Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    OpenVPN server: Can not connect to certain websites

    Scheduled Pinned Locked Moved OpenVPN
    13 Posts 4 Posters 1.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • noplanN
      noplan @Marci
      last edited by

      @marci

      DNS?

      M 1 Reply Last reply Reply Quote 0
      • M
        Marci @noplan
        last edited by

        @noplan Hi noplan, thanks for your reply. Can DNS selectively not work for certain websites?
        I am using google DNS server and since I can open most websites I was guessing that DNS is working..?

        noplanN 1 Reply Last reply Reply Quote 0
        • noplanN
          noplan @Marci
          last edited by

          @marci
          Yeah could do but unlikely,

          Do you connect your phone to the same openVpn server?

          Do u use Splitt dns for the tunnel or all traffic through the tunnel

          Screenshots of vpn config of your server would help

          Any other services like pfB runnin um your server

          M 1 Reply Last reply Reply Quote 0
          • M
            Marci @noplan
            last edited by

            @noplan
            Yes, I am connecting to the same server and I am routing all traffic through the tunnel.
            Here is the server config.

            I am not running any other services, it is a fresh install with just the server being active.

            I am clueless... Thanks for looking into it noplan!

            1 Reply Last reply Reply Quote 0
            • M
              Marci
              last edited by

              bump

              My last try to bump this thread ๐Ÿ˜–

              Any idea where else to look into would be highly appreciated.

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator @Marci
                last edited by

                @marci said in OpenVPN server: Can not connect to certain websites:

                198.18.0.75.443

                And what IP is that suppose to be exactly - it sure isn't the IP for www.digitec.ch

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                M 1 Reply Last reply Reply Quote 0
                • M
                  Marci @johnpoz
                  last edited by

                  @johnpoz
                  I thought this is the right IP:

                  ~$ ping www.digitec.ch
                  PING www.digitec.ch (198.18.0.75) 56(84) bytes of data.
                  64 bytes from 198.18.0.75 (198.18.0.75): icmp_seq=1 ttl=63 time=18.3 ms
                  

                  Isn't it?

                  NogBadTheBadN 1 Reply Last reply Reply Quote 0
                  • NogBadTheBadN
                    NogBadTheBad @Marci
                    last edited by NogBadTheBad

                    @marci said in OpenVPN server: Can not connect to certain websites:

                    www.digitec.ch

                    https://www.whatsmydns.net/#A/www.digitec.ch

                    Looks to me like there using Akamai so the address could resolve to the closet IP.

                    Andy

                    1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

                    johnpozJ 1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator @NogBadTheBad
                      last edited by johnpoz

                      @nogbadthebad said in OpenVPN server: Can not connect to certain websites:

                      https://www.whatsmydns.net/#A/www.digitec.ch

                      Very true - IP could be different depending on region.. But thing is 198.18.0.75 is not a valid IP..

                      NetRange:       198.18.0.0 - 198.19.255.255
                      CIDR:           198.18.0.0/15
                      NetName:        SPECIAL-IPV4-BENCHMARK-TESTING-IANA-RESERVED
                      Comment:        Addresses starting with "198.18." or "198.19." are set aside for use in 
                      isolated laboratory networks used for benchmarking and performance testing.  They should never 
                      appear on the Internet and if you see Internet traffic using these addresses, they are being 
                      used without permission.
                      

                      As you see from the link @NogBadTheBad posted - That IP is not returned for that fqdn for any region.

                      And 198.18.0.0/15 is listed as bogon, updated as of
                      last updated 1632473401 (Fri Sep 24 08:50:01 2021 GMT)
                      https://www.team-cymru.org/Services/Bogons/fullbogons-ipv4.txt

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      M 1 Reply Last reply Reply Quote 1
                      • M
                        Marci @johnpoz
                        last edited by

                        @johnpoz and @NogBadTheBad
                        Thank you very much for your comments.
                        I see why 198.18.0.0/15 is not an external IP address.

                        The reason why I used this IP was because I wanted to perform a packet capture to further analyze my problem and I though this was the IP for the domain I was trying to access.

                        So my packet capture data above can be ignored as it doesn't make sense.

                        Still I am not able to connect to this site when I use my pfSense OpenVPN client, whereas I am able to connect to the site when I use my OpenVPN phone client (both times to the same pfSense OpenVPN server).

                        ๐Ÿ˜•

                        Do you have any idea how I could dig into that?

                        johnpozJ 1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @Marci
                          last edited by johnpoz

                          @marci and what does the fqdn resolve too, from your ping its resolving to that

                          ping www.digitec.ch
                          PING www.digitec.ch (198.18.0.75) 56(84) bytes of data.
                          

                          So clearly your never going to be able to go there if its resolving to such an IP.

                          The other question is how and the F are you getting any response from that IP?

                          64 bytes from 198.18.0.75 (198.18.0.75): icmp_seq=1 ttl=63 time=18.3 ms

                          I guess its possible your ISP has such a network internal to their network.. That would be bad practice for sure. But it is possible - but the bigger question is how/why your resolving the fqdn to that IP in the first place? That site for sure is not being hosted on such an IP. Even if was recently decided to make that public space now, kind of how 1.1.1.1 was once not valid public IP space, and now is.

                          In the current state of deployment if that was the case - it wouldn't work for pretty much anyone because it is still listed as bogon (which do not route on the public internet - or atleast are not suppose to). And if that is the case - why has arin not updated to reflect that it is now owned by company xyz, vs still listing it as special use space.

                          if I had to take a guess to why it works when you connect via your phone to some vpn, is your phone (different dns, doh maybe) or the vpn dns is resolving it to the correct IP, while how you have pfsense setup its not resolving correctly.

                          But no your not going to get there if it resolves to that 198.18 address. Since it is not valid IP, nor is even suppose to route on the public internet.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.