I am trying to use OpenVPN to access the internet over a secure connection.
I have openVPN configured and running on Amazon EC2 in bridge mode with client certs. I can successfully connect from the client, but I cannot get access to the internet or ping anything from the client
I checked the following and everything seems to shows a successful connection between the vpn client/server and UDP traffic on 1194
[server] sudo tcpdump -i eth0 udp port 1194
(shows UDP traffic after establishing connection)
[server] sudo iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
[server] sudo iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- ip-W-X-Y-0.us-west-1.compute.internal/24 anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
[server] openvpn.log
Wed Oct 19 03:11:26 2011 localhost/a.b.c.d:61905 [localhost] Inactivity timeout (--ping-restart), restarting
Wed Oct 19 03:11:26 2011 localhost/a.b.c.d:61905 SIGUSR1[soft,ping-restart] received, client-instance restarting
Wed Oct 19 03:41:31 2011 MULTI: multi_create_instance called
Wed Oct 19 03:41:31 2011 a.b.c.d:57889 Re-using SSL/TLS context
Wed Oct 19 03:41:31 2011 a.b.c.d:57889 LZO compression initialized
Wed Oct 19 03:41:31 2011 a.b.c.d:57889 Control Channel MTU parms [ L:1574 D:166 EF:66 EB:0 ET:0 EL:0 ]
Wed Oct 19 03:41:31 2011 a.b.c.d:57889 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Wed Oct 19 03:41:31 2011 a.b.c.d:57889 Local Options hash (VER=V4): '360696c5'
Wed Oct 19 03:41:31 2011 a.b.c.d:57889 Expected Remote Options hash (VER=V4): '13a273ba'
Wed Oct 19 03:41:31 2011 a.b.c.d:57889 TLS: Initial packet from [AF_INET]a.b.c.d:57889, sid=dd886604 ab6ebb38
Wed Oct 19 03:41:35 2011 a.b.c.d:57889 VERIFY OK: depth=1, /C=US/ST=CA/L=SanFrancisco/O=EXAMPLE/CN=EXAMPLE_CA/
[email protected]
Wed Oct 19 03:41:35 2011 a.b.c.d:57889 VERIFY OK: depth=0, /C=US/ST=CA/L=SanFrancisco/O=EXAMPLE/CN=localhost/
[email protected]
Wed Oct 19 03:41:37 2011 a.b.c.d:57889 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Oct 19 03:41:37 2011 a.b.c.d:57889 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Oct 19 03:41:37 2011 a.b.c.d:57889 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Oct 19 03:41:37 2011 a.b.c.d:57889 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Oct 19 03:41:37 2011 a.b.c.d:57889 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Oct 19 03:41:37 2011 a.b.c.d:57889 [localhost] Peer Connection Initiated with [AF_INET]a.b.c.d:57889
Wed Oct 19 03:41:39 2011 localhost/a.b.c.d:57889 PUSH: Received control message: 'PUSH_REQUEST'
Wed Oct 19 03:41:39 2011 localhost/a.b.c.d:57889 SENT CONTROL [localhost]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,route-gateway W.X.Y.Z,ping 10,ping-restart 120,ifconfig W.X.Y.Z 255.255.255.0' (status=1)
Wed Oct 19 03:41:40 2011 localhost/a.b.c.d:57889 MULTI: Learn: (IPV6) -> localhost/a.b.c.d:57889
[client] tracert google.com
Tracing route to google.com [74.125.71.104] over a maximum of 30 hops:
1 347 ms 349 ms 348 ms PC [w.X.Y.Z]
2 * * * Request timed out.
I can also successfully ping the server IP address from the client, and ping google.com from an SSH shell on the server. What am I doing wrong?
Here is my config (Note: W.X.Y.Z == amazon EC2 private ipaddress)
bridge config on br0
ifconfig eth0 0.0.0.0 promisc up
brctl addbr br0
brctl addif br0 eth0
ifconfig br0 W.X.Y.X netmask 255.255.255.0 broadcast W.X.Y.255 up
route add default gw W.X.Y.1 br0
/etc/openvpn/server.conf (from https://help.ubuntu.com/10.04/serverguide/C/openvpn.html)
local W.X.Y.Z
dev tap0
up "/etc/openvpn/up.
sh br0"
down "/etc/openvpn/down.
sh br0"
;server W.X.Y.0 255.255.255.0
server-bridge W.X.Y.Z 255.255.255.0 W.X.Y.105 W.X.Y.200
;push "route W.X.Y.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
tls-auth ta.key 0 # This file is secret
user nobody
group nogroup
log-append openvpn.log
iptables config
sudo iptables -A INPUT -i tap0 -j ACCEPT
sudo iptables -A INPUT -i br0 -j ACCEPT
sudo iptables -A FORWARD -i br0 -j ACCEPT
sudo iptables -t nat -A POSTROUTING -s W.X.Y.0/24 -o eth0 -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward
Routing Tables added
route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
W.X.Y.0 0.0.0.0 255.255.255.0 U 0 0 0 br0
0.0.0.0 W.X.Y.1 0.0.0.0 UG 0 0 0 br0
C:>route print
===========================================================================
Interface List
32...00 ff ac d6 f7 04 ......TAP-Win32 Adapter V9
15...00 14 d1 e9 57 49 ......Microsoft Virtual WiFi Miniport Adapter #2
14...00 14 d1 e9 57 49 ......Realtek RTL8191SU Wireless LAN 802.11n USB 2.0 Net
work Adapter
10...00 1f d0 50 1b ca ......Realtek PCIe GBE Family Controller
1...........................Software Loopback Interface 1
11...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
16...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
17...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
18...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
36...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #5
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.1.2.1 10.1.2.201 25
10.1.2.0 255.255.255.0 On-link 10.1.2.201 281
10.1.2.201 255.255.255.255 On-link 10.1.2.201 281
10.1.2.255 255.255.255.255 On-link 10.1.2.201 281
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.1.2.201 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 10.1.2.201 281
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.0.0 0.0.0.0 10.1.2.1 Default
===========================================================================
C:>tracert google.com
Tracing route to google.com [74.125.71.147]
over a maximum of 30 hops:
1 344 ms 345 ms 343 ms PC [W.X.Y.221]
2 * * * Request timed out.
