Help forcing all traffic over OpenVPN Server - tried HOWTO

thejestre

Hello,

First, thanks for providing support to this great free software.

Second, I already tried this:
http://www.openvpn.net/index.php/open-source/documentation/howto.html#redirect

I also tried this tutorial:
http://library.linode.com/networking/openvpn/ubuntu-10.04-lucid#sph_configuring-the-virtual-private-network

I have a dedicated server running Ubuntu 10.04. It is very new and I've been trying all kinds of things so far to no avail, so if I need to put a fresh reinstall of Ubuntu 10.04 on it, it is no great loss at this point. BUT if you can help me with what I have so far that would be great.

I have OpenVPN installed 'successfully' but I can't get it to do what I want. I don't know much about troubleshooting network issues in Linux.

What it does now:
I can successfully connect from my home client computer [XP SP3] to the OpenVPN dedicated server using the OpenVPN GUI for Windows. It connects and I can do normal services [ssh, ftp] with the dedicated. OpenVPN is set up to use 10.8.0.0/24 for private addressing. I cannot successfully ping 10.8.0.1 or 10.8.0.5 when connected to the VPN.

What I want:
I want to force all client traffic [web, etc] through the server.

Here are my config files.
Server:

port 1194
proto udp
dev tun

ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key  # This file should be kept secret
dh /etc/openvpn/keys/dh1024.pem


server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"

push "dhcp-option DNS 10.8.0.1"
keepalive 10 120

cipher AES-128-CBC   # AES
comp-lzo
user nobody
group nogroup

persist-key
persist-tun

status openvpn-status.log

log         openvpn.log

verb 3

Client:

client
dev tun

proto udp

remote A.B.C.D 1194
resolv-retry infinite

nobind
persist-key
persist-tun

ca Lease-ca.crt
cert thejestre.crt
key thejestre.key
cipher AES-128-CBC   # AES
comp-lzo

verb 3

I am really new to networking with Ubuntu. Please let me know any logs you want to see, etc. I've tried all kinds of iptables rules etc but no avail.

All help greatly appreciated.

Thank you,

_theJestre

janjust

the best way to troubleshoot this is to start with the VPN IPs and then work your way out.
First, comment out the lines

ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"

as they can interfere with initial troubleshooting.

Then, connect the client (post the client and server logs!) and try to ping the server VPN IP, which should be 10.8.0.1 . If that works, then try to ping the server's LAN IP.

thejestre

Hi and thanks for the quick response.

I commented the 2 lines out in server.conf and restarted it with /etc/init.d/openvpn restart

Connected to the VPN with the OpenVPN GUI on XP SP3.

Tried to ping 10.8.0.1 from the client, no dice.
Same with trying to ping the server's LAN ip.

Able to SSH to the server over the VPN, but that route might have been remembered from before I started the VPN, or I could have no idea what I'm talking about...

I ran ipconfig on my client and got this result for the tun device:

Ethernet adapter Local Area Connection 4:

        Connection-specific DNS Suffix  . :
        IP Address. . . . . . . . . . . . : 10.8.0.6
        Subnet Mask . . . . . . . . . . . : 255.255.255.252
        Default Gateway . . . . . . . . . :

Thought the no default gateway might help you all, it is just a mystery to me 🙂.
Client tun device is set to receive IP address and DNS server address automatically.

Client log:

Tue Oct 04 12:32:00 2011 OpenVPN 2.0.9 Win32-MinGW [SSL] [LZO] built on Oct  1 2006
Tue Oct 04 12:32:00 2011 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA.  OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Tue Oct 04 12:32:00 2011 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Tue Oct 04 12:32:00 2011 LZO compression initialized
Tue Oct 04 12:32:00 2011 Control Channel MTU parms [ L:1558 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Oct 04 12:32:00 2011 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Oct 04 12:32:00 2011 Local Options hash (VER=V4): '66096c33'
Tue Oct 04 12:32:00 2011 Expected Remote Options hash (VER=V4): '691e95c7'
Tue Oct 04 12:32:00 2011 UDPv4 link local: [undef]
Tue Oct 04 12:32:00 2011 UDPv4 link remote: A.B.C.D:1194
Tue Oct 04 12:32:00 2011 TLS: Initial packet from A.B.C.D:1194, sid=6644526e e5eab058
Tue Oct 04 12:32:01 2011 VERIFY OK: depth=1, /C=US/ST=California/L=LosGatos/O=None/OU=Gander/CN=server/name=Chris/emailAddress=no@way.com
Tue Oct 04 12:32:01 2011 VERIFY OK: depth=0, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/OU=section/CN=server/name=Karl/emailAddress=noway@out.com
Tue Oct 04 12:32:04 2011 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Tue Oct 04 12:32:04 2011 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Oct 04 12:32:04 2011 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Tue Oct 04 12:32:04 2011 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Oct 04 12:32:04 2011 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Oct 04 12:32:04 2011 [server] Peer Connection Initiated with A.B.C.D:1194
Tue Oct 04 12:32:05 2011 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Tue Oct 04 12:32:05 2011 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 10.8.0.1,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Tue Oct 04 12:32:05 2011 Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:3: topology (2.0.9)
Tue Oct 04 12:32:05 2011 OPTIONS IMPORT: timers and/or timeouts modified
Tue Oct 04 12:32:05 2011 OPTIONS IMPORT: --ifconfig/up options modified
Tue Oct 04 12:32:05 2011 OPTIONS IMPORT: route options modified
Tue Oct 04 12:32:05 2011 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Oct 04 12:32:05 2011 TAP-WIN32 device [Local Area Connection 4] opened: \\.\Global\{E60404BA-F1AB-4B38-B052-25704240B754}.tap
Tue Oct 04 12:32:05 2011 TAP-Win32 Driver Version 8.4 
Tue Oct 04 12:32:05 2011 TAP-Win32 MTU=1500
Tue Oct 04 12:32:05 2011 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {E60404BA-F1AB-4B38-B052-25704240B754} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Tue Oct 04 12:32:05 2011 Successful ARP Flush on interface [65543] {E60404BA-F1AB-4B38-B052-25704240B754}
Tue Oct 04 12:32:05 2011 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Tue Oct 04 12:32:05 2011 Route: Waiting for TUN/TAP interface to come up...
Tue Oct 04 12:32:06 2011 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Tue Oct 04 12:32:06 2011 Route: Waiting for TUN/TAP interface to come up...
Tue Oct 04 12:32:07 2011 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Tue Oct 04 12:32:07 2011 Route: Waiting for TUN/TAP interface to come up...
Tue Oct 04 12:32:08 2011 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Tue Oct 04 12:32:08 2011 Route: Waiting for TUN/TAP interface to come up...
Tue Oct 04 12:32:09 2011 TEST ROUTES: 1/1 succeeded len=1 ret=1 a=0 u/d=up
Tue Oct 04 12:32:09 2011 route ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Tue Oct 04 12:32:09 2011 Route addition via IPAPI succeeded
Tue Oct 04 12:32:09 2011 Initialization Sequence Completed
Tue Oct 04 12:39:52 2011 TCP/UDP: Closing socket
Tue Oct 04 12:39:52 2011 route DELETE 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Tue Oct 04 12:39:52 2011 Route deletion via IPAPI succeeded
Tue Oct 04 12:39:52 2011 Closing TUN/TAP interface
Tue Oct 04 12:39:52 2011 SIGTERM[hard,] received, process exiting

Server log:

Tue Oct  4 21:27:43 2011 OpenVPN 2.1.0 x86_64-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Jul 20 2010
Tue Oct  4 21:27:43 2011 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Tue Oct  4 21:27:43 2011 Diffie-Hellman initialized with 1024 bit key
Tue Oct  4 21:27:43 2011 /usr/bin/openssl-vulnkey -q -b 1024 -m <modulus omitted>
Tue Oct  4 21:27:43 2011 TLS-Auth MTU parms [ L:1558 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Oct  4 21:27:43 2011 ROUTE default_gateway=82.192.79.190
Tue Oct  4 21:27:43 2011 TUN/TAP device tun0 opened
Tue Oct  4 21:27:43 2011 TUN/TAP TX queue length set to 100
Tue Oct  4 21:27:43 2011 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Tue Oct  4 21:27:43 2011 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Tue Oct  4 21:27:43 2011 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Oct  4 21:27:43 2011 GID set to nogroup
Tue Oct  4 21:27:43 2011 UID set to nobody
Tue Oct  4 21:27:43 2011 Socket Buffers: R=[124928->131072] S=[124928->131072]
Tue Oct  4 21:27:43 2011 UDPv4 link local (bound): [undef]
Tue Oct  4 21:27:43 2011 UDPv4 link remote: [undef]
Tue Oct  4 21:27:43 2011 MULTI: multi_init called, r=256 v=256
Tue Oct  4 21:27:43 2011 IFCONFIG POOL: base=10.8.0.4 size=62
Tue Oct  4 21:27:43 2011 Initialization Sequence Completed
Tue Oct  4 21:31:57 2011 MULTI: multi_create_instance called
Tue Oct  4 21:31:57 2011 216.139.31.193:1518 Re-using SSL/TLS context
Tue Oct  4 21:31:57 2011 216.139.31.193:1518 LZO compression initialized
Tue Oct  4 21:31:57 2011 216.139.31.193:1518 Control Channel MTU parms [ L:1558 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Oct  4 21:31:57 2011 216.139.31.193:1518 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Oct  4 21:31:57 2011 216.139.31.193:1518 Local Options hash (VER=V4): '691e95c7'
Tue Oct  4 21:31:57 2011 216.139.31.193:1518 Expected Remote Options hash (VER=V4): '66096c33'
Tue Oct  4 21:31:57 2011 216.139.31.193:1518 TLS: Initial packet from [AF_INET]216.139.31.193:1518, sid=526b7047 480abdd3
Tue Oct  4 21:31:59 2011 216.139.31.193:1518 VERIFY OK: depth=1, /C=US/ST=California/L=LosGatos/O=None/OU=Gander/CN=server/name=Chris/emailAddress=no@way.com
Tue Oct  4 21:31:59 2011 216.139.31.193:1518 VERIFY OK: depth=0, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/OU=pod/CN=thejestre/name=Jack/emailAddress=not@way.com
Tue Oct  4 21:32:00 2011 216.139.31.193:1518 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Tue Oct  4 21:32:00 2011 216.139.31.193:1518 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Oct  4 21:32:00 2011 216.139.31.193:1518 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Tue Oct  4 21:32:00 2011 216.139.31.193:1518 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Oct  4 21:32:00 2011 216.139.31.193:1518 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Oct  4 21:32:00 2011 216.139.31.193:1518 [thejestre] Peer Connection Initiated with [AF_INET]216.139.31.193:1518
Tue Oct  4 21:32:00 2011 thejestre/216.139.31.193:1518 MULTI: Learn: 10.8.0.6 -> thejestre/216.139.31.193:1518
Tue Oct  4 21:32:00 2011 thejestre/216.139.31.193:1518 MULTI: primary virtual IP for thejestre/216.139.31.193:1518: 10.8.0.6
Tue Oct  4 21:32:02 2011 thejestre/216.139.31.193:1518 PUSH: Received control message: 'PUSH_REQUEST'
Tue Oct  4 21:32:02 2011 thejestre/216.139.31.193:1518 SENT CONTROL [thejestre]: 'PUSH_REPLY,dhcp-option DNS 10.8.0.1,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Tue Oct  4 21:43:39 2011 thejestre/216.139.31.193:1518 [thejestre] Inactivity timeout (--ping-restart), restarting
Tue Oct  4 21:43:39 2011 thejestre/216.139.31.193:1518 SIGUSR1[soft,ping-restart] received, client-instance restarting

janjust

I noticed you're using an older version of openvpn (2.0.9) on your win xp box; should be OK, but it is worthwhile to upgrade to 2.2.1.

the client log file looks OK, the missing default gateway is "normal" as you did not specify a new gateway nor 'push redirect-gateway def' on the server.

check the firewall/iptables on the vpn server to see if incoming pings are allowed on the tun interface. If you can , try running entirely without iptables for debugging.

thejestre

Hello and thanks for the support so far.

>> check the firewall/iptables on the vpn server to see if incoming pings are allowed on the tun interface.
No idea how to do this. I'm very new to Lunux/Ubuntu networking.

>> If you can , try running entirely without iptables for debugging.

I am not very familiar with Linux networking, but I tried to disable iptables by following this guide:
http://www.cyberciti.biz/faq/turn-on-turn-off-firewall-in-linux/
I did the following as root:

iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

Still no ping response to ping 10.8.0.1 on the client.

On the server, ping 10.8.0.1 and ping 10.8.0.6 get positive responses:

PING 10.8.0.6 (10.8.0.6) 56(84) bytes of data.
64 bytes from 10.8.0.6: icmp_seq=1 ttl=128 time=187 ms
64 bytes from 10.8.0.6: icmp_seq=2 ttl=128 time=192 ms

PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.
64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=0.095 ms
64 bytes from 10.8.0.1: icmp_seq=2 ttl=64 time=0.050 ms

EDIT:
I found another site that said in addition to the above iptables commands I had to run:

iptables -F

And after that the client got positive responses to ping 10.8.0.1.

ANOTHER EDIT:
After 'turning off' iptables I uncommented the push directive, restarted the OpenVPN, ran a iptables masquarade command and I think all traffic is going over the VPN.

So it must be the firewall then? I really appreciate your help so far, can you help me make persistent rule(s) to the iptables to fix my configuration for good?

Thanks for the help,

_theJestre