connected to Centos openvpn but no outside internet access

Question

I am using Windows 7 to connect to a VPS server running CentOS 6.4

First off, I have read every single post and just cant find the solution to my problem

I configured my VPN server with openvpn, and finally got it working after on and off trying for 4 months now...

so I got to connect to my server which is a break through HOWEVER, I get no internet access :( I am not sure what you all need to see to be able to help but i will post what I know might be relevant

as far as I understand, I have configured openvpn correctly since I can successfully connect to the server

I do not know what firewall I am using, I guess it is called iptables

iptables

# Generated by iptables-save v1.4.7 on Thu Feb 13 17:10:07 2014
*nat
:PREROUTING ACCEPT [721:50130]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
COMMIT
# Completed on Thu Feb 13 17:10:07 2014
# Generated by iptables-save v1.4.7 on Thu Feb 13 17:10:07 2014
*filter
:INPUT DROP [886:120871]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [1209:156538]
-A INPUT -p udp --dport 1194 -j ACCEPT
-A INPUT -i tun+ -j ACCEPT
-A FORWARD -i tun+ -j ACCEPT
-A OUTPUT -m state --state NEW -o eth0 -j ACCEPT
-A FORWARD -m state --state NEW -o eth0 -j ACCEPT
-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -m comment --comment "SSH" -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5252 -m comment --comment "SecureSSH" -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -m state --state NEW,RELATED,ESTABLISHED$
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -p icmp -m icmp --icmp-type 0 -m state --state RELATED,ESTABLISHED -j$
COMMIT
# Completed on Thu Feb 13 17:10:07 2014

and

ifconfig

eth0      Link encap:Ethernet  HWaddr 00:1D:D8:B7:22:17
          inet addr:41.185.26.95  Bcast:41.185.26.255  Mask:255.255.255.0
          inet6 addr: fe80::21d:d8ff:feb7:2217/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:6598 errors:0 dropped:0 overruns:0 frame:0
          TX packets:464 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:545682 (532.8 KiB)  TX bytes:51265 (50.0 KiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:141 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:7352 (7.1 KiB)  TX bytes:0 (0.0 b)

if anyone needs anything else, just ask, I am really struggling here , I do not know what else to do...

if anyone has a suggestion, i am still a linux newbie, so please explain what I need to do and also give the code if required, I would really appreciate it

thanks in advance

i editied my iptables :)

# Generated by iptables-save v1.4.7 on Thu Feb 13 17:10:07 2014
*nat
:PREROUTING ACCEPT [721:50130]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
COMMIT
# Completed on Thu Feb 13 17:10:07 2014
# Generated by iptables-save v1.4.7 on Thu Feb 13 17:10:07 2014
*filter
:INPUT DROP [886:120871]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [1209:156538]
-A INPUT -p tcp --dport 443 -j ACCEPT
-A INPUT -i tun0 -j ACCEPT
-A FORWARD -i tun0 -o eth0 -j ACCEPT
-A FORWARD -i eth0 -o tun0 -j ACCEPT
-A OUTPUT -m state --state NEW -o eth0 -j ACCEPT
-A FORWARD -m state --state NEW -o eth0 -j ACCEPT
-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -m comment --comment "SSH" -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5252 -m comment --comment "SecureSSH" -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -m state --state NEW,RELATED,ESTABLISHED -j A$
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -p icmp -m icmp --icmp-type 0 -m state --state RELATED,ESTABLISHED -j ACCE$
COMMIT
# Completed on Thu Feb 13 17:10:07 2014

WORKING!!!

score 4 · Answer 1 · answered Feb 13 '14 at 18:31

4

As you don't mention it it's worth a shot ... did you enable ipv4 forwarding ?

sysctl net.ipv4.ip_forward=1

and if that works edit /etc/sysctl.conf and add or edit

# Controls IP packet forwarding
net.ipv4.ip_forward =1

Also check that you push a suitable route from your server,

push "redirect-gateway"

or

push "redirect-gateway def1"

answered Feb 13 '14 at 18:31

user9517

115,471
20
215
297

@lain sorry, i know its worth a try, i didnt mention it but yes, I have ipforwarding enabled, yes I have push "redirect-gateway def1" – Charlie Dyason Feb 13 '14 at 18:56
LOOOOOOOL, got it working, check update – Charlie Dyason Feb 13 '14 at 18:58

score 0 · Answer 2 · edited Jul 21 '14 at 14:31

0

You can tell the Network Manager plug-in not to route traffic through the VPN as well. There's an option under IPv4 Settings - click the Routes button and then check the box next to Use this connection only for resources on its network and see if that works.

Suranga

edited Jul 21 '14 at 14:31

Itai Ganot

10,644
29
93
146

answered Jul 21 '14 at 12:23

Suranga Kasthuriarachchi

1

good day Suranga, ty for your response, I have found the solution to the problem(which I have posted as an answer), but if i may, you are amusing that I have access to the GUI, which in this case, unfortunately i do not, but thank you in any case – Charlie Dyason Jul 22 '14 at 18:01

score 0 · Accepted Answer · answered Jul 22 '14 at 19:25

Good day all,

I AM WRITING THE AS A "TUTORIAL" FOR THOSE WHO ARE SEEKING HELP WITH IPTABLES

I have been experimenting with different rules and after lots of hearaches and iptables flushes I have figured out and also got some understanding of why I had no internet access/throughput from tun0 to the eth0 interface

/etc/sysconfig/iptables

# Generated by iptables-save v1.4.7 on Thu Feb 13 17:10:07 2014

//I speak under correction but the NAT simply routes any packets BEFORE going through the firewall, so basically, since ALL the packets are going to the server - thus it needs to go through the firewall however you can tell teh server to "place" those packets onto different interfaces (eg. eth0, tun0, wlan0)

*nat

:PREROUTING ACCEPT [721:50130]

//accepts all packets from any OUTSIDE source and doesnt route to any specific interface(same as filter INPUT)

:POSTROUTING ACCEPT [0:0]

//accepts all packets from any INSIDE IP RANGE(10.8.0.0/24) source and routes it to the interface eth0 as OUTPUT(same as filter FORWARD)

:OUTPUT ACCEPT [0:0]

//accepts all packets from any INSIDE source to the OUTSIDE and doesnt route to any specific interface(same as filter OUTPUT)

-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

//append a rule to send all post-route traffic from after the firewall, from a device with a ip address in the range of 10.8.0.0/24 (including all packets since no --sport has been added) to the interface eth0 (the interface with the live internet connection for the server)

COMMIT

# Completed on Thu Feb 13 17:10:07 2014

# Generated by iptables-save v1.4.7 on Thu Feb 13 17:10:07 2014

*filter

//all the filter does is it sorts the packets into groups(based on port numbers) and allows certain packets with the suitable port numbers through, and also allows certain packets from certain ip addresses

//NOTE: the filter works with a standard policy of ACCEPT/DROP in short(the most commonly used options), packets will be dropped based on their source/where they come from BUT, just as you have rules for the NAT, so you will also have rules for the filter

:INPUT DROP [886:120871]

//All packets COMING INTO the server will be dropped/ignored

:FORWARD DROP [0:0]

//All packets needing to be forwarded between the server interfaces will be dropped/ignored

:OUTPUT ACCEPT [1209:156538]

//The server knows that it must drop all INPUT/incoming and FORWARD/transferring packets, BUT all these rules are exceptions to the policy stated, thus these exceptions will be listed below

//All packets GOING OUT from the server will be accepted/allowed

-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT

//Allow all packets with the following criteria: incoming from port 443(HTTPS port) on the TCP protocol

-A INPUT -i tun0 -j ACCEPT

//Allow all packets with the following criteria: incoming from interface tun0 (your VPN interface)

-A FORWARD -i tun0 -o eth0 -j ACCEPT

//Allow all packets with the following criteria: transfer all packets from interface tun0 to interface eth0

-A FORWARD -i eth0 -o tun0 -j ACCEPT

//Allow all packets with the following criteria: transfer all packets from interface eth0 to interface tun0

//THESE 2 RULES ARE VERY VERY IMPORTANT to allow your clients connecting to your openvpn server to have internet access, without them, you are able to connect but wont have any internet access using openvpn

-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

//Allow all packets with the following criteria: all packets related to existing connections and/or established connections between interfaces, accept them

-A INPUT -p tcp -m tcp --dport 22 -m comment --comment "SSH" -j ACCEPT

//Allow all packets with the following criteria: incoming packets on tcp port 22 and add a comment "SSH"

-A INPUT -p tcp -m tcp --dport 5252 -m comment --comment "SecureSSH" -j ACCEPT

//Allow all packets with the following criteria: incoming packets on tcp port 5252 and add a comment "SecureSSH"

-A INPUT -p icmp -m icmp --icmp-type 8 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

//Allow all packets with the following criteria:allow all incoming new, related or established echo/ping requests

-A OUTPUT -p icmp -m icmp --icmp-type 0 -m state --state RELATED,ESTABLISHED -j ACCEPT

//Allow all packets with the following criteria:allow all outoing new, related or established echo/ping replies

//SEE THE LINK FOR LIST OF REPLIES/REQUEST TYPES/CODES - http://www.faqs.org/docs/iptables/icmptypes.html

-A INPUT -i lo -j ACCEPT

//Allow all packets with the following criteria: incoming from localhost

COMMIT

Completed on Thu Feb 13 17:10:07 2014

I hope this helps someone, and good luck to all in the future!

connected to Centos openvpn but no outside internet access

3 Answers3

//Allow all packets with the following criteria: transfer all packets from interface eth0 to interface tun0

Completed on Thu Feb 13 17:10:07 2014