5

Goal: Change the network location(country) using vpn at my house.

Why: Vpn is much more secure than using proxy. It is integrated to the router. Do not want to use a shared solution such as a smart DNS solution or hidemyass.

Problem: Could establish Openvpn connection with my home router using openvpn server hosted at Azure. But can not browse pages.

Debugging:

  • Vpn Client tells the connection is established.
  • The home network could ping the server in Azure.
  • Browsing gives "Dns probe finished error"

Note: The router works with Hidemyass service using L2TP. The reason I would like to use Azure is I need a dedicated resource.

Misc:

  • Installed openVpn server both on Windows and Ubuntu.
  • I have enabled the TCP and UDP ports in the Azure server and disabled the firewall.
  • This config enables pinging from home network to Azure network. ( push "redirect-gateway def1 bypass-dhcp" )

What did I Tried

  • Installed dns server on azure part

  • Dns had forwarders configured

  • Pointed home dns in azure

  • Giving domain name removes one dns timeout when not connected to vpn.

  • Disabled the firewall at home

  • Ping to Azure gateway ip(10.8.0.1) works after vpn

  • After vpn home network can access the files in (10.8.0.1) using \10.8.0.1\vpn ( after push "redirect-gateway def1 bypass-dhcp" )

  • Ping to google ip(216.58.209.14) stops after vpn when we have push "redirect-gateway def1 bypass-dhcp" config. But I could ping azure

  • Updated ip registry for enable ipforwarding on the Azure and restarted. Even the vpn connection seems working the ip forwarding does not work.

All updates for the router

http://www.asus.com/Networking/DSLAC68U/HelpDesk_Download/?utm_source=asus-product&utm_medium=referral&utm_campaign=router

CONCEPTUAL NETWORK TOPOLOGY

enter image description here

REAL NETWORK TOPOLOGY

enter image description here

SERVER CONFIGURATION

port 1194

proto udp

dev tun

ca "C:\Program Files (x86)\OpenVPN\config\ca.crt"

cert "C:\Program Files (x86)\OpenVPN\config\server.crt"

key "C:\Program Files (x86)\OpenVPN\config\server.key"

dh "C:\Program Files (x86)\OpenVPN\config\dh1024.pem"

server 10.8.0.0 255.255.255.0

ifconfig-pool-persist ipp.txt

push "redirect-gateway def1 bypass-dhcp"

push "dhcp-option DNS 208.67.222.222"

push "dhcp-option DNS 208.67.220.220"

keepalive 10 120

comp-lzo

persist-key

persist-tun

status openvpn-status.log

verb 9

CLIENT CONFIGURATION

client

dev tun

proto udp

remote 40.121.143.153 1194

resolv-retry infinite

nobind

persist-key

persist-tun

ca "C:\Vpn\ca.crt"

cert "C:\Vpn\mike-laptop.crt"

key "C:\Vpn\mike-laptop.key"

ns-cert-type server

comp-lzo

verb 9

ERROR AT MY HOUSE BEFORE AFTER push "redirect-gateway def1 bypass-dhcp enter image description here

BEFORE AND AFTER VPN enter image description here

ROUTING TABLE AT HOME enter image description here

ROUTING TABLE AT AZURE enter image description here

References:

Asus Router DSL-AC68U

https://www.asus.com/Networking/DSLAC68U/

Improve this question
5
  • Can you please describe your problem better? We don't know what your openvpn configuration contains, we don't know your servers details (IP address, version of software running, ...), we don't know anything about your router configuration. Your screenshots don't contain any useful information.
    – Lætitia
    Dec 3, 2015 at 11:25
  • Tonin thanks for the feedback. Just updated the post.
    – Rıfat Erdem Sahin
    Dec 3, 2015 at 11:51
  • After reading this marguspala.com/… removed "redirect-gateway def1" from server to the client. We now do not get dns probe finished error but not using the gateway
    – Rıfat Erdem Sahin
    Dec 3, 2015 at 22:32
  • If you disable redirect-gateway def1 then your DNS probe is not using the VPN.
    – dotvotdot
    Dec 4, 2015 at 17:00
  • Moving this parameter on to the client config enables me to ping google from the client and also could ping azure. But the traffic does not go over vpn
    – Rıfat Erdem Sahin
    Dec 5, 2015 at 7:56

2 Answers 2

Reset to default
1

This is one possible answer (not covered by your question):

  • Enable IP_Forwarding on the Azure Server.

Use Regedit:

  • Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
  • Select key IPEnableRouter REG_DWORD
  • Modify value = Hexadecimal 1
  • Reboot server

Note: This Registry key may not be the same for your version of Windows but you will still need to make sure IP_Forwarding is enabled on your server.

Improve this answer
6
  • tried that and it did not work.
    – Rıfat Erdem Sahin
    Dec 4, 2015 at 21:46
  • So you had not enabled IP_Forwarding before hand ?
    – dotvotdot
    Dec 5, 2015 at 0:58
  • I phrased it wrong. After your post I tried it but it did not work. The vpn connects I could access the resources in the Azure and could ping azure but can not redirect my internet traffic to Azure.
    – Rıfat Erdem Sahin
    Dec 5, 2015 at 6:17
  • Do you have access to netsh.exe on your Server machine ?
    – dotvotdot
    Dec 5, 2015 at 23:31
  • Yes. I am the local admin on that machine
    – Rıfat Erdem Sahin
    Dec 6, 2015 at 4:17
1

the openvpn created a new network interface tap/tun. After telling the interface auto assign dns and ip address the issue was solved.Now connected via vpn.

enter image description here

Improve this answer
5
  • Is everything solved ?
    – dotvotdot
    Dec 7, 2015 at 4:04
  • Other than performance it is working
    – Rıfat Erdem Sahin
    Dec 7, 2015 at 5:08
  • It is worth noting: On Windows (as VPN server or client) the Windows DHCP Client Service is required to assign IP addresses to the Tun or Tap interface.
    – dotvotdot
    Dec 7, 2015 at 22:01
  • True for dns probing to work over
    – Rıfat Erdem Sahin
    Dec 8, 2015 at 5:05
  • Performance problem solved after removing the debug parameters...But there is room to improve.
    – Rıfat Erdem Sahin
    Dec 24, 2015 at 9:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .