Arch Linux

dlh

Member

Registered: 2010-11-26

Posts: 44

OpenVPN doesn't accept routing

Hello again!

This is my server configuration of opevpn

port 1194
proto tcp
dev tun
ca privnet/ca.crt
cert privnet/server.crt
key privnet/server.key
dh privnet/dh1024.pem
tls-auth privnet/ta.key 0
cipher AES-256-CBC
server 10.8.0.0 255.255.255.0
push "dhcp-option DNS 192.168.1.0"
push "redirect-gateway def1"
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 3

client:

##############################################
# Sample client-side OpenVPN 2.0 config file #
# for connecting to multi-client server.     #
#                                            #
# This configuration can be used by multiple #
# clients, however each client should have   #
# its own cert and key files.                #
#                                            #
# On Windows, you might want to rename this  #
# file so it has a .ovpn extension           #
##############################################

# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client

# Use the same setting as you are using on
# the server.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
;dev tap
dev tun

# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel
# if you have more than one.  On XP SP2,
# you may need to disable the firewall
# for the TAP adapter.
;dev-node MyTap

# Are we connecting to a TCP or
# UDP server?  Use the same setting as
# on the server.
proto tcp
;proto udp

# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote ks389320.kimsufi.com 1194
;remote my-server-2 1194

# Choose a random host from the remote
# list for load-balancing.  Otherwise
# try hosts in the order specified.
;remote-random

# Keep trying indefinitely to resolve the
# host name of the OpenVPN server.  Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite

# Most clients don't need to bind to
# a specific local port number.
nobind

# Downgrade privileges after initialization (non-Windows only)
user nobody
group nobody

# Try to preserve some state across restarts.
persist-key
persist-tun

# If you are connecting through an
# HTTP proxy to reach the actual OpenVPN
# server, put the proxy server/IP and
# port number here.  See the man page
# if your proxy server requires
# authentication.
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]

# Wireless networks often produce a lot
# of duplicate packets.  Set this flag
# to silence duplicate packet warnings.
;mute-replay-warnings

# SSL/TLS parms.
# See the server config file for more
# description.  It's best to use
# a separate .crt/.key file pair
# for each client.  A single ca
# file can be used for all clients.
ca ca.crt
cert client.crt
key client.key

# Verify server certificate by checking
# that the certicate has the nsCertType
# field set to "server".  This is an
# important precaution to protect against
# a potential attack discussed here:
#  http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the nsCertType
# field set to "server".  The build-key-server
# script in the easy-rsa folder will do this.
ns-cert-type server

# If a tls-auth key is used on the server
# then every client must also have the key.
tls-auth ta.key 1

# Select a cryptographic cipher.
# If the cipher option is used on the server
# then you must also specify it here.
cipher AES-256-CBC

# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
comp-lzo

# Set log file verbosity.
verb 3

# Silence repeating messages
;mute 20

Everything goes smoothly, but I can't route the traffic through the server, the issue must be in this server configuration line:

push "dhcp-option DNS 192.168.1.0"
push "redirect-gateway def1"

Server and client can ping each other.

On client I added this line:

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o wlan0 -j MASQUERADE

Thanks fore help.

Last edited by dlh (2012-02-15 17:03:16)

Gcool

Member

Registered: 2011-08-16

Posts: 1,456

Re: OpenVPN doesn't accept routing

On client I added this line:

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o wlan0 -j MASQUERADE

Don't know if it's a typo on your end or not, but that should be set on the server, not the client.

---

Burninate!

dlh

Member

Registered: 2010-11-26

Posts: 44

Re: OpenVPN doesn't accept routing

OK, I added this on a server, but on a client I have an error:

Wed Feb 15 20:18:31 2012 ERROR: Linux route add command failed: external program exited with error status: 2

Where can I get this dns in line below:

push "dhcp-option DNS 192.168.1.0"
push "redirect-gateway def1"

Gcool

Member

Registered: 2011-08-16

Posts: 1,456

Re: OpenVPN doesn't accept routing

Could you post a small overview of what you're trying to accomplish exactly (which hosts and ip's are involved,...)?

Also please post the full output of the openvpn logging (client and server side) and the output of:

# iptables -L -v

---

Burninate!

dlh

Member

Registered: 2010-11-26

Posts: 44

Re: OpenVPN doesn't accept routing

Chain INPUT (policy ACCEPT 159M packets, 146G bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 1619 packets, 106K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 89M packets, 321G bytes)
 pkts bytes target     prot opt in     out     source               destination 

But in the other chain:

-A POSTROUTING -s 10.8.0.0/24 -o wlan0 -j MASQUERADE

I want to push traffic through the server.

client:

Thu Feb 16 19:41:52 2012 OpenVPN 2.2.2 x86_64-unknown-linux-gnu [SSL] [LZO2] [EPOLL] [eurephia] built on Jan  3 2012
Thu Feb 16 19:41:52 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu Feb 16 19:41:52 2012 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Thu Feb 16 19:41:52 2012 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 16 19:41:52 2012 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 16 19:41:52 2012 LZO compression initialized
Thu Feb 16 19:41:52 2012 Control Channel MTU parms [ L:1560 D:168 EF:68 EB:0 ET:0 EL:0 ]
Thu Feb 16 19:41:52 2012 Socket Buffers: R=[87380->131072] S=[16384->131072]
Thu Feb 16 19:41:52 2012 Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Feb 16 19:41:52 2012 Local Options hash (VER=V4): '2f2c6498'
Thu Feb 16 19:41:52 2012 Expected Remote Options hash (VER=V4): '9915e4a2'
Thu Feb 16 19:41:52 2012 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Thu Feb 16 19:41:52 2012 Attempting to establish TCP connection with [cut] [nonblock]
Thu Feb 16 19:41:53 2012 TCP connection established with [cut]
Thu Feb 16 19:41:53 2012 TCPv4_CLIENT link local: [undef]
Thu Feb 16 19:41:53 2012 TCPv4_CLIENT link remote: [cut]
Thu Feb 16 19:41:53 2012 TLS: Initial packet from [cut], sid=d559ac49 21d96681
Thu Feb 16 19:41:55 2012 VERIFY OK: depth=1, /C=PL/ST=CA/L=[cut]/O=[cut]/CN=[cut]/emailAddress=[cut]
Thu Feb 16 19:41:55 2012 VERIFY OK: nsCertType=SERVER
Thu Feb 16 19:41:55 2012 VERIFY OK: depth=0, /C=PL/ST=CA/L=[cut]/O=[cut]/CN=server/emailAddress=[cut]
Thu Feb 16 19:41:58 2012 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Feb 16 19:41:58 2012 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 16 19:41:58 2012 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Feb 16 19:41:58 2012 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 16 19:41:58 2012 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu Feb 16 19:41:58 2012 [server] Peer Connection Initiated with 176.31.101.111:1194
Thu Feb 16 19:42:00 2012 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Feb 16 19:42:00 2012 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 192.168.1.0,redirect-gateway def1,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Thu Feb 16 19:42:00 2012 OPTIONS IMPORT: timers and/or timeouts modified
Thu Feb 16 19:42:00 2012 OPTIONS IMPORT: --ifconfig/up options modified
Thu Feb 16 19:42:00 2012 OPTIONS IMPORT: route options modified
Thu Feb 16 19:42:00 2012 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu Feb 16 19:42:00 2012 ROUTE default_gateway=192.168.1.1
Thu Feb 16 19:42:00 2012 TUN/TAP device tun0 opened
Thu Feb 16 19:42:00 2012 TUN/TAP TX queue length set to 100
Thu Feb 16 19:42:00 2012 /usr/sbin/ip link set dev tun0 up mtu 1500
Thu Feb 16 19:42:00 2012 /usr/sbin/ip addr add dev tun0 local 10.8.0.6 peer 10.8.0.5
Thu Feb 16 19:42:00 2012 /usr/sbin/ip route add 176.31.101.111/32 via 192.168.1.1
RTNETLINK answers: File exists
Thu Feb 16 19:42:00 2012 ERROR: Linux route add command failed: external program exited with error status: 2
Thu Feb 16 19:42:00 2012 /usr/sbin/ip route add 0.0.0.0/1 via 10.8.0.5
Thu Feb 16 19:42:00 2012 /usr/sbin/ip route add 128.0.0.0/1 via 10.8.0.5
Thu Feb 16 19:42:00 2012 /usr/sbin/ip route add 10.8.0.1/32 via 10.8.0.5
Thu Feb 16 19:42:00 2012 GID set to nobody
Thu Feb 16 19:42:00 2012 UID set to nobody
Thu Feb 16 19:42:00 2012 Initialization Sequence Completed

server:

Thu Feb 16 18:42:02 2012 OpenVPN 2.1.4 x86_64-pc-linux-gnu [SSL] [LZO2] [EPOLL] [MH] [PF_INET6] built on Feb 13 2012
Thu Feb 16 18:42:02 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu Feb 16 18:42:02 2012 Diffie-Hellman initialized with 1024 bit key
Thu Feb 16 18:42:02 2012 Control Channel Authentication: using 'privnet/ta.key' as a OpenVPN static key file
Thu Feb 16 18:42:02 2012 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 16 18:42:02 2012 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 16 18:42:02 2012 TLS-Auth MTU parms [ L:1560 D:168 EF:68 EB:0 ET:0 EL:0 ]
Thu Feb 16 18:42:02 2012 Socket Buffers: R=[87380->131072] S=[16384->131072]
Thu Feb 16 18:42:02 2012 ROUTE default_gateway=176.31.101.254
Thu Feb 16 18:42:02 2012 TUN/TAP device tun0 opened
Thu Feb 16 18:42:02 2012 TUN/TAP TX queue length set to 100
Thu Feb 16 18:42:02 2012 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Thu Feb 16 18:42:02 2012 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Thu Feb 16 18:42:02 2012 Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Feb 16 18:42:02 2012 GID set to nobody
Thu Feb 16 18:42:02 2012 UID set to nobody
Thu Feb 16 18:42:02 2012 Listening for incoming TCP connection on [undef]
Thu Feb 16 18:42:02 2012 TCPv4_SERVER link local (bound): [undef]
Thu Feb 16 18:42:02 2012 TCPv4_SERVER link remote: [undef]
Thu Feb 16 18:42:02 2012 MULTI: multi_init called, r=256 v=256
Thu Feb 16 18:42:02 2012 IFCONFIG POOL: base=10.8.0.4 size=62
Thu Feb 16 18:42:02 2012 IFCONFIG POOL LIST
Thu Feb 16 18:42:02 2012 [cut],10.8.0.4
Thu Feb 16 18:42:02 2012 MULTI: TCP INIT maxclients=1024 maxevents=1028
Thu Feb 16 18:42:02 2012 Initialization Sequence Completed
Thu Feb 16 18:42:04 2012 MULTI: multi_create_instance called
Thu Feb 16 18:42:04 2012 Re-using SSL/TLS context
Thu Feb 16 18:42:04 2012 LZO compression initialized
Thu Feb 16 18:42:04 2012 Control Channel MTU parms [ L:1560 D:168 EF:68 EB:0 ET:0 EL:0 ]
Thu Feb 16 18:42:04 2012 Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Feb 16 18:42:04 2012 Local Options hash (VER=V4): '9915e4a2'
Thu Feb 16 18:42:04 2012 Expected Remote Options hash (VER=V4): '2f2c6498'
Thu Feb 16 18:42:04 2012 TCP connection established with [AF_INET][cut]
Thu Feb 16 18:42:04 2012 TCPv4_SERVER link local: [undef]
Thu Feb 16 18:42:04 2012 TCPv4_SERVER link remote: [AF_INET][cut]
Thu Feb 16 18:42:05 2012 [cut] TLS: Initial packet from [AF_INET][cut], sid=e4a5f8d8 2e0eff55
Thu Feb 16 18:42:08 2012 [cut] VERIFY OK: depth=1, /C=PL/ST=CA/L=[cut]/O=[cut]/CN=[cut]A/emailAddress=[cut]
Thu Feb 16 18:42:08 2012 [cut] VERIFY OK: depth=0, /C=PL/ST=CA/L=[cut]/O=[cut]/CN=[cut]/emailAddress=[cut]
Thu Feb 16 18:42:09 2012 [cut] Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Feb 16 18:42:09 2012 [cut] Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 16 18:42:09 2012 [cut] Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Feb 16 18:42:09 2012 [cut] Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 16 18:42:09 2012 [cut] Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu Feb 16 18:42:09 2012 [cut] [[cut]] Peer Connection Initiated with [AF_INET][cut]
Thu Feb 16 18:42:09 2012 [cut]/[cut] MULTI: Learn: 10.8.0.6 -> [cut]/[cut]
Thu Feb 16 18:42:09 2012 [cut]/[cut] MULTI: primary virtual IP for [cut]/[cut]: 10.8.0.6
Thu Feb 16 18:42:11 2012 [cut]/[cut] PUSH: Received control message: 'PUSH_REQUEST'
Thu Feb 16 18:42:11 2012 [cut]/[cut] SENT CONTROL [[cut]]: 'PUSH_REPLY,dhcp-option DNS 192.168.1.0,redirect-gateway def1,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)

Gcool

Member

Registered: 2011-08-16

Posts: 1,456

Re: OpenVPN doesn't accept routing

I'm a bit confused with the routing messages I see in those logs. Could you make a small description of your exact setup; which are the ip's involved (client, server, encryption domain that'll be used, dns,...), is the client lan supposed to be routed to the server or vice-versa(client -> server if I understand correctly),....

PS: have you set it up as described here?

Last edited by Gcool (2012-02-17 06:56:39)

---

Burninate!

megabrain

Member

Registered: 2008-09-12

Posts: 16

Re: OpenVPN doesn't accept routing

try to ping 8.8.8.8 from client.. if it works then something wrong with dns because you pushing network instead of host

push "dhcp-option DNS 192.168.1.0"

Last edited by megabrain (2012-02-17 08:40:25)