OpenVPN - Internet won't work



  • Hey!

    I read this (http://forum.pfsense.org/index.php?topic=7840.msg44065) tutorial to setup a OpenVPN server on my Pfsense router.

    I can ping/acces my computers but i can't surf the net. Whats wrong?

    For route print and firewall settings look in attachments

    Client settings:

    client
    dev tun
    proto tcp
    remote 213.XXX.XXX.XXX 443
    ping 10
    resolv-retry infinite
    nobind
    persist-key
    persist-tun
    ca C:\openvpn-config\ca.crt
    cert C:\openvpn-config\ovpn_klient1.crt
    key C:\openvpn-config\ovpn_klient1.key
    ns-cert-type server
    comp-lzo
    pull
    verb 3
    cipher BF-CBC
    route-method exe
    mssfix 1200
    route-delay 2

    //EkkO



    route.txt



  • Did you remember to configure the pfSense server to push the default gateway, by adding push "redirect-gateway" to the Custom Options field?



  • @Cry:

    Did you remember to configure the pfSense server to push the default gateway, by adding push "redirect-gateway" to the Custom Options field?

    My Custom Options right now

    push "route 192.168.1.0 255.255.255.0";management 127.0.0.1 443;
    push "redirect-gateway"



  • Not related to your current problem, but you'll get MUCH better performance from your tunnel by using UDP.  Unless there's a specific reason you're using TCP 443, moving to a default UDP port would be a good idea.



  • @submicron:

    Not related to your current problem, but you'll get MUCH better performance from your tunnel by using UDP.  Unless there's a specific reason you're using TCP 443, moving to a default UDP port would be a good idea.

    I know but all ports are blocked at my school expect 80 and 443 TCP.



  • When you connect, what does your client log show?  What is the default gateway on the client after you connect?



  • @Cry:

    When you connect, what does your client log show?  What is the default gateway on the client after you connect?

    Client log in attachement.

    openVPN_log.txt



  • That log shows the new route being added, so how about providing the output of netstat -rn after the VPN tunnel is established to confirm that.

    Also, does your web browser have a proxy set?  If so you'll need to unset it to browse using your VPN.



  • @Cry:

    That log shows the new route being added, so how about providing the output of netstat -rn after the VPN tunnel is established to confirm that.

    Also, does your web browser have a proxy set?  If so you'll need to unset it to browse using your VPN.

    Output for netstat -rn in attachement.

    Thanks for helping :)

    netstat.txt


  • Rebel Alliance Developer Netgate

    Switch to manual outbound NAT and add a rule like the one that shows up for LAN that matches the subnet your OpenVPN clients will come from.



  • @jimp:

    Switch to manual outbound NAT and add a rule like the one that shows up for LAN that matches the subnet your OpenVPN clients will come from.

    I already have a rule like that, Or I misunderstand you?



  • Rebel Alliance Developer Netgate

    Ah, I missed that the first time.

    What IP scheme is on the local LAN network to the client?  192.168.1.x would be very common to have overlap and cause other problems. It may not be the case this time, but it will be a problem eventually.

    I see you have:
    push "redirect gateway";

    Change that to:
    push "redirect-gateway def1";

    See if that makes a difference.



  • @jimp:

    Ah, I missed that the first time.

    What IP scheme is on the local LAN network to the client?   192.168.1.x would be very common to have overlap and cause other problems. It may not be the case this time, but it will be a problem eventually.

    Address pool for OpenVPN Server 192.168.200.0
    Addres pool for my local connected devices are 192.168.1.0 - 192.168.1.100

    I see you have:
    push "redirect gateway";

    Change that to:
    push "redirect-gateway def1";

    See if that makes a difference.

    No difference

    Maybe i found whats wrong. When I typed in ipconfig /all in command prompt i saw that there was no default/standard gateway.

    Beskrivning . . . . . . . . . . . : TAP-Win32 Adapter OAS
    Fysisk adress . . . . . . . . . . : 00-FF-13-2F-C8-02
    DHCP aktiverat. . . . . . . . . . : Ja
    Autokonfiguration aktiverat . . . : Ja
    Länklokal IPv6-adress . . . . . . : fe80::60c6:64fb:43b6:3e99%17(Standard)
    IPv4-adress . . . . . . . . . . . : 192.168.200.6(Standard)
    Nätmask . . . . . . . . . . . . . : 255.255.255.252
    Standard-gateway. . . . . . . . . :
    DHCP-server . . . . . . . . . . . : 192.168.200.5
    DNS-servrar . . . . . . . . . . . : fec0:0:0:ffff::1%1

    Still have problem :/


  • Rebel Alliance Developer Netgate

    That doesn't really matter quite so much. The output of "route print" from a command prompt would be more informative about routes and gateways.



  • @jimp:

    That doesn't really matter quite so much. The output of "route print" from a command prompt would be more informative about routes and gateways.

    Okay, Route print in a attachment.

    routee.txt



  • DNS-servrar . . . . . . . . . . . : fec0:0:0:ffff::1%1

    Looks like your client is using an IPv6 address for DNS, that's not going to get trough the VPN tunnel since pfSense by default drops IPv6 traffic.



  • @kpa:

    DNS-servrar . . . . . . . . . . . : fec0:0:0:ffff::1%1

    Looks like your client is using an IPv6 address for DNS, that's not going to get trough the VPN tunnel since pfSense by default drops IPv6 traffic.

    I tried to turn it off without any difference. I did it by go to Start > Network > Interface (TAP-VPN) and properties then disable ipv6

    Edit: I think that all ports works fine except 80. I can play games like Trackmania over internet. But i can't play it without vpn. Somthing wrong with port 80.


Log in to reply