Been staring at this for hours, and I cannot figure out why my Windows 7 client cannot route all its traffic through the VPN after connected.
Server is CentOS running openvpn-2.1.4-1.el5. Client is Windows 7 64-bit, and I got the OpenVPN Windows client from
swupdate.openvpn.net/downloads/openvpn-client.msi
Set up the client and server configs using tun. Client does connect successfully, and when it does, it gets assigned IP 172.31.0.6 with its DHCP server of 172.31.0.5, and appears to have been given a network of 172.31.0.4/30. On the server, its tun0 interface listens on 172.31.0.1 with a P-t-P of 172.31.0.2. When I connect from the Windows client, I can ping 172.31.0.1 successfully, not 172.31.0.5, but I read in the openvpn.net docs that this is completely normal.
Then on the server I add the following Default Gateway command to push to the client:
push "redirect-gateway def1"
When the client reconnects, I do see 172.31.0.5 as the default route (from two /1 route entries using "route print -4" on the Windows 7 client), but I cannot get anywhere. No websites, no pings. Traceroute to any IP comes up successful only on the first hop of 172.31.0.1, but fails on hop 2 and after.
I can query the DNS resolver running on the server, if I tell my Windows 7 client to query 172.31.0.1 directly, with this command prompt command:
nslookup www.yahoo.com 172.31.0.1
That works. So the connection is alive, so I don't think it's a client issue.
So maybe this is a Masquerade issue on the server, but I can't see why. Only two requirements I see for a working MASQ are /proc/sys/net/ipv4/ip_forward set to 1, and a NAT rule set up on iptables. I tried two kinds of iptables entries to the *nat, neither helped:
-A POSTROUTING -s 172.31.0.0/24 ! -d 172.31.0.0/24 -j MASQUERADE
and
-A POSTROUTING -s 172.31.0.0/24 -o eth0 -j MASQUERADE
neither worked.
Also I added
iptables -I INPUT -i tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -j ACCEPT
That didn't help.
I'm stuck. I need my clients to route all their traffic through the server. My configs are below this line.
/etc/openvpn/openvpn.conf on the server:
port 1234
dev tun
tls-server
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh4096.pem
server 172.31.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 172.31.0.1 255.255.255.255"
push "dhcp-option DOMAIN mydomain.com"
keepalive 10 60
inactive 3600
route 172.31.0.0 255.255.255.0
user openvpn
group openvpn
persist-tun
persist-key
status /var/log/openvpn-status.log
verb 3
client-to-client
push "redirect-gateway def1"
client ovpn file:
port 1234
dev tun
remote mydomain.com
tls-client
ca ca.crt
cert jon.crt
key jon.key
pull
verb 4
Any advice would be appreciated. My initial thoughts are since I can query the DNS resolver by querying 172.31.0.1 directly after the OpenVPN connection is up, perhaps this is a MASQ issue somehow. But I've tried all the iptables commands I know of to get it to masquerade and still no luck. Thanks in advance.
