Arch Linux

Tzeny

Member

Registered: 2017-12-29

Posts: 5

OpenVPN connected to server but no internet/network access

Hello, I have a problem connecting to my VPN server. I am using obfsproxy3, and OpenVPN 2.4.6. OpenVPN doesn't report any errors, and this is the output of 'ip addr':

ip addr

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: enp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 8c:ec:4b:02:de:94 brd ff:ff:ff:ff:ff:ff
    inet 10.21.2.132/16 brd 10.21.255.255 scope global dynamic noprefixroute enp2s0
       valid_lft 693sec preferred_lft 693sec
    inet6 fe80::760e:b43:7624:7946/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
3: wlp3s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
    link/ether 3a:9a:c1:80:6e:d8 brd ff:ff:ff:ff:ff:ff
4: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default 
    link/ether 02:42:77:80:e9:72 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever
7: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 100
    link/none 
    inet 192.168.255.6 peer 192.168.255.5/32 scope global tun0
       valid_lft forever preferred_lft forever
    inet6 fe80::c668:79fc:ec80:bd6c/64 scope link stable-privacy 
       valid_lft forever preferred_lft forever

Output of ping:

ping 192.168.0.1
PING 192.168.0.1 (192.168.0.1) 56(84) bytes of data.
^C
--- 192.168.0.1 ping statistics ---
74 packets transmitted, 0 received, 100% packet loss, time 73968ms

ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
^C
--- 8.8.8.8 ping statistics ---
19 packets transmitted, 0 received, 100% packet loss, time 18235ms

I've been assigned an IP, the interface tun0 is created but I can't access the internet or ping any other machines connected to the same network as the VPN server.

The full scenario is this: I have a server back home running an Obfsproxy3 instance and a TCP OpenVPN server (this docker image: https://hub.docker.com/r/kylemanna/openvpn/). I have a dual boot laptop, with Windows 10 and Arch Linux 1.4. I first tried this configuration (obfsproxy + openvpn) on Windows, because in the area I'm currently in VPN network access is restricted, and it has been working for some time now. Then I decided to use the same configuration for Arch Linux.

To run obfsproxy3 I used this command and got this output:

obfsproxy --log-min-severity=info obfs3 socks 127.0.0.1:1050

2018-06-05 08:11:34,164 [WARNING] Obfsproxy (version: 0.2.13_1_g2bf9d09-py2.7.egg) starting up.
2018-06-05 08:11:34,167 [INFO] OBFSSOCKSv5Factory starting on 1050
2018-06-05 08:11:34,167 [INFO] Starting factory <obfsproxy.network.socks.OBFSSOCKSv5Factory instance at 0x7f0b94c79f80>
2018-06-05 08:11:34,167 [INFO] Launched 'socks' listener at '[scrubbed]:1050' for transport 'obfs3'.

To run OpenVPN I used this command and got this ouput:\

sudo openvpn server-obfs.ovpn

Tue Jun  5 08:29:01 2018 OpenVPN 2.4.6 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 24 2018
Tue Jun  5 08:29:01 2018 library versions: OpenSSL 1.1.0h  27 Mar 2018, LZO 2.10
Enter Private Key Password: *****************
Tue Jun  5 08:29:03 2018 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Jun  5 08:29:03 2018 TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:1050
Tue Jun  5 08:29:03 2018 Attempting to establish TCP connection with [AF_INET]127.0.0.1:1050 [nonblock]
Tue Jun  5 08:29:03 2018 TCP connection established with [AF_INET]127.0.0.1:1050
Tue Jun  5 08:29:03 2018 TCP_CLIENT link local: (not bound)
Tue Jun  5 08:29:03 2018 TCP_CLIENT link remote: [AF_INET]127.0.0.1:1050
Tue Jun  5 08:29:03 2018 [<remote>] Peer Connection Initiated with [AF_INET]127.0.0.1:1050
Tue Jun  5 08:29:04 2018 Options error: Unrecognized option or missing or extra parameter(s) in [PUSH-OPTIONS]:1: block-outside-dns (2.4.6)
Tue Jun  5 08:29:04 2018 TUN/TAP device tun0 opened
Tue Jun  5 08:29:04 2018 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Tue Jun  5 08:29:04 2018 /usr/bin/ip link set dev tun0 up mtu 1500
Tue Jun  5 08:29:04 2018 /usr/bin/ip addr add dev tun0 local 192.168.255.6 peer 192.168.255.5
Tue Jun  5 08:29:04 2018 Initialization Sequence Completed
Tue Jun  5 08:30:06 2018 [<remote>] Inactivity timeout (--ping-restart), restarting
Tue Jun  5 08:30:06 2018 /usr/bin/ip addr del dev tun0 local 192.168.255.6 peer 192.168.255.5
Tue Jun  5 08:30:06 2018 SIGUSR1[soft,ping-restart] received, process restarting
Tue Jun  5 08:30:11 2018 TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:1050
Tue Jun  5 08:30:11 2018 Attempting to establish TCP connection with [AF_INET]127.0.0.1:1050 [nonblock]
Tue Jun  5 08:30:11 2018 TCP connection established with [AF_INET]127.0.0.1:1050
Tue Jun  5 08:30:11 2018 TCP_CLIENT link local: (not bound)
Tue Jun  5 08:30:11 2018 TCP_CLIENT link remote: [AF_INET]127.0.0.1:1050
Tue Jun  5 08:30:11 2018 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1551', remote='link-mtu 1543'
Tue Jun  5 08:30:11 2018 WARNING: 'cipher' is used inconsistently, local='cipher AES-256-GCM', remote='cipher BF-CBC'
Tue Jun  5 08:30:11 2018 WARNING: 'auth' is used inconsistently, local='auth [null-digest]', remote='auth SHA1'
Tue Jun  5 08:30:11 2018 WARNING: 'keysize' is used inconsistently, local='keysize 256', remote='keysize 128'
Tue Jun  5 08:30:11 2018 [<remote>] Peer Connection Initiated with [AF_INET]127.0.0.1:1050
Tue Jun  5 08:30:12 2018 Options error: Unrecognized option or missing or extra parameter(s) in [PUSH-OPTIONS]:1: block-outside-dns (2.4.6)
Tue Jun  5 08:30:12 2018 TUN/TAP device tun0 opened
Tue Jun  5 08:30:12 2018 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Tue Jun  5 08:30:12 2018 /usr/bin/ip link set dev tun0 up mtu 1500
Tue Jun  5 08:30:12 2018 /usr/bin/ip addr add dev tun0 local 192.168.255.6 peer 192.168.255.5
Tue Jun  5 08:30:12 2018 Initialization Sequence Completed
^CTue Jun  5 08:30:25 2018 event_wait : Interrupted system call (code=4)
Tue Jun  5 08:30:25 2018 /usr/bin/ip addr del dev tun0 local 192.168.255.6 peer 192.168.255.5
Tue Jun  5 08:30:25 2018 SIGINT[hard,] received, process exiting

And this is my OpenVPN config file created with 'easy_rsa build-client-full':

server-obfs.ovpn

proto tcp-client
client
nobind
dev tun
remote-cert-tls server

socks-proxy 127.0.0.1 1050

remote <remote> 8080

<key>
-----BEGIN ENCRYPTED PRIVATE KEY-----
<private key>
-----END ENCRYPTED PRIVATE KEY-----
</key>
<cert>
-----BEGIN CERTIFICATE-----
<cert>
-----END CERTIFICATE-----
</cert>
<ca>
-----BEGIN CERTIFICATE-----
<cert>
-----END CERTIFICATE-----
</ca>
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
<key>
-----END OpenVPN Static key V1-----
</tls-auth>
key-direction 1

redirect-gateway def1

Any idea what I am doing wrong?

sincomil

Member

Registered: 2018-02-13

Posts: 118

Re: OpenVPN connected to server but no internet/network access

To get on Internet through VPN server you have to set default route on your client machine and also set up NAT on VPN server side.
Please show output of

ip ro sh

In summary:
1. put 'redirect-gateway def1' in your client.ovpn file
2. enable packet forwarding on VPN server: echo "1" > /proc/sys/net/ipv4/ip_forward
3. enable NAT on VPN server: iptables -t nat -A POSTROUTING -s <your_client_ip> -j MASQUERADE

Last edited by sincomil (2018-06-05 07:07:50)

Tzeny

Member

Registered: 2017-12-29

Posts: 5

Re: OpenVPN connected to server but no internet/network access

ip ro sh

0.0.0.0/1 via 192.168.255.5 dev tun0 
default via 10.21.1.1 dev enp2s0 proto dhcp metric 100 
10.21.0.0/16 dev enp2s0 proto kernel scope link src 10.21.2.132 metric 100 
127.0.0.1 via 10.21.1.1 dev enp2s0 
128.0.0.0/1 via 192.168.255.5 dev tun0 
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown 
192.168.255.1 via 192.168.255.5 dev tun0 
192.168.255.5 dev tun0 proto kernel scope link src 192.168.255.6 

But why do I have to modify something on the server side if from Windows and Android clients it works ok?

sincomil

Member

Registered: 2018-02-13

Posts: 118

Re: OpenVPN connected to server but no internet/network access

Since you have a problem only on linux machine, then NAT actually works ok
10.0.0.0/1 via 192.168.255.5 dev tun0  - indicates that default route was replaced by openvpn to vpn-server peer ip 192.168.255.5
Then you shoud try to ping first that peer ip: 192.168.255.5 to make sure that at least you tunnel trafic is working between you client private ip and server peer ip

Tzeny

Member

Registered: 2017-12-29

Posts: 5

Re: OpenVPN connected to server but no internet/network access

I tried pinging 192.168.255.5, no luck

ping 192.168.255.5
PING 192.168.255.5 (192.168.255.5) 56(84) bytes of data.
^C
--- 192.168.255.5 ping statistics ---
14 packets transmitted, 0 received, 100% packet loss, time 13170ms

ragnarokandroll

Member

Registered: 2019-09-03

Posts: 1

Re: OpenVPN connected to server but no internet/network access

I just had this same issue and maybe this information will save others from the hours of troubleshooting I just put in (with NetworkManager). For some reason with openconnect I didn't need to check this box but with openvpn I needed to check it. Under Network Settings > VPN > click on the gear for settings > on both IPv4 and IPv6 tabs > check "Use this connection only for resources on its network".

Last edited by ragnarokandroll (2019-09-03 04:23:56)