I am trying to use OpenVPN to access the internet over a secure connection.
I have openVPN configured and running on Amazon EC2 in bridge mode with client certs. I can successfully connect from the client, but I cannot get access to the internet or ping anything from the client
I checked the following and everything seems to shows a successful connection between the vpn client/server and UDP traffic on 1194
[server] sudo tcpdump -i eth0 udp port 1194
(shows UDP traffic after establishing connection)
[server] sudo iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
[server] sudo iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- ip-W-X-Y-0.us-west-1.compute.internal/24 anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
[server] openvpn.log
Wed Oct 19 03:11:26 2011 localhost/a.b.c.d:61905 [localhost] Inactivity timeout (--ping-restart), restarting
Wed Oct 19 03:11:26 2011 localhost/a.b.c.d:61905 SIGUSR1[soft,ping-restart] received, client-instance restarting
Wed Oct 19 03:41:31 2011 MULTI: multi_create_instance called
Wed Oct 19 03:41:31 2011 a.b.c.d:57889 Re-using SSL/TLS context
Wed Oct 19 03:41:31 2011 a.b.c.d:57889 LZO compression initialized
Wed Oct 19 03:41:31 2011 a.b.c.d:57889 Control Channel MTU parms [ L:1574 D:166 EF:66 EB:0 ET:0 EL:0 ]
Wed Oct 19 03:41:31 2011 a.b.c.d:57889 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Wed Oct 19 03:41:31 2011 a.b.c.d:57889 Local Options hash (VER=V4): '360696c5'
Wed Oct 19 03:41:31 2011 a.b.c.d:57889 Expected Remote Options hash (VER=V4): '13a273ba'
Wed Oct 19 03:41:31 2011 a.b.c.d:57889 TLS: Initial packet from [AF_INET]a.b.c.d:57889, sid=dd886604 ab6ebb38
Wed Oct 19 03:41:35 2011 a.b.c.d:57889 VERIFY OK: depth=1, /C=US/ST=CA/L=SanFrancisco/O=EXAMPLE/CN=EXAMPLE_CA/
[email protected]
Wed Oct 19 03:41:35 2011 a.b.c.d:57889 VERIFY OK: depth=0, /C=US/ST=CA/L=SanFrancisco/O=EXAMPLE/CN=localhost/
[email protected]
Wed Oct 19 03:41:37 2011 a.b.c.d:57889 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Oct 19 03:41:37 2011 a.b.c.d:57889 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Oct 19 03:41:37 2011 a.b.c.d:57889 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Oct 19 03:41:37 2011 a.b.c.d:57889 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Oct 19 03:41:37 2011 a.b.c.d:57889 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Oct 19 03:41:37 2011 a.b.c.d:57889 [localhost] Peer Connection Initiated with [AF_INET]a.b.c.d:57889
Wed Oct 19 03:41:39 2011 localhost/a.b.c.d:57889 PUSH: Received control message: 'PUSH_REQUEST'
Wed Oct 19 03:41:39 2011 localhost/a.b.c.d:57889 SENT CONTROL [localhost]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,route-gateway W.X.Y.Z,ping 10,ping-restart 120,ifconfig W.X.Y.Z 255.255.255.
0' (status=1)
Wed Oct 19 03:41:40 2011 localhost/a.b.c.d:57889 MULTI: Learn: (IPV6) -> localhost/a.b.c.d:57889
[client] tracert google.com
Tracing route to google.com [74.125.71.104] over a maximum of 30 hops:
1 347 ms 349 ms 348 ms PC [w.X.Y.Z]
2 * * * Request timed out.
I can also successfully ping the server IP address from the client, and ping google.com from an SSH shell on the server. What am I doing wrong?
Here is my config (Note: W.X.Y.Z == amazon EC2 private ipaddress)
bridge config on br0
ifconfig eth0
0.0.
0.0 promisc up
brctl addbr br0
brctl addif br0 eth0
ifconfig br0 W.X.Y.X netmask 255.255.255.
0 broadcast W.X.Y.255 up
route add default gw W.X.Y.1 br0
/etc/openvpn/server.conf (from https://help.ubuntu.com/10.04/serverguide/C/openvpn.html)
local W.X.Y.Z
dev tap0
up "/etc/openvpn/up.sh br0"
down "/etc/openvpn/down.sh br0"
;server W.X.Y.
0 255.255.255.
0
server-bridge W.X.Y.Z 255.255.255.
0 W.X.Y.105 W.X.Y.200
;push "route W.X.Y.
0 255.255.255.
0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
tls-auth ta.key
0 # This file is secret
user nobody
group nogroup
log-append openvpn.log
iptables config
sudo iptables -A INPUT -i tap0 -j ACCEPT
sudo iptables -A INPUT -i br0 -j ACCEPT
sudo iptables -A FORWARD -i br0 -j ACCEPT
sudo iptables -t nat -A POSTROUTING -s W.X.Y.0/24 -o eth0 -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward
Routing Tables added
route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
W.X.Y.
0 0.0.
0.0 255.255.255.
0 U
0 0 0 br0
0.0.
0.0 W.X.Y.1
0.0.
0.0 UG
0 0 0 br0
C:>route print
===========================================================================
Interface List
32...00 ff ac d6 f7 04 ......TAP-Win32 Adapter V9
15...00 14 d1 e9 57 49 ......Microsoft Virtual WiFi Miniport Adapter #2
14...00 14 d1 e9 57 49 ......Realtek RTL8191SU Wireless LAN 802.11n USB 2.
0 Net
work Adapter
10...00 1f d0 50 1b ca ......Realtek PCIe GBE Family Controller
1...........................Software Loopback Interface 1
11...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
16...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
17...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
18...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
36...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #5
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.
0.0
0.0.
0.0 10.1.2.1 10.1.2.201 25
10.1.2.
0 255.255.255.
0 On-link 10.1.2.201 281
10.1.2.201 255.255.255.255 On-link 10.1.2.201 281
10.1.2.255 255.255.255.255 On-link 10.1.2.201 281
127.
0.0.
0 255.
0.0.
0 On-link 127.
0.0.1 306
127.
0.0.1 255.255.255.255 On-link 127.
0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.
0.0.1 306
224.
0.0.
0 240.
0.0.
0 On-link 127.
0.0.1 306
224.
0.0.
0 240.
0.0.
0 On-link 10.1.2.201 281
255.255.255.255 255.255.255.255 On-link 127.
0.0.1 306
255.255.255.255 255.255.255.255 On-link 10.1.2.201 281
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.
0.0
0.0.
0.0 10.1.2.1 Default
===========================================================================
C:>tracert google.com
Tracing route to google.com [74.125.71.147]
over a maximum of 30 hops:
1 344 ms 345 ms 343 ms PC [W.X.Y.221]
2 * * * Request timed out.