I've been trying to get OpenVPN to work for three days. After reading many questions, the HOWTO, the FAQ and even parts of a guide to Linux networking, I cannot get my an Internet connection to the Internet.

I'm trying to set up a OpenVPN server on a VPS, which will be used for:

• secure access to the Internet
• bypassing port restrictions (directadmin/2222 for example)
• an IPv6 connection (my client does only have IPv4 connectivity, while the VPS has both IPv4 and native IPv6 connectivity) (if possible)

I can connect to my server and access the machine (HTTP), but Internet connectivity fails completely. I'm using ping 8.8.8.8 for testing whether my connection works or not.

Using tcpdump and iptables -t nat -A POSTROUTING -j LOG, I can confirm that the packets reach my server. If I ping to 8.8.8.8 on the VPS, I get an echo-reply from 8.8.8.8 as expected. When pinging from the client, I do not get an echo-reply.

The VPS has only one NIC: etho. It runs on Xen.

Summary: I want to have a secure connection between my laptop and the Internet using OpenVPN. If that works, I want to have IPv6 connectivity as well.

Network setup and software:

 Home laptop    (eth0: 192.168.2.10) (tap0: 10.8.0.2)
  |      |       (running Kubuntu 10.10; OpenVPN 2.1.0-3ubuntu1)
  | wifi |
router/gateway  (gateway 192.168.2.1)
      |
  INTERNET
      |
     VPS        (eth0:1.2.3.4)       (gateway, tap0: 10.8.0.1)
                  (running Debian 6; OpenVPN 2.1.3-2)

wifi and my home router should not cause problems since all traffic goes encrypted over UDP port 1194.

I've turned IP forwarding on:

# echo 1 > /proc/sys/net/ipv4/ip_forward

iptables has been configured to allow forwarding traffic as well:

iptables -F FORWARD
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
iptables -A FORWARD -j DROP

I've tried each of these rules separately without luck (flushing the chains before executing):

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to 1.2.3.4
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

route -n before (server):

1.2.3.4         0.0.0.0         255.255.255.0   U     0      0        0 eth0
0.0.0.0         1.2.3.4         0.0.0.0         UG    0      0        0 eth0

route -n after (server):

1.2.3.4         0.0.0.0         255.255.255.0   U     0      0        0 eth0
10.8.0.0        0.0.0.0         255.255.255.0   U     0      0        0 tap0
0.0.0.0         1.2.3.4         0.0.0.0         UG    0      0        0 eth0

route -n before (client):

192.168.2.0     0.0.0.0         255.255.255.0   U     2      0        0 wlan0
169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 wlan0
0.0.0.0         192.168.2.1     0.0.0.0         UG    0      0        0 wlan0

route -n after (client):

1.2.3.4         192.168.2.1     255.255.255.255 UGH   0      0        0 wlan0
10.8.0.0        0.0.0.0         255.255.255.0   U     0      0        0 tap0
192.168.2.0     0.0.0.0         255.255.255.0   U     2      0        0 wlan0
169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 wlan0
0.0.0.0         10.8.0.1        128.0.0.0       UG    0      0        0 tap0
128.0.0.0       10.8.0.1        128.0.0.0       UG    0      0        0 tap0
0.0.0.0         192.168.2.1     0.0.0.0         UG    0      0        0 wlan0

SERVER config

proto udp
dev tap
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1"
ifconfig-pool-persist ipp.txt
keepalive 10 120
tls-auth ta.key 0
comp-lzo
user nobody
group nobody
persist-key
persist-tun
log-append openvpn-log
verb 3
mute 10

CLIENT config

dev tap
proto udp
remote 1.2.3.4 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
ns-cert-type server
tls-auth ta.key 1
comp-lzo
verb 3
mute 20

traceroute 8.8.8.8 works as expected (similar output without OpenVPN activated):

 1  10.8.0.1 (10.8.0.1)  24.276 ms  26.891 ms  29.454 ms
 2  gw03.sbp.directvps.nl (178.21.112.1)  31.161 ms  31.890 ms  34.458 ms
 3  ge0-v0652.cr0.nik-ams.nl.as8312.net (195.210.57.105)  35.353 ms  36.874 ms  38.403 ms
 4  ge0-v3900.cr0.nik-ams.nl.as8312.net (195.210.57.53)  41.311 ms  41.561 ms  43.006 ms
 5  * * *
 6  209.85.248.88 (209.85.248.88)  147.061 ms  36.931 ms  28.063 ms
 7  216.239.49.36 (216.239.49.36)  31.109 ms  33.292 ms 216.239.49.28 (216.239.49.28)  64.723 ms
 8  209.85.255.130 (209.85.255.130)  49.350 ms 209.85.255.126 (209.85.255.126)  49.619 ms 209.85.255.122 (209.85.255.122)  52.416 ms
 9  google-public-dns-a.google.com (8.8.8.8)  41.266 ms  44.054 ms  44.730 ms

If you have any suggestions, please comment or answer.

Thanks in advance.