[SOLVED]Client can connect but has no access to the Internet

jsmithvps

Hi
A client can connect to OpenVPN server hosted on Ubuntu server but connection to internet is not well routed. I wonder what am I missing.

Below is the configuration for the client:

client
remote ss.xen.prgmr.com
ca /home/adi/.ssh/ca.crt
cert /home/adi/.ssh/dev-vm.crt
key /home/adi/.ssh/dev-vm.key
comp-lzo yes
dev tun
proto udp
nobind
auth-nocache
script-security 2
persist-key
persist-tun
user openvpn
group openvpn

Server

local 1yy.xxx.xx.213
port 1194
proto udp
dev tun0
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3

IP routing tables:

Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
10.8.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
1yy.xxx.xx.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
0.0.0.0 1yy.xxx.xx.1 0.0.0.0 UG 0 0 0 eth0

IP Table:

Chain PREROUTING (policy ACCEPT)
target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 10.8.0.0/24 anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Thanks

maikcat

post netstat -nr output before and after vpn connection on your client.

Michael.

jsmithvps

Thank you for your reply.

Before

adi@dev-vm:~$ netstat -nr
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0

After:

adi@dev:~$ netstat -nr
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 10.8.0.17 0.0.0.0 UG 0 0 0 tun0
10.8.0.1 10.8.0.17 255.255.255.255 UGH 0 0 0 tun0
10.8.0.17 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0
173.245.73.213 192.168.1.1 255.255.255.255 UGH 0 0 0 eth0
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0

maikcat

i wanted to check if your client gets the default gw parameter..

can you post the output of traceroute 8.8.8.8

Michael.

jsmithvps

Here is the output of traceroute 8.8.8.8 while connected to VPN.

traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets
1 * * *
2 * * *
3 * * *
4 * * *
5 * * *
6 * * *
7 * * *
8 * * *
9 * * *
10 * * *
11 * * *
12 * * *
13 * * *
14 * * *
15 * * *
16 * * *
17 * * *
18 * * *
19 * * *
20 * * *
21 * * *
22 * * *
23 * * *
24 * * *
25 * * *
26 * * *
27 * * *
28 * * *
29 * * *
30 * * *

janjust

can't find any obvious flaws; post the server log (with 'verb 4' on the server) after the client connects. Also, post the output of

iptables -t nat -L -n -v
ip route show

jsmithvps

Thanks Janjust

Here is the log:

and finally ip route show:

10.8.0.2 dev tun0 proto kernel scope link src 10.8.0.1
10.8.0.0/24 via 10.8.0.2 dev tun0
173.245.73.0/24 dev eth0 proto kernel scope link src 173.245.73.213
default via 173.245.73.1 dev eth0 metric 100

janjust

the log file (/var/log/daemon ?) only shows the openvpn process shutting down, nothing else.
the kernel routing table shows that no traffic is being processed by the MASQUERADE rule (first 2 numbers are 0).

is ip forwarding enabled? can the client actually ping the tun0 IP address of the server? or the LAN IP address of the server?

jsmithvps

Ok, Here is the result of /var/log/daemon

Feb 1 22:16:19 cucacula ovpn-server[14793]: event_wait : Interrupted system call (code=4)
Feb 1 22:16:20 cucacula ovpn-server[14793]: TCP/UDP: Closing socket
Feb 1 22:16:20 cucacula ovpn-server[14793]: /sbin/route del -net 10.8.0.0 netmask 255.255.255.0
Feb 1 22:16:21 cucacula ovpn-server[14793]: ERROR: Linux route delete command failed: external program exited with error status: 7
Feb 1 22:16:21 cucacula ovpn-server[14793]: Closing TUN/TAP interface
Feb 1 22:16:21 cucacula ovpn-server[14793]: /sbin/ifconfig tun0 0.0.0.0
Feb 1 22:16:21 cucacula ovpn-server[14793]: Linux ip addr del failed: external program exited with error status: 255
Feb 1 22:16:21 cucacula ovpn-server[14793]: SIGTERM[hard,] received, process exiting

Yes I've enabled IP forwarding by this command:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

Also from the client I was able to ping successfully 10.8.0.1 & 10.8.0.18

janjust

Yes I've enabled IP forwarding by this command:
Quote:
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

that's not IP forwarding, that's masquerading; run

echo 1 > /proc/sys/net/ipv4/ip_forward

to see if that helps; if it does, make it permanent by editing the file /etc/sysctl.conf

jsmithvps

Thank you sir. It works like a Mercedes Benz

janjust

Excellent, closing topic