DNS 8.8.8.8"[/code] but I've still the same problem. Best Regards

no internet on a VPN client connection established

jsmithvps

I configured the server and in the client I used the default vpn manager in ubuntu to connect to the server. The connection is established correctly, but the client is not able to go to the internet. Firefox doesn't open any Web page.

Would you please help me for the server configuration so clients will be able to use Web Traffic as well?

The server has a fix IP address. Below you have the content of the configuration file.

local 173.98.88.213
port 1194
proto udp
;dev tap
dev tun0
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "route 173.98.88.0 255.255.255.0"
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3

Regards

Mimiko

Remove

push "route 173.98.88.0 255.255.255.0"

from the config. You use redirect-gateway option that does that.
Also you don't need "bypass-dhcp" to redirect internet trafic thru tunnel.
Also you can add a new google dns:

push "dhcp-option DNS 8.8.8.8"

jsmithvps

Dear Mimilko, Thank you for your reply. I appreciate it.

I removed that line and as well as bypass option. I also added

push "dhcp-option DNS 8.8.8.8"

but I've still the same problem.

Best Regards

Mimiko

I would like to see the log of OpenVPN client, and the routing table of the client.
Try "tracert 8.8.8.8" from client and see where it goes.

jsmithvps

Here is the log on the client.

Sep 25 17:46:53 laptop NetworkManager[928]: <info> Starting VPN service 'openvpn'...
Sep 25 17:46:53 laptop NetworkManager[928]: <info> VPN service 'openvpn' started (org.freedesktop.NetworkManager.openvpn), PID 7175
Sep 25 17:46:53 laptop NetworkManager[928]: <info> VPN service 'openvpn' appeared; activating connections
Sep 25 17:46:53 laptop NetworkManager[928]: <info> VPN plugin state changed: 1
Sep 25 17:46:53 laptop nm-openvpn[7178]: OpenVPN 2.2.0 i686-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Jul 4 2011
Sep 25 17:46:53 laptop nm-openvpn[7178]: WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Sep 25 17:46:53 laptop nm-openvpn[7178]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sep 25 17:46:53 laptop NetworkManager[928]: <info> VPN plugin state changed: 3
Sep 25 17:46:53 laptop NetworkManager[928]: <info> VPN connection 'VPS_VPN' (Connect) reply received.
Sep 25 17:46:53 laptop nm-openvpn[7178]: UDPv4 link local: [undef]
Sep 25 17:46:53 laptop nm-openvpn[7178]: UDPv4 link remote: [AF_INET]173.245.73.213:1194
Sep 25 17:46:56 laptop nm-openvpn[7178]: WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1541', remote='link-mtu 1542'
Sep 25 17:46:56 laptop nm-openvpn[7178]: WARNING: 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo'
Sep 25 17:46:56 laptop nm-openvpn[7178]: [server] Peer Connection Initiated with [AF_INET]173.245.73.213:1194
Sep 25 17:46:59 laptop nm-openvpn[7178]: TUN/TAP device tun0 opened
Sep 25 17:46:59 laptop nm-openvpn[7178]: /usr/lib/NetworkManager/nm-openvpn-service-openvpn-helper tun0 1500 1541 10.8.0.6 10.8.0.5 init
Sep 25 17:46:59 laptop NetworkManager[928]: SCPlugin-Ifupdown: devices added (path: /sys/devices/virtual/net/tun0, iface: tun0)
Sep 25 17:46:59 laptop NetworkManager[928]: SCPlugin-Ifupdown: device added (path: /sys/devices/virtual/net/tun0, iface: tun0): no ifupdown configuration found.
Sep 25 17:46:59 laptop NetworkManager[928]: <info> VPN connection 'VPS_VPN' (IP Config Get) reply received.
Sep 25 17:46:59 laptop NetworkManager[928]: <info> VPN Gateway: 173.245.73.213
Sep 25 17:46:59 laptop NetworkManager[928]: <info> Internal Gateway: 10.8.0.5
Sep 25 17:46:59 laptop NetworkManager[928]: <info> Tunnel Device: tun0
Sep 25 17:46:59 laptop NetworkManager[928]: <info> Internal IP4 Address: 10.8.0.6
Sep 25 17:46:59 laptop NetworkManager[928]: <info> Internal IP4 Prefix: 32
Sep 25 17:46:59 laptop NetworkManager[928]: <info> Internal IP4 Point-to-Point Address: 10.8.0.5
Sep 25 17:46:59 laptop NetworkManager[928]: <info> Maximum Segment Size (MSS): 0
Sep 25 17:46:59 laptop NetworkManager[928]: <info> Static Route: 10.8.0.1/32 Next Hop: 10.8.0.1
Sep 25 17:46:59 laptop NetworkManager[928]: <info> Forbid Default Route: no
Sep 25 17:46:59 laptop NetworkManager[928]: <info> Internal IP4 DNS: 8.8.8.8
Sep 25 17:46:59 laptop NetworkManager[928]: <info> DNS Domain: '(none)'
Sep 25 17:46:59 laptop nm-openvpn[7178]: Initialization Sequence Completed
Sep 25 17:47:00 laptop NetworkManager[928]: <info> VPN connection 'VPS_VPN' (IP Config Get) complete.
Sep 25 17:47:00 laptop NetworkManager[928]: <info> Policy set 'VPS_VPN' (tun0) as default for IPv4 routing and DNS.
Sep 25 17:47:00 laptop NetworkManager[928]: <info> VPN plugin state changed: 4
Sep 25 17:47:00 laptop dbus[837]: [system] Activating service name='org.freedesktop.nm_dispatcher' (using servicehelper)
Sep 25 17:47:00 laptop dbus[837]: [system] Successfully activated service 'org.freedesktop.nm_dispatcher'
Sep 25 17:47:09 laptop nm-openvpn[7178]: write to TUN/TAP : Invalid argument (code=22)
Sep 25 17:47:34 nm-openvpn[7178]: last message repeated 2 times
Sep 25 17:47:34 laptop ntpdate[7225]: no server suitable for synchronization found
Sep 25 17:47:39 laptop nm-openvpn[7178]: write to TUN/TAP : Invalid argument (code=22)
Sep 25 17:48:11 nm-openvpn[7178]: last message repeated 3 times
Sep 25 17:48:11 laptop avahi-daemon[926]: Withdrawing workstation service for tun0.
Sep 25 17:48:11 laptop NetworkManager[928]: nm_system_iface_flush_routes: assertion `iface != NULL' failed
Sep 25 17:48:11 laptop NetworkManager[928]: sync_addresses: assertion `iface != NULL' failed
Sep 25 17:48:12 laptop NetworkManager[928]: <info> Policy set 'Auto hfy-35527' (wlan0) as default for IPv4 routing and DNS.
Sep 25 17:48:12 laptop NetworkManager[928]: SCPlugin-Ifupdown: devices removed (path: /sys/devices/virtual/net/tun0, iface: tun0)
Sep 25 17:48:12 laptop dbus[837]: [system] Activating service name='org.freedesktop.nm_dispatcher' (using servicehelper)
Sep 25 17:48:12 laptop dbus[837]: [system] Successfully activated service 'org.freedesktop.nm_dispatcher'
Sep 25 17:48:12 laptop nm-openvpn[7178]: SIGTERM[hard,] received, process exiting
Sep 25 17:48:17 laptop NetworkManager[928]: <info> VPN service 'openvpn' disappeared

And here is traceroute 8.8.8.8:

home@laptop:/var/log$ traceroute 8.8.8.8
traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets
1 * * *
2 * * *
3 * * *
4 * * *
5 * * *
6 * * *
7 * * *
8 * * *
9 * * *
10 * * *
11 * * *
12 * * *
13 * * *
14 * * *
15 * * *
16 * * *
17 * * *
18 * * *
19 * * *
20 * * *
21 * * *
22 * * *
23 * * *
24 * * *
25 * * *
26 * * *
27 * * *
28 * * *
29 * * *
30 * * *

Thanks

Mimiko

You didnt show routing table on client on OpenVPN is connected.

Did you configure the system where OpenVPN server is installed to forward packets from tunnel to internet?

jsmithvps

xx.xx.xx.com is actually the name server's domain. Below you have the routing table while connected to VPN.

Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 10.8.0.5 0.0.0.0 UG 0 0 0 tun0
10.8.0.1 10.8.0.5 255.255.255.255 UGH 0 0 0 tun0
10.8.0.5 * 255.255.255.255 UH 0 0 0 tun0
link-local * 255.255.0.0 U 1000 0 0 wlan0
xx.xx.xx.com 192.168.1.1 255.255.255.255 UGH 0 0 0 wlan0
192.168.1.0 * 255.255.255.0 U 0 0 0 wlan0

Except openvpn configuration file, I don't know how I should configure the server so that packets are forwarded from tunnel to the internet. How should I do that?

Mimiko

This is for you: http://www.openvpn.net/index.php/open-source/documentation/howto.html#redirect

jsmithvps

Hello Again, Sorry I was figuring out how to install iptables. Finally I install it manually.

Anyways, I copied the command from the link you provided (openvpn documentation) as follows:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

It didnt work so I tried this

Then this

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o tun0 -j MASQUERADE

And finally this:

iptables -t nat -A POSTROUTING -s 10.8.0.0/32 -o tun0 -j MASQUERADE

I'm still not able to reach the internet while connected. Sorry for my stupid question, I don't know well iptables.

Here is the result of ifconfig command:

eth0      Link encap:Ethernet  HWaddr aa:00:00:f5:49:d5  
          inet addr:173.245.73.213  Bcast:173.245.73.255  Mask:255.255.255.0
          inet6 addr: fe80::a800:ff:fef5:49d5/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:7931390 errors:0 dropped:0 overruns:0 frame:0
          TX packets:148490 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:1311239485 (1.3 GB)  TX bytes:38493630 (38.4 MB)
          Interrupt:11 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:987 errors:0 dropped:0 overruns:0 frame:0
          TX packets:987 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:79928 (79.9 KB)  TX bytes:79928 (79.9 KB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

Regards

Mimiko

Sep 25 17:46:56 laptop nm-openvpn[7178]: WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1541', remote='link-mtu 1542'
Sep 25 17:46:56 laptop nm-openvpn[7178]: WARNING: 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo'

Resolve this issue. "link-mtu" and "comp-lzo" must be same on server and client.

jsmithvps

I solved those issues you mentioned. By I don't know why it's not able to connect to VPN server. VPN connection fails. In the client I've

read UDPv4 [ECONNREFUSED]: Connection refused (code=111)

Oct  8 13:59:26 laptop NetworkManager[580]: <info> Starting VPN service 'openvpn'...
Oct  8 13:59:26 laptop NetworkManager[580]: <info> VPN service 'openvpn' started (org.freedesktop.NetworkManager.openvpn), PID 26282
Oct  8 13:59:26 laptop NetworkManager[580]: <info> VPN service 'openvpn' appeared; activating connections
Oct  8 13:59:26 laptop NetworkManager[580]: <info> VPN plugin state changed: 1
Oct  8 13:59:27 laptop NetworkManager[580]: <info> VPN plugin state changed: 3
Oct  8 13:59:27 laptop NetworkManager[580]: <info> VPN connection 'VPS_VPN' (Connect) reply received.
Oct  8 13:59:27 laptop nm-openvpn[26285]: OpenVPN 2.2.0 i686-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Jul  4 2011
Oct  8 13:59:27 laptop nm-openvpn[26285]: WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Oct  8 13:59:27 laptop nm-openvpn[26285]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Oct  8 13:59:27 laptop nm-openvpn[26285]: LZO compression initialized
Oct  8 13:59:27 laptop nm-openvpn[26285]: UDPv4 link local: [undef]

Oct 8 13:59:27 laptop nm-openvpn[26285]: UDPv4 link remote: [AF_INET]173.245.73.213:1194
Oct 8 13:59:27 laptop nm-openvpn[26285]: read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Oct 8 14:00:07 nm-openvpn[26285]: last message repeated 4 times
Oct 8 14:00:07 laptop NetworkManager[580]: <warn> VPN connection 'VPS_VPN' (IP Config Get) timeout exceeded.
Oct 8 14:00:07 laptop nm-openvpn[26285]: SIGTERM[hard,] received, process exiting
Oct 8 14:00:07 laptop NetworkManager[580]: <info> Policy set 'Auto hfy-35527' (wlan0) as default for IPv4 routing and DNS.
Oct 8 14:00:12 laptop NetworkManager[580]: <info> VPN service 'openvpn' disappeared

Mimiko

Oct 8 13:59:27 laptop nm-openvpn[26285]: WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.

Are you using "ca ca.crt" in your client config file? Post client and server config file.

jsmithvps

yes I'm using ca.crt.
Here the client configuration file:

client
remote cucacula.xen.prgmr.com
ca /home/home/.ssh/ca.crt
cert /home/home/.ssh/laptop.crt
key /home/home/.ssh/laptop.key
comp-lzo yes
dev tun
proto udp
nobind
auth-nocache
script-security 2
persist-key
persist-tun
user openvpn
group openvpn

Here the server configuration file:

# OpenVPN configuration.

local 173.245.73.213


port 1194
;proto tcp
proto udp

;dev tap
dev tun0

;dev-node MyTap
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret

dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
;server-bridge
;push "route 192.168.10.0 255.255.255.0"
;push "route 192.168.20.0 255.255.255.0"
;push 10.8.0.2

;client-config-dir ccd
;route 192.168.40.128 255.255.255.248
;client-config-dir ccd
;route 10.9.0.0 255.255.255.252
;learn-address ./script
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
;push "dhcp-option DNS 208.67.222.222"
;push "dhcp-option DNS 208.67.220.220"
;client-to-client
;duplicate-cn
keepalive 10 120
;tls-auth ta.key 0 # This file is secret
;cipher BF-CBC        # Blowfish (default)
;cipher AES-128-CBC   # AES
;cipher DES-EDE3-CBC  # Triple-DES
comp-lzo
;max-clients 100
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
;log         openvpn.log
;log-append  openvpn.log
verb 3
;mute 20

Mimiko

Add "ns-cert-type server" to client config.

jsmithvps

I did so. But I can't steel connect to the server. Connection fails:

Oct  8 16:19:14 laptop NetworkManager[580]: <info> Starting VPN service 'openvpn'...
Oct  8 16:19:14 laptop NetworkManager[580]: <info> VPN service 'openvpn' started (org.freedesktop.NetworkManager.openvpn), PID 27546
Oct  8 16:19:14 laptop NetworkManager[580]: <info> VPN service 'openvpn' appeared; activating connections
Oct  8 16:19:14 laptop NetworkManager[580]: <info> VPN plugin state changed: 3
Oct  8 16:19:14 laptop NetworkManager[580]: <info> VPN connection 'VPS_VPN' (Connect) reply received.
Oct  8 16:19:14 laptop nm-openvpn[27549]: OpenVPN 2.2.0 i686-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Jul  4 2011
Oct  8 16:19:14 laptop nm-openvpn[27549]: WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Oct  8 16:19:14 laptop nm-openvpn[27549]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Oct  8 16:19:14 laptop nm-openvpn[27549]: LZO compression initialized
Oct  8 16:19:14 laptop nm-openvpn[27549]: UDPv4 link local: [undef]
Oct  8 16:19:14 laptop nm-openvpn[27549]: UDPv4 link remote: [AF_INET]173.245.73.213:1194
Oct  8 16:19:14 laptop nm-openvpn[27549]: read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Oct  8 16:19:55  nm-openvpn[27549]: last message repeated 4 times
Oct  8 16:19:55 laptop NetworkManager[580]: <warn> VPN connection 'VPS_VPN' (IP Config Get) timeout exceeded.
Oct  8 16:19:55 laptop NetworkManager[580]: <info> Policy set 'Auto hfy-35527' (wlan0) as default for IPv4 routing and DNS.
Oct  8 16:19:55 laptop nm-openvpn[27549]: SIGTERM[hard,] received, process exiting
Oct  8 16:20:00 laptop NetworkManager[580]: <info> VPN service 'openvpn' disappeared

Mimiko

Verify firewall on server. May be you need to flash iptables.

jsmithvps

Now I'm sure that thr problem comes from the fact that VPN on the server fails starting.

ss@dd:~$ /etc/init.d/openvpn start
 * Starting virtual private network daemon(s)...                                 
*   Autostarting VPN 'server'                                           [fail]

jsmithvps

Ok as the logs show there some problem with loading the private keys. So I copied keys from /etc/openvpn/easy-rsa/keys to /etc/openvpn/ and that Solved the problem relating to openvpn Start.

From the client side, I'm now able to connect to the VPN server successfully. But I've still no Web Traffic available. Here is the iptable while connected to the VPN server:

x@home:~$ netstat -rn
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         10.8.0.9        0.0.0.0         UG        0 0          0 tun0
10.8.0.1        10.8.0.9        255.255.255.255 UGH       0 0          0 tun0
10.8.0.9        0.0.0.0         255.255.255.255 UH        0 0          0 tun0
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 wlan0
173.245.73.213  192.168.1.1     255.255.255.255 UGH       0 0          0 wlan0
192.168.1.0     0.0.0.0         255.255.255.0   U         0 0          0 wlan0

home@laptop:~$ tracepath 8.8.8.8
 1:  10.8.0.10                                             0.162ms pmtu 1500
 1:  no reply
 2:  no reply
 3:  no reply
 4:  no reply
 5:  no reply
 6:  no reply
 7:  no reply
 8:  no reply
 9:  no reply
10:  no reply
11:  no reply
12:  no reply
13:  no reply
14:  no reply
15:  no reply
16:  no reply
17:  no reply
18:  no reply
19:  no reply
20:  no reply
21:  no reply
22:  no reply
23:  no reply
24:  no reply
25:  no reply
26:  no reply
27:  no reply
28:  no reply
29:  no reply
30:  no reply
31:  no reply
     Too many hops: pmtu 1500
     Resume: pmtu 1500

On the server I've the following:

abc@server:~$ sudo iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  10.8.0.0/24          anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

For packet forwarding I used the following command:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o tun0 -j MASQUERADE

Is this right?

Mimiko

Regenerate keys and certificates from scratch.

jsmithvps

The connection to the VPN from client works well. There is steel no internet?