0

I have OpenVPN up and running on my server. I want all traffic from my clients to be routed trough the VPN server.

The client connects just fine but is unable to connect to the internet.

Server config:

port 443 proto udp dev tun ca /etc/openvpn/certs/ca.crt cert /etc/openvpn/certs/brimstone.crt key /etc/openvpn/certs/brimstone.key # This file should be kept secret dh /etc/openvpn/certs/dh4096.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push redirect-gateway def1 keepalive 10 120 tls-cipher DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-CAMELLIA256-SHA:DHE-RSA-AES256-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-RSA-AES128-SHA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA cipher AES-256-CBC auth SHA384 comp-lzo persist-key persist-tun status openvpn-status.log verb 3

iptables-save:

# Generated by iptables-save v1.4.14 on Fri Jul 24 07:44:57 2015 *raw :PREROUTING ACCEPT [69770:12550856] :OUTPUT ACCEPT [52469:5225827] COMMIT # Completed on Fri Jul 24 07:44:57 2015 # Generated by iptables-save v1.4.14 on Fri Jul 24 07:44:57 2015 *nat :PREROUTING ACCEPT [171:11702] :POSTROUTING ACCEPT [136:8184] :OUTPUT ACCEPT [0:0] -A POSTROUTING -s 10.8.0.0/24 -o venet0 -j MASQUERADE COMMIT # Completed on Fri Jul 24 07:44:57 2015 # Generated by iptables-save v1.4.14 on Fri Jul 24 07:44:57 2015 *mangle :PREROUTING ACCEPT [69770:12550856] :INPUT ACCEPT [69068:12508784] :FORWARD ACCEPT [684:41112] :OUTPUT ACCEPT [52469:5225827] :POSTROUTING ACCEPT [53153:5266939] COMMIT # Completed on Fri Jul 24 07:44:57 2015 # Generated by iptables-save v1.4.14 on Fri Jul 24 07:44:57 2015 *filter :INPUT DROP [25:2952] :FORWARD DROP [0:0] :OUTPUT ACCEPT [320:45993] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p icmp -m state --state NEW -j ACCEPT -A INPUT -p udp -m state --state NEW -m udp --dport 443 -j ACCEPT -A FORWARD -s 10.8.0.0/24 -j ACCEPT COMMIT # Completed on Fri Jul 24 07:44:57 2015

Did I miss something when configuring the forwarding/routing?

edit:

Turns out I made quite a stupid mistake.. I wrote down the iptables rules I need and then forgot one, when actually applying them.

I forgot to allow FORWARDING for established or related sessions..

Improve this question
5
  • can the vpn server connect to the internet? Commented Jul 24, 2015 at 9:45
  • yes, the server can access the internet. Commented Jul 24, 2015 at 9:51
  • I see you use venet0, so does that mean that this is a VM? have you allowed this traffic in the firewall in VM layer? Commented Jul 24, 2015 at 10:44
  • It's a VPS and tun/tap is allowed for the server. Commented Jul 24, 2015 at 11:50
  • Please don't use words like 'SOLVED" in question titles. This doesn't mark a question as solved. If the question truly is solved, please post an answer and then mark the answer. Commented Feb 6, 2018 at 21:59

1 Answer 1

Reset to default
0

several things I can think of,

1) make sure your server is a router, e.g it will forward packages from your clients to other networks.. .this is done like this:

echo 1 > /proc/sys/net/ipv4/ip_forward

or to make this more permanent:

pico /etc/sysctl.conf

uncomment or add something like this:

net.ipv4.ip_forward=1

also, does the client get ip address and dns setup? maybe push DHCP over vpn is a good idea

Improve this answer
7
  • I had /proc/sys/net/ipv4/ip_forward enabled, the tun0 adapter of the client gets the 10.8.0.6, I don't think DNS is tunneled, as I can successfully dig addresses, but can't access anything else. Commented Jul 24, 2015 at 10:12
  • do you run the openvpn client with proper rights? (in windows, administrator), so that routing will work? Commented Jul 24, 2015 at 10:16
  • I run it as root.. Commented Jul 24, 2015 at 10:18
  • can you ssh from client to openvpn server? can you confirm that the traffic is routed via vpn on client? Commented Jul 24, 2015 at 10:20
  • I can access the server via SSH. How may I confirm that? Commented Jul 24, 2015 at 10:30

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.