You are not logged in.

Pages: 1

#1 2019-04-30 15:00:44

pawggers
Member
Registered: 2019-04-30
Posts: 8

Cannot get OpenVPN to work

Hello!

I have a PIA subscription and installed the openvpn config files and can connect to the VPN but I am unable to properly forward data.

I enabled 

net.ipv4.ip_forward = 1

to try to get the VPN to work but it does not work.

I also installed the PIA application to see if it would work and I'm still having similiar issues.

1. I can connect to the server
2. The server does not give me an IP or DNS is broken


/etc/resolv.conf

outputs PIA dns servers when connected to the VPN.

https://biyori.org/i/AWK0pi28yG.png

It connects with the application but it does not give an IP back.

Here's a picture of connecting with an ovpn file with openvpn.
https://biyori.org/i/dmWIktwVkx.png

I don't know why I can't get the VPN to work. I turned off iptables and still no cigar.

Last edited by jasonwryan (2019-04-30 16:05:21)

Offline

#2 2019-04-30 16:06:39

jasonwryan
Anarchist
From: .nz
Registered: 2009-05-09
Posts: 30,426
Website

Re: Cannot get OpenVPN to work

Don't post screenshots of text output: paste the actual text: https://wiki.archlinux.org/index.php/Co … s_and_code


And read the Code of Conduct and only post thumbnails when you do post images.

Arch + dwm   •   Mercurial repos  •   Surfraw

Registered Linux User #482438

Offline

#3 2019-05-01 15:21:33

pawggers
Member
Registered: 2019-04-30
Posts: 8

Re: Cannot get OpenVPN to work

Alright here's an update to what I've tried so far:


Tried UFW firewall and added the rules (my network adapter is eno1)

# START OPENVPN RULES
# NAT table rules
*nat
:POSTROUTING ACCEPT [0:0]
# Allow traffic from OpenVPN client to eno1
#used /8 bitmask to ensure ip is routed
-A POSTROUTING -s 10.0.0.0/8 -o eno1 -j MASQUERADE
COMMIT
# END OPENVPN RULES

Also modified 

/etc/default/ufw

and added 

DEFAULT_FORWARD_POLICY="ACCEPT"

some more console debug info:

Before VPN:
(ifconfig & ip addr)

[kyle@ArchDatAss ~]$ ifconfig
eno1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.1.119  netmask 255.255.255.0  broadcast 192.168.1.255
        inet6 fe80::8aa1:3e70:60fd:13cc  prefixlen 64  scopeid 0x20<link>
        inet6 fe80::8d90:10d9:8996:2a0a  prefixlen 64  scopeid 0x20<link>
        ether bc:ae:c5:74:cb:e8  txqueuelen 1000  (Ethernet)
        RX packets 957  bytes 1318844 (1.2 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 396  bytes 36437 (35.5 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
        device interrupt 20  memory 0xf7500000-f7520000  

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 16  bytes 960 (960.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 16  bytes 960 (960.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0





[kyle@ArchDatAss ~]$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eno1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether bc:ae:c5:74:cb:e8 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.119/24 brd 192.168.1.255 scope global dynamic noprefixroute eno1
       valid_lft 86340sec preferred_lft 86340sec
    inet 192.168.1.118/24 brd 192.168.1.255 scope global secondary noprefixroute eno1
       valid_lft forever preferred_lft forever
    inet6 fe80::8aa1:3e70:60fd:13cc/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
    inet6 fe80::8d90:10d9:8996:2a0a/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
[kyle@ArchDatAss ~]$

After VPN: 

[kyle@ArchDatAss ~]$ ifconfig
eno1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.1.119  netmask 255.255.255.0  broadcast 192.168.1.255
        inet6 fe80::8aa1:3e70:60fd:13cc  prefixlen 64  scopeid 0x20<link>
        inet6 fe80::8d90:10d9:8996:2a0a  prefixlen 64  scopeid 0x20<link>
        ether bc:ae:c5:74:cb:e8  txqueuelen 1000  (Ethernet)
        RX packets 1003  bytes 1327447 (1.2 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 489  bytes 49551 (48.3 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
        device interrupt 20  memory 0xf7500000-f7520000  

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 595  bytes 31538 (30.7 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 595  bytes 31538 (30.7 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 10.67.10.6  netmask 255.255.255.255  destination 10.67.10.5
        inet6 fe80::eec2:e549:efcd:74de  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 50  bytes 3020 (2.9 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0




[kyle@ArchDatAss ~]$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eno1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether bc:ae:c5:74:cb:e8 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.119/24 brd 192.168.1.255 scope global dynamic noprefixroute eno1
       valid_lft 86229sec preferred_lft 86229sec
    inet 192.168.1.118/24 brd 192.168.1.255 scope global secondary noprefixroute eno1
       valid_lft forever preferred_lft forever
    inet6 fe80::8aa1:3e70:60fd:13cc/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
    inet6 fe80::8d90:10d9:8996:2a0a/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 100
    link/none 
    inet 10.67.10.6 peer 10.67.10.5/32 brd 10.67.10.6 scope global noprefixroute tun0
       valid_lft forever preferred_lft forever
    inet6 fe80::eec2:e549:efcd:74de/64 scope link stable-privacy 
       valid_lft forever preferred_lft forever
[kyle@ArchDatAss ~]$

Last edited by pawggers (2019-05-01 15:22:53)

Offline

#4 2019-05-01 15:50:56

Zod
Member
From: Hoosiertucky
Registered: 2019-03-10
Posts: 636

Re: Cannot get OpenVPN to work

I don't understand this firewall (part of?) rule...

A POSTROUTING -s 10.0.0.0/8 -o eno1 -j MASQUERADE

I wouldn't think the localhost wouldn't understand it either.

I can't imagne you would need to do this...

net.ipv4.ip_forward = 1

unless your box is a router.

I'm guessing 73.185.x is the other end of the tunnel.

Do..

ip route

before and after you connect the vpn, paste the results here.

Don't forget to use code tags.

Also you can use traceroute and ping to see what you can get to with the vpn
connected.

10.90.10.6 (your next hop) can be used as a ping target for testing purposes.

You could try traceroute to archlinux.org to get an idea where your going and testing name resolution.

Assumptions I'm making: 73.185.x is target for the far end of the tunnel and in a DMZ. 10.90.10.x is their is their dhcp address space. You are getting connected and assigned an address (at one time it was 10.90.10.5).

EDIT: Oh! I get it now...Private Internet Access...ok this might help anyway.

Last edited by Zod (2019-05-01 20:38:22)

Offline

#5 2019-05-02 05:42:29

pawggers
Member
Registered: 2019-04-30
Posts: 8

Re: Cannot get OpenVPN to work

Zod wrote:

I don't understand this firewall (part of?) rule...

A POSTROUTING -s 10.0.0.0/8 -o eno1 -j MASQUERADE

I wouldn't think the localhost wouldn't understand it either.

I can't imagne you would need to do this...

net.ipv4.ip_forward = 1

unless your box is a router.

I'm guessing 73.185.x is the other end of the tunnel.

Do..

ip route

before and after you connect the vpn, paste the results here.

Don't forget to use code tags.

Also you can use traceroute and ping to see what you can get to with the vpn
connected.

10.90.10.6 (your next hop) can be used as a ping target for testing purposes.

You could try traceroute to archlinux.org to get an idea where your going and testing name resolution.

Assumptions I'm making: 73.185.x is target for the far end of the tunnel and in a DMZ. 10.90.10.x is their is their dhcp address space. You are getting connected and assigned an address (at one time it was 10.90.10.5).

EDIT: Oh! I get it now...Private Internet Access...ok this might help anyway.

So I'm not actually sure why but after doing a traceroute on a vpn it started to work?

kyle@ArchDatAss ~]$ traceroute archlinux.org
traceroute to archlinux.org (138.201.81.199), 30 hops max, 60 byte packets
 1  10.4.10.1 (10.4.10.1)  212.494 ms  212.483 ms  212.482 ms
 2  * * *
 3  46.166.138.190 (46.166.138.190)  486.230 ms 109.201.154.254 (109.201.154.254)  538.745 ms 46.166.138.190 (46.166.138.190)  488.764 ms
 4  185.107.116.22 (185.107.116.22)  487.674 ms  488.043 ms 185.107.116.21 (185.107.116.21)  483.751 ms
 5  5.104.136.186 (5.104.136.186)  487.626 ms 5.104.137.178 (5.104.137.178)  486.110 ms 5.104.136.186 (5.104.136.186)  486.111 ms
 6  core1.fra.hetzner.com (213.239.203.157)  496.528 ms core4.fra.hetzner.com (213.239.252.45)  492.412 ms core1.fra.hetzner.com (213.239.203.157)  494.795 ms
 7  core23.fsn1.hetzner.com (213.239.229.74)  499.039 ms  498.419 ms core24.fsn1.hetzner.com (213.239.203.150)  502.079 ms
 8  ex9k2.dc8.fsn1.hetzner.com (213.239.229.18)  511.111 ms  499.833 ms  500.561 ms
 9  apollo.archlinux.org (138.201.81.199)  496.937 ms !X  496.569 ms !X  494.668 ms !X
[kyle@ArchDatAss ~]$

also here's the output of the `ip route`

Before VPN

[kyle@ArchDatAss ~]$ ip route
default via 192.168.1.1 dev eno1 proto dhcp metric 100 
default via 192.168.1.1 dev eno1 proto dhcp src 192.168.1.118 metric 202 
192.168.1.0/24 dev eno1 proto kernel scope link src 192.168.1.119 metric 100 
192.168.1.0/24 dev eno1 proto kernel scope link src 192.168.1.118 metric 100 
192.168.1.0/24 dev eno1 proto dhcp scope link src 192.168.1.118 metric 202 
192.168.1.1 dev eno1 proto static scope link metric 100 
194.187.249.34 via 192.168.1.1 dev eno1 proto static metric 100 
[kyle@ArchDatAss ~]$

After VPN

[kyle@ArchDatAss ~]$ ip route
default via 10.97.10.5 dev tun0 proto static metric 50 
default via 192.168.1.1 dev eno1 proto dhcp metric 100 
default via 192.168.1.1 dev eno1 proto dhcp src 192.168.1.118 metric 202 
10.97.10.1 via 10.97.10.5 dev tun0 proto static metric 50 
10.97.10.5 dev tun0 proto kernel scope link src 10.97.10.6 metric 50 
103.231.89.10 via 192.168.1.1 dev eno1 proto static metric 100 
185.210.219.156 via 192.168.1.1 dev eno1 proto static metric 100 
192.168.1.0/24 dev eno1 proto kernel scope link src 192.168.1.119 metric 100 
192.168.1.0/24 dev eno1 proto kernel scope link src 192.168.1.118 metric 100 
192.168.1.0/24 dev eno1 proto dhcp scope link src 192.168.1.118 metric 202 
192.168.1.1 dev eno1 proto static scope link metric 100 
194.187.249.34 via 192.168.1.1 dev eno1 proto static metric 100 
[kyle@ArchDatAss ~]$

Is there anything out of order?

Off topic but is UFW/iptables/a firewall even needed in 2019?

Warm regards,

- pawggers

Offline

#6 2019-05-02 12:11:47

Zod
Member
From: Hoosiertucky
Registered: 2019-03-10
Posts: 636

Re: Cannot get OpenVPN to work

You picked up a route for 194.187.249.34 before you connected to the vpn, if I were you I would need to understand why.

As far as a firewall goes, it's a matter of personal choice. Me, I don't on the linux side but do on the Windows side.

If you're happy with the way your vpn is working please don't forget to edit your OP title and mark it as solved.

Offline

#7 2019-05-03 16:34:08

pawggers
Member
Registered: 2019-04-30
Posts: 8

Re: Cannot get OpenVPN to work

Zod wrote:

You picked up a route for 194.187.249.34 before you connected to the vpn, if I were you I would need to understand why.

As far as a firewall goes, it's a matter of personal choice. Me, I don't on the linux side but do on the Windows side.

If you're happy with the way your vpn is working please don't forget to edit your OP title and mark it as solved.

Is that a problem?

I cleared my iptables because I wanted to see what exactly is the bare minimum to get openvpn to work. With no IPtables the vpn does not work. These rules work:
I also opened the port for PIA to work it was on port 1197 via udp.

iptables -A INPUT -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -j ACCEPT

However the wiki says that this is (tun+) a security implication if I don't trust the client but... the client is openvpn? Does it matter if I'm just using openvpn?

Warm regards,

- P

Offline

Pages: 1

Board footer

Powered by FluxBB