I've looked at a lot of different pages on this site and in other places but I couldn't find any solution to this problem I've spent the afternoon on.
I want to setup an OpenVPN server on a VPS CentOS 6.5 machine. I have successfully done that and I'm able to establish a tunnel to the server, ping the remote gateway IP address etc. However I am unable to reach Internet from the VPN. After a lot of time troubleshooting the OpenVPN configuration, I believe the issue comes from the VPS itself since the tun0 interface itself can't reach Internet (so it can't very well route it!).
If I try to reach Internet from the tun0 (OpenVPN) interface, it doesn't work:
[root@vps3580 ~]# ping -I tun0 8.8.8.8
PING 8.8.8.8 (8.8.8.8) from 10.44.3.1 tun0: 56(84) bytes of data.
--- 8.8.8.8 ping statistics ---
6 packets transmitted, 0 received, 100% packet loss, time 5301ms
If I ping from the default interface (venet0:0) it works fine:
[root@vps3580 ~]# ping -I venet0:0 8.8.8.8
Warning: cannot bind to specified iface, falling back: No such device
PING 8.8.8.8 (8.8.8.8) from 37.187.42.146 venet0:0: 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=49 time=10.0 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=49 time=10.0 ms
--- 8.8.8.8 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1793ms
rtt min/avg/max/mdev = 10.038/10.056/10.074/0.018 ms
This is what my ifconfig looks like (I modified the public IP for this post) :
[root@vps3580 ~]# ifconfig
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:5013190 errors:0 dropped:0 overruns:0 frame:0
TX packets:5013190 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:677461812 (646.0 MiB) TX bytes:677461812 (646.0 MiB)
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.44.3.1 P-t-P:10.44.3.2 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:2004 errors:0 dropped:0 overruns:0 frame:0
TX packets:1287 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:223030 (217.8 KiB) TX bytes:329848 (322.1 KiB)
venet0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:127.0.0.1 P-t-P:127.0.0.1 Bcast:0.0.0.0 Mask:255.255.255.255
inet6 addr: 2001:41d0:52:100::e84/56 Scope:Global
UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1
RX packets:1027193 errors:0 dropped:0 overruns:0 frame:0
TX packets:878383 errors:0 dropped:318 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:508829024 (485.2 MiB) TX bytes:133008265 (126.8 MiB)
venet0:0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:73.83.42.22 P-t-P:73.83.42.22 Bcast:37.187.43.255 Mask:255.255.252.0
UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1
And my routes:
[root@vps3580~]# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.44.3.2 * 255.255.255.255 UH 0 0 0 tun0
10.44.3.0 10.44.3.2 255.255.255.248 UG 0 0 0 tun0
73.83.42.22 * 255.255.252.0 U 0 0 0 venet0
link-local * 255.255.0.0 U 0 0 0 *
link-local * 255.255.0.0 U 1002 0 0 venet0
198.18.0.0 * 255.254.0.0 U 0 0 0 *
172.16.0.0 * 255.240.0.0 U 0 0 0 *
default * 255.0.0.0 U 0 0 0 *
default * 0.0.0.0 U 0 0 0 venet0
I suspect there is something wrong with one of the route but I can't figure out what. When I traceroute I get this:
[root@vps3580~]# traceroute -i tun0 8.8.8.8
traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets
1 * * *
2 * * *
3 * * *
4 * * *
5 * * *
6 * * *
7 * * *
8 * * *
9 * * *
10 * * *
[...]
30 * *
I'm not familiar with "tun" interfaces and I've been struggling with this for hours and was really hoping somebody could help me troubleshoot this!
Edit: Firewall rules:
[root@vps3580~]# iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i venet0 -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT
-A INPUT -i venet0 -p tcp -m tcp --dport 443 -m state --state NEW -j ACCEPT
-A INPUT -i venet0 -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT
-A INPUT -i venet0 -p udp -m udp --dport 1194 -m state --state NEW -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.44.3.0/29 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
I found the answer. It was, in fact, a firewall problem. OpenVZ doesn't support MASQUERADE, you need to use SNAT.
This won't work:
But this will work:
Did you check the firewall configuration?
iptables -SIn
iptables, if you have INPUT or OUTPUT default policies set to DROP, you will need will need to open the ports and allow access to the devices using iptables rules.The CentOS wiki has a full walkthrough of iptables.
2014-04-16 Edit: Do you want to route all traffic over tun0?
On CentOS 7 works