3

I would like to setup a VPN server and route all the clients traffic through the VPN.

In order to do that, I run a VPN server using the OpenVPN docker image kylemanna/openvpn. My docker runs on Kubernetes and doesn't share the host network. I also added the NET_ADMIN capability and enabled privileged mode.

In order to configure my docker image as a gateway, I configured NAT (inside the docker) using iptables

iptables -I FORWARD -i tun0 -o eth0 -s 192.168.255.0/24 -m conntrack --ctstate NEW -j ACCEPT
iptables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -t nat -I POSTROUTING -o eth0 -s 192.168.255.0/24 -j MASQUERADE

Unfortunately something is going wrong. I can perfectly connects to the VPN and ping to any public IP. I can also curl to any HTTP traffic without any problems. If I curl http://ifconfig.co, I can also see that my IP changed to the IP of my server. So until here everything works as expected.

But it only works on HTTP traffic, if I try to curl google using HTTP, I got a response, but using HTTPS, I do not get any response back. I checked it out with tcpdump, and the packets arrives back on the client side.

When I curl in verbose mode google, that's what happens before it hangs:

curl -v https://www.google.com
*   Trying 172.217.20.100:443...
* TCP_NODELAY set
* Connected to www.google.com (172.217.20.100) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):

Does someone have an idea how to debug this / why HTTPS is not working while HTTP works ?

Thank you

cmoi
  • 31
  • 3
  • Likely an MTU issue... you should get an answer on https://serverfault.com – Matt Jun 18 '20 at 01:24
  • 1
    Hi, Thank you. I configured my MTU options and now it works – cmoi Jun 18 '20 at 10:39
  • 1
    Hi I am trying to do something similar - would you mind responding. I am trying to run multiple docker openvpn servers and then allow my host to communicate on each vpn connection. The openvpn dockers are setup but I am unable to route host traffic through the docker. Do you know how to do this or better yet is there a network tool like wget that could test this? – LeanMan Dec 15 '20 at 03:46

0 Answers0