OpenVPN server: Can not connect to certain websites

[Marci]

@noplan Hi noplan, thanks for your reply. Can DNS selectively not work for certain websites?
I am using google DNS server and since I can open most websites I was guessing that DNS is working..?

[noplan]

@marci
Yeah could do but unlikely,

Do you connect your phone to the same openVpn server?

Do u use Splitt dns for the tunnel or all traffic through the tunnel

Screenshots of vpn config of your server would help

Any other services like pfB runnin um your server

[Marci]

@noplan
Yes, I am connecting to the same server and I am routing all traffic through the tunnel.
Here is the server config.

I am not running any other services, it is a fresh install with just the server being active.

I am clueless... Thanks for looking into it noplan!

[Marci]

bump

My last try to bump this thread

Any idea where else to look into would be highly appreciated.

[johnpoz]

@marci said in OpenVPN server: Can not connect to certain websites:

198.18.0.75.443

And what IP is that suppose to be exactly - it sure isn't the IP for www.digitec.ch

[Marci]

@johnpoz
I thought this is the right IP:

~$ ping www.digitec.ch
PING www.digitec.ch (198.18.0.75) 56(84) bytes of data.
64 bytes from 198.18.0.75 (198.18.0.75): icmp_seq=1 ttl=63 time=18.3 ms

Isn't it?

[NogBadTheBad]

@marci said in OpenVPN server: Can not connect to certain websites:

www.digitec.ch

https://www.whatsmydns.net/#A/www.digitec.ch

Looks to me like there using Akamai so the address could resolve to the closet IP.

[johnpoz]

@nogbadthebad said in OpenVPN server: Can not connect to certain websites:

https://www.whatsmydns.net/#A/www.digitec.ch

Very true - IP could be different depending on region.. But thing is 198.18.0.75 is not a valid IP..

NetRange:       198.18.0.0 - 198.19.255.255
CIDR:           198.18.0.0/15
NetName:        SPECIAL-IPV4-BENCHMARK-TESTING-IANA-RESERVED
Comment:        Addresses starting with "198.18." or "198.19." are set aside for use in 
isolated laboratory networks used for benchmarking and performance testing.  They should never 
appear on the Internet and if you see Internet traffic using these addresses, they are being 
used without permission.

As you see from the link @NogBadTheBad posted - That IP is not returned for that fqdn for any region.

And 198.18.0.0/15 is listed as bogon, updated as of
last updated 1632473401 (Fri Sep 24 08:50:01 2021 GMT)
https://www.team-cymru.org/Services/Bogons/fullbogons-ipv4.txt

[Marci]

@johnpoz and @NogBadTheBad
Thank you very much for your comments.
I see why 198.18.0.0/15 is not an external IP address.

The reason why I used this IP was because I wanted to perform a packet capture to further analyze my problem and I though this was the IP for the domain I was trying to access.

So my packet capture data above can be ignored as it doesn't make sense.

Still I am not able to connect to this site when I use my pfSense OpenVPN client, whereas I am able to connect to the site when I use my OpenVPN phone client (both times to the same pfSense OpenVPN server).

Do you have any idea how I could dig into that?

[johnpoz]

@marci and what does the fqdn resolve too, from your ping its resolving to that

ping www.digitec.ch
PING www.digitec.ch (198.18.0.75) 56(84) bytes of data.

So clearly your never going to be able to go there if its resolving to such an IP.

The other question is how and the F are you getting any response from that IP?

64 bytes from 198.18.0.75 (198.18.0.75): icmp_seq=1 ttl=63 time=18.3 ms

I guess its possible your ISP has such a network internal to their network.. That would be bad practice for sure. But it is possible - but the bigger question is how/why your resolving the fqdn to that IP in the first place? That site for sure is not being hosted on such an IP. Even if was recently decided to make that public space now, kind of how 1.1.1.1 was once not valid public IP space, and now is.

In the current state of deployment if that was the case - it wouldn't work for pretty much anyone because it is still listed as bogon (which do not route on the public internet - or atleast are not suppose to). And if that is the case - why has arin not updated to reflect that it is now owned by company xyz, vs still listing it as special use space.

if I had to take a guess to why it works when you connect via your phone to some vpn, is your phone (different dns, doh maybe) or the vpn dns is resolving it to the correct IP, while how you have pfsense setup its not resolving correctly.

But no your not going to get there if it resolves to that 198.18 address. Since it is not valid IP, nor is even suppose to route on the public internet.