OpenVPN - Internet won't work

EkkO

Hey!

I read this (http://forum.pfsense.org/index.php?topic=7840.msg44065) tutorial to setup a OpenVPN server on my Pfsense router.

I can ping/acces my computers but i can't surf the net. Whats wrong?

For route print and firewall settings look in attachments

Client settings:

client
dev tun
proto tcp
remote 213.XXX.XXX.XXX 443
ping 10
resolv-retry infinite
nobind
persist-key
persist-tun
ca C:\openvpn-config\ca.crt
cert C:\openvpn-config\ovpn_klient1.crt
key C:\openvpn-config\ovpn_klient1.key
ns-cert-type server
comp-lzo
pull
verb 3
cipher BF-CBC
route-method exe
mssfix 1200
route-delay 2

//EkkO

firewalls.jpg_thumb
route.txt

Cry Havok

Did you remember to configure the pfSense server to push the default gateway, by adding push "redirect-gateway" to the Custom Options field?

EkkO

@Cry:

Did you remember to configure the pfSense server to push the default gateway, by adding push "redirect-gateway" to the Custom Options field?

My Custom Options right now

push "route 192.168.1.0 255.255.255.0";management 127.0.0.1 443;
push "redirect-gateway"

Not related to your current problem, but you'll get MUCH better performance from your tunnel by using UDP. Unless there's a specific reason you're using TCP 443, moving to a default UDP port would be a good idea.

EkkO

@submicron:

Not related to your current problem, but you'll get MUCH better performance from your tunnel by using UDP. Unless there's a specific reason you're using TCP 443, moving to a default UDP port would be a good idea.

I know but all ports are blocked at my school expect 80 and 443 TCP.

Cry Havok

When you connect, what does your client log show? What is the default gateway on the client after you connect?

EkkO

@Cry:

When you connect, what does your client log show? What is the default gateway on the client after you connect?

Client log in attachement.

openVPN_log.txt

Cry Havok

That log shows the new route being added, so how about providing the output of netstat -rn after the VPN tunnel is established to confirm that.

Also, does your web browser have a proxy set? If so you'll need to unset it to browse using your VPN.

EkkO

@Cry:

That log shows the new route being added, so how about providing the output of netstat -rn after the VPN tunnel is established to confirm that.

Also, does your web browser have a proxy set? If so you'll need to unset it to browse using your VPN.

Output for netstat -rn in attachement.

Thanks for helping :)

netstat.txt

jimp

Switch to manual outbound NAT and add a rule like the one that shows up for LAN that matches the subnet your OpenVPN clients will come from.

EkkO

@jimp:

Switch to manual outbound NAT and add a rule like the one that shows up for LAN that matches the subnet your OpenVPN clients will come from.

I already have a rule like that, Or I misunderstand you?

ruleOUT.jpg_thumb

jimp

Ah, I missed that the first time.

What IP scheme is on the local LAN network to the client? 192.168.1.x would be very common to have overlap and cause other problems. It may not be the case this time, but it will be a problem eventually.

I see you have:
push "redirect gateway";

Change that to:
push "redirect-gateway def1";

See if that makes a difference.

EkkO

@jimp:

Ah, I missed that the first time.

What IP scheme is on the local LAN network to the client? 192.168.1.x would be very common to have overlap and cause other problems. It may not be the case this time, but it will be a problem eventually.

Address pool for OpenVPN Server 192.168.200.0
Addres pool for my local connected devices are 192.168.1.0 - 192.168.1.100

I see you have:
push "redirect gateway";

Change that to:
push "redirect-gateway def1";

See if that makes a difference.

No difference

Maybe i found whats wrong. When I typed in ipconfig /all in command prompt i saw that there was no default/standard gateway.

Beskrivning . . . . . . . . . . . : TAP-Win32 Adapter OAS
Fysisk adress . . . . . . . . . . : 00-FF-13-2F-C8-02
DHCP aktiverat. . . . . . . . . . : Ja
Autokonfiguration aktiverat . . . : Ja
Länklokal IPv6-adress . . . . . . : fe80::60c6:64fb:43b6:3e99%17(Standard)
IPv4-adress . . . . . . . . . . . : 192.168.200.6(Standard)
Nätmask . . . . . . . . . . . . . : 255.255.255.252
Standard-gateway. . . . . . . . . :
DHCP-server . . . . . . . . . . . : 192.168.200.5
DNS-servrar . . . . . . . . . . . : fec0:0:0:ffff::1%1

Still have problem :/

jimp

That doesn't really matter quite so much. The output of "route print" from a command prompt would be more informative about routes and gateways.

EkkO

@jimp:

That doesn't really matter quite so much. The output of "route print" from a command prompt would be more informative about routes and gateways.

Okay, Route print in a attachment.

routee.txt

kpa

DNS-servrar . . . . . . . . . . . : fec0:0:0:ffff::1%1

Looks like your client is using an IPv6 address for DNS, that's not going to get trough the VPN tunnel since pfSense by default drops IPv6 traffic.

EkkO

@kpa:

DNS-servrar . . . . . . . . . . . : fec0:0:0:ffff::1%1

Looks like your client is using an IPv6 address for DNS, that's not going to get trough the VPN tunnel since pfSense by default drops IPv6 traffic.

I tried to turn it off without any difference. I did it by go to Start > Network > Interface (TAP-VPN) and properties then disable ipv6

Edit: I think that all ports works fine except 80. I can play games like Trackmania over internet. But i can't play it without vpn. Somthing wrong with port 80.