Routing all client traffic (inc web-traffic) through the VPN

dixon

Dear OpenVPN community,

I am using Windows Server 2008 to run OpenVPN Server. Clients are Windows 7 (x64). I want all their WAN traffic to go through my internet connection.
From http://openvpn.net/index.php/open-source/documentation/howto.html#redirect I gather these two lines should be enough:

push "redirect-gateway def1"
push "dhcp-option DNS x.x.x.x"

Here is my server config:

local 192.168.1.100
port 1194 
proto udp
mssfix 1400
dev tap
dev-node VPN-TAP
ca   "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\server.crt"
key  "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\server.key"
dh   "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\dh1024.pem"
server 192.168.10.0 255.255.255.128
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS x.x.x.x"
push "dhcp-option DNS x.x.x.x"
keepalive 10 120
cipher AES-128-CBC
comp-lzo
max-clients 50
persist-key
persist-tun
status openvpn-status.log
verb 1

x.x.x.x obviously replaced.

Extra information..

My router: NETGEAR WNDR3700
Router has the following static route:
dest: 192.168.10.0
sub mask: 255.255.255.252
gateway: 192.168.1.100
metric: 3

My cable modem: Cisco EPC3925 EuroDocsis 3.0
Modem has 5 static IP addresses.
Modem has IPSec Passthrough & PPTP Passthrough enabled. Not sure if it's needed for OpenVPN (will try disabling later).

Clients are assigned an IP and they can access my Server but when they visit http://www.whatismyipaddress.com/ they still see their own IP address.
Clients connect fine. No warnings/errors. What have I done wrong?

If more information is needed please tell me. Thank you.

maikcat

are you running openvpn on your clients with admin rights?
what openvpn version are you using on your clients?

can you verify that the static route on your netgear works?

Michael.

dixon

Hi Michael,

thank you for your reply. To answer your questions:

- The user running the client is an administrator/has administrative rights. To be sure I tried 'Run as administrator'. No difference.
- Server and Client are running version 2.2.2
- This might be it. I just de-activated the Static Route and there is no difference either. Is the route incorrect or is my router not functioning correctly?

dixon

When you perform a web-search on WNDR3700 and OpenVPN you will find several pages regarding issues with this router and OpenVPN. I have read several but most problems seem to differ from mine. I am actually able to connect to OpenVPN without any warnings or errors BUT web traffic is not going through the VPN.

What I find strange is that I see no difference with or without the static route. Why is OpenVPN not giving any errors/warnings?

I'm at a loss...

PS: In the meanwhile I have switched to OpenWRT which is a great firmware but it did not fix the problem.

dixon

I have now dedicated a computer to Kubuntu, solely for running OpenVPN server. I get exactly the same problem as with OpenVPN server on Windows Server 2008. I can connect to the VPN server but then I lose my internet connection.

So I guess the problem lies with my router. I hoped installing OpenWRT would fix the bug but I guess it does not. I am almost ready to buy a new router, perhaps one with VPN capabilities. I really hope it doesn't have to come to this.

Anyone else got any suggestions?

maikcat

try to masquerade traffic on your openvpn server originating from
the tunnel..

Michael.

dixon

Hey maikcat, thank you for replying once more.

I'm sorry to say I don't quite understand what you are saying. This due to my lack of knowledge on networking/NAT. How do I 'masquerade traffic on my openvpn server originating from the tunnel'?

In the meantime I have tried something I probably should have tried much earlier on: I have connected my server directly to my modem, giving it a static WAN IP. So no router in between. Guess what? Same problem.... This leads me too only one conclusion: I have no idea what the ɟnɔʞ I am doing.

If it's not my router it could be my modem or an OpenVPN misconfiguration (which seems highly unlikely after checking/re-configuring till my nails were bleeding).

maikcat

hi there,

bebop has wrote a very detailed howto about windows+nat (using RAS i think)
please search....

Michael.

cudiaco

Hi.

I'm not sure what your client looks like, but could you check to see if the "pull" directive is in there?

It doesn't sound like your problem is with the router if you can establish a connection, I believe it has to be a configuration issue on your client side.

dixon

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

maikcat

client directive includes pull as well

--client
A helper directive designed to simplify the configuration of OpenVPN's client mode. This directive is equivalent to:

pull
tls-client

Michael.

dixon

@maikcat: Yes, when you specify --client as a command line argument then pull is implied/included. But, when you simply add 'client' in your client config file (which is of course necessary) then pull is not included. That is what I ment (sorry if I was unclear, English is not my first language).

pull
I have re-installed Ubuntu and with that OpenVPN so it took me a while to get everything up and running again. I have added the pull directive and my client is now adding several routes (C:\WINDOWS\system32\route.exe). Still the same problem though. Client can't reach the outside world once it is connected to the VPN.

dns?
To be sure I try pinging a public IP directly. Nothing. So it's not DNS related. Though there could be problems with DNS too. At least I have a question about it. According to the HOWTO I can/should push the OpenVPN's IP (10.8.0.1) to the client as a DNS server. Is OpenVPN forwarding DNS requests? Can't I just push my ISP's or Google's public DNS servers (8.8.8.8 and 8.8.4.4) to my clients? Because if all traffic is routed through the VPN then the DNS requests should also be?

client log
Because I cannot test from another location at this moment I have disconnected a pc from my network and used my Android mobile to connect externally. Anyway, here is the log from my client:

Mon Feb 27 15:21:18 2012 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Mon Feb 27 15:21:18 2012 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Mon Feb 27 15:21:18 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Feb 27 15:21:18 2012 LZO compression initialized
Mon Feb 27 15:21:18 2012 Control Channel MTU parms [ L:1560 D:140 EF:40 EB:0 ET:0 EL:0 ]
Mon Feb 27 15:21:18 2012 Socket Buffers: R=[8192->8192] S=[8192->8192]
Mon Feb 27 15:21:18 2012 Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Feb 27 15:21:18 2012 Local Options hash (VER=V4): 'bc07730e'
Mon Feb 27 15:21:18 2012 Expected Remote Options hash (VER=V4): 'b695cb4a'
Mon Feb 27 15:21:18 2012 Attempting to establish TCP connection with A.B.C.D:PORT
Mon Feb 27 15:21:18 2012 TCP connection established with A.B.C.D:PORT
Mon Feb 27 15:21:18 2012 TCPv4_CLIENT link local: [undef]
Mon Feb 27 15:21:18 2012 TCPv4_CLIENT link remote: A.B.C.D:PORT
Mon Feb 27 15:21:18 2012 TLS: Initial packet from A.B.C.D:PORT, sid=e552dd94 50f9d77b
Mon Feb 27 15:21:20 2012 VERIFY OK: depth=1, /C=NL/ST=NH/L=Amsterdam/O=dixon/CN=server/emailAddress=my@email.address
Mon Feb 27 15:21:20 2012 VERIFY OK: depth=0, /C=NL/ST=NH/L=Amsterdam/O=dixon/CN=server/emailAddress=my@email.address
Mon Feb 27 15:21:22 2012 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Mon Feb 27 15:21:22 2012 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb 27 15:21:22 2012 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Mon Feb 27 15:21:22 2012 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb 27 15:21:22 2012 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Mon Feb 27 15:21:22 2012 [server] Peer Connection Initiated with A.B.C.D:PORT
Mon Feb 27 15:21:25 2012 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Mon Feb 27 15:21:25 2012 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 10.8.0.1,dhcp-option DNS 8.8.8.8,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Mon Feb 27 15:21:25 2012 OPTIONS IMPORT: timers and/or timeouts modified
Mon Feb 27 15:21:25 2012 OPTIONS IMPORT: --ifconfig/up options modified
Mon Feb 27 15:21:25 2012 OPTIONS IMPORT: route options modified
Mon Feb 27 15:21:25 2012 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Mon Feb 27 15:21:25 2012 ROUTE default_gateway=192.168.42.129
Mon Feb 27 15:21:25 2012 TAP-WIN32 device [TAP] opened: \\.\Global\{8A6532EF-8C3B-4F16-9AE9-B2E9462AEC5D}.tap
Mon Feb 27 15:21:25 2012 TAP-Win32 Driver Version 9.9
Mon Feb 27 15:21:25 2012 TAP-Win32 MTU=1500
Mon Feb 27 15:21:25 2012 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {8A6532EF-8C3B-4F16-9AE9-B2E9462AEC5D} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Mon Feb 27 15:21:25 2012 Successful ARP Flush on interface [17] {8A6532EF-8C3B-4F16-9AE9-B2E9462AEC5D}
Mon Feb 27 15:21:30 2012 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Mon Feb 27 15:21:30 2012 C:\WINDOWS\system32\route.exe ADD A.B.C.D MASK 255.255.255.255 192.168.42.129
Mon Feb 27 15:21:30 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=10 and dwForwardType=4
Mon Feb 27 15:21:30 2012 Route addition via IPAPI succeeded [adaptive]
Mon Feb 27 15:21:30 2012 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5
Mon Feb 27 15:21:30 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Mon Feb 27 15:21:30 2012 Route addition via IPAPI succeeded [adaptive]
Mon Feb 27 15:21:30 2012 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.5
Mon Feb 27 15:21:30 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Mon Feb 27 15:21:30 2012 Route addition via IPAPI succeeded [adaptive]
Mon Feb 27 15:21:30 2012 C:\WINDOWS\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.5
Mon Feb 27 15:21:30 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Mon Feb 27 15:21:30 2012 Route addition via IPAPI succeeded [adaptive]
Mon Feb 27 15:21:30 2012 Initialization Sequence Completed

Obviously I replaced my IP:PORT (in case anyone would like to try to connect to my awesome network).

routes
I do not understand the routes my client is creating. Where are these IP's coming from?
192.168.42.129 -> Default Gateway off Android phone for it is tethering.
10.8.0.5 -> What is this? The OpenVPN server is 10.8.0.1, the client is 10.8.0.6. What is 5?

Seems like the virtual ethernet adapter TAP is using 10.8.0.5 as DHCP server. Shouldn't that be 10.8.0.1?

Again thanks for taking the time 🙂

janjust

Seems like the virtual ethernet adapter TAP is using 10.8.0.5 as DHCP server. Shouldn't that be 10.8.0.1?

nope, the .5 address is correct in the default 'net30' mode ; this address is NOT pingable however. The routing statements look good:

C:\WINDOWS\system32\route.exe ADD A.B.C.D MASK 255.255.255.255 192.168.42.129

sets up a direct route to the VPN server via the usb phone

C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5

redirects one half of all traffic via the VPN tunnel

C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.5

redirects the other half

C:\WINDOWS\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.5

redirects the VPN network range via the VPN tunnel

so all traffic should go via the VPN tunnel. What is working and what isn't ? can you ping 8.8.8.8 ?

dixon

@janjust:
Hey, thank you for your reply. I cannot ping 8.8.8.8. So far I've only been able to ping 10.8.0.1 and localhost/10.8.0.6 of course.

I've checked out ipconfig /all and I see that Default Gateway is not set. I think that must be it. When you search this https://encrypted.google.com/search?sourceid=chrome&ie=UTF-8&q=openvpn+push+default+gateway you'll find quite a few forums with similar problems.

For example here http://talk.maemo.org/showthread.php?t=36069 mikkov suggests redirect-gateway does not work on a cellular connection. I have a hard time believing this though. I am using a cellular connection now but I have also had this problem before using another cable internet connection.

I just tried changing

push               redirect-gateway def1

push               redirect-gateway

When I connect now my client log shows this:

WARNING: potential route subnet conflict between local LAN [10.8.0.4/255.255.255.252] and remote VPN [10.8.0.0/255.255.255.0]

But when I check ipconfig /all the Default Gateway is now set too 10.8.0.5. I had an internet connection but it was still not through the OpenVPN (I check using http://www.whatismyipaddress.com).

dixon

I was at another location this morning so I could try my OpenVPN from another internet connection, besides my Android phone. Same problem.

What perhaps was helpful is the message I received when I tried to manually configure the virtual adapter (once connected with OpenVPN). I typed over the existing IP info and added the Default Gateway (the only thing not being set by the OpenVPN client). When I hit the [ok] button Windows was moaning something about not being on the same subnet. Maybe something is wrong here?

My current server config:

### Server settings
local myexternalip
dev tun
proto tcp
port myport
server 10.8.0.0 255.255.255.0

### Added NAT
### iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth1 -j MASQUERADE

### Connection settings
comp-lzo
keepalive 10 120
cipher AES-256-CBC
max-clients 10

push "redirect-gateway def1"

#push "dhcp-option DNS 10.8.0.1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

ifconfig-pool-persist ipp.txt

persist-key
persist-tun

### Keys
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem

### Access restriction
user nobody
group nogroup

### Logging
# log openvpn.log
log-append /var/log/openvpn_wan
status /etc/openvpn/openvpn-status_wan.log
verb 3

Mimiko

When I hit the [ok] button Windows was moaning something about not being on the same subnet.

This is a bug in Windows with some ISPs, where GW does not lie wihtin same mask as the IP the interface gets.

To be clear, where do you try the OpenVPN client: on Android or Windows station? Did you tried a tracert to 8.8.8.8 when client is connected to see how the packets are routed? Did you assured that tunnels network IPs are not the same as the local lan of the client thru witch it is connected to internet?

dixon

Hello Mimiko, thank you for helping.

Where do you try the OpenVPN client: on Android or Windows station?

Both Windows and Android and both have the same problem. Also when I am at home I sometimes use my Android's internet connection (from a Windows pc) to ensure an external connection.

Did you tried a tracert to 8.8.8.8 when client is connected to see how the packets are routed?

I will do this and post the results here.

Did you assured that tunnels network IPs are not the same as the local lan of the client thru witch it is connected to internet?

Yes, my local LAN is on 10.10.1.x. VPN is on 10.8.0.x and my clients are either 192.168.42.x (Android) or 192.168.150.x (somewhere else).

Actually, I now have two instances of OpenVPN running, both on a different NIC:
* eth0 is connected to my local LAN (10.10.1.x) using 10.8.0.x
* eth1 is connected to my modem (thus it has a direct internet connection) using 10.9.0.x
Same problem on both interfaces.. Is there no way it could be a problem with my modem?