Openvpn – Internet stop working after connection to OpenVPN

openvpnwindows 10

Internet do not working after connection to OpenVPN.

I installed on Linux server OpenVPN. And trying to connect to it from my Windows 10. But after connecting I can't open any site.

My client config:

client
dev tun
proto udp
sndbuf 0
rcvbuf 0
remote <ip_removed> 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
comp-lzo
setenv opt block-outside-dns
key-direction 1
verb 3
auth SHA512

Server config:

port 1194
proto udp
dev tun
sndbuf 0
rcvbuf 0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-auth ta.key 0
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
#push "redirect-gateway def1 bypass-dhcp"
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
cipher AES-256-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem

Without connection to VPN:

>nslookup
Address:  192.168.3.1

After connection to VPN:

>nslookup
Address:  8.8.8.8

ping also not working.

IP forwarding on the server is enabled:

# sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1

My firewall have next rule:

$ sudo ufw allow 22
$ sudo ufw allow 80
$ sudo ufw allow 443
$ sudo ufw allow 1194

 

root@me:~# cat /etc/rc.local
#!/bin/sh -e
iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT
iptables -I INPUT -p udp --dport 1194 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to <external-IP-of-my-server>

Where is the problem?

Best Answer

You can try to debug using traceroute tools (on Windows, it's named tracert I think). See where the packet is blocked: if your server internal IP 10.8.0.1 appears (and then the packet is lost), something is wrong with IP forwarding (routing table on server, NAT). If the server IP doesn't appear, then you either have an issue with firewall on the server or with the client.

If you can provide the routing tables for both client and server, and use ping to verify reachability between client and server inside VPN (after adding an iptables rule to allow ICMP on server), it would be better.

Related Topic