I am trying to forward traffic through a vpn with openvpn on a vps. I already did this successfully on an OpenVZ virtualized server in the past, but I cannot replicate the working behaviour on a new installation on a different vps. I changed provider because of reasons unimportant to this question's scope.
I can correctly connect to the vpn with my windows client, but I reach pages through my machine's public IP instead of the vps public IP.
The vps runs debian 7, 32bit. Server openvpn config:
port 1194
proto udp
dev tun
ca /etc/openvpn/easy-rsa/keys/ca.crt # generated keys
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key # keep secret
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
server 10.9.8.0 255.255.255.0 # internal tun0 connection IP
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo # Compression - must be turned on at both end
persist-key
persist-tun
push "redirect-gateway"
status log/openvpn-status.log
verb 3 # verbose mode
client-to-client
Client (Windows 7) openvpn config:
client
dev tun
proto udp
remote my-server-ip 1194
remote-random
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ca "C:\\Program Files (x86)\\OpenVPN\\config\\frankfurt\\ca.crt"
cert "C:\\Program Files (x86)\\OpenVPN\\config\\frankfurt\\nick.crt"
key "C:\\Program Files (x86)\\OpenVPN\\config\\frankfurt\\nick.key"
comp-lzo
verb 3
keepalive 10 120
route-method exe
route-delay 2
ifconfig:
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.9.8.1 P-t-P:10.9.8.2 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
venet0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:127.0.0.2 P-t-P:127.0.0.2 Bcast:0.0.0.0 Mask:255.255.255.255
inet6 addr: .../128 Scope:Global
inet6 addr: .../128 Scope:Global
inet6 addr: .../128 Scope:Global
inet6 addr: .../128 Scope:Global
inet6 addr: .../128 Scope:Global
UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1
RX packets:15332 errors:0 dropped:0 overruns:0 frame:0
TX packets:7317 errors:0 dropped:56 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:13666157 (13.0 MiB) TX bytes:762502 (744.6 KiB)
venet0:0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:my-server-ip P-t-P:my-server-ip Bcast:my-server-ip Mask:255.255.255.255
UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1
iptables -L: (rules with port 20100 are from previous experiments that have nothing to do with this)
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp dpt:20100
ACCEPT tcp -- anywhere anywhere tcp dpt:20100
ACCEPT tcp -- anywhere anywhere tcp dpt:20100
ACCEPT all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- 10.9.8.0/24 anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
iptables -L -t nat:
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
SNAT all -- anywhere anywhere to:my-server-ip
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
I already checked most discussions, forums and blog posts about this error, but couldn' quite understand what's wrong with my config.
Btw, ip_forward is 1, also in sysctl.conf.
I solved the issue by restarting the vps and re-entering all the iptables rules.