4

Goal: Change the network location(country) using vpn at my house.

Why: Vpn is much more secure than using proxy. It is integrated to the router. Do not want to use a shared solution such as a smart DNS solution or hidemyass.

Problem: Could establish Openvpn connection with my home router using openvpn server hosted at Azure. But can not browse pages.

Debugging:

  • Vpn Client tells the connection is established.
  • The home network could ping the server in Azure.
  • Browsing gives "Dns probe finished error"

Note: The router works with Hidemyass service using L2TP. The reason I would like to use Azure is I need a dedicated resource.

Misc:

  • Installed openVpn server both on Windows and Ubuntu.
  • I have enabled the TCP and UDP ports in the Azure server and disabled the firewall.
  • This config enables pinging from home network to Azure network. ( push "redirect-gateway def1 bypass-dhcp" )

What did I Tried

  • Installed dns server on azure part

  • Dns had forwarders configured

  • Pointed home dns in azure

  • Giving domain name removes one dns timeout when not connected to vpn.

  • Disabled the firewall at home

  • Ping to Azure gateway ip(10.8.0.1) works after vpn

  • After vpn home network can access the files in (10.8.0.1) using \10.8.0.1\vpn ( after push "redirect-gateway def1 bypass-dhcp" )

  • Ping to google ip(216.58.209.14) stops after vpn when we have push "redirect-gateway def1 bypass-dhcp" config. But I could ping azure

  • Updated ip registry for enable ipforwarding on the Azure and restarted. Even the vpn connection seems working the ip forwarding does not work.

All updates for the router

http://www.asus.com/Networking/DSLAC68U/HelpDesk_Download/?utm_source=asus-product&utm_medium=referral&utm_campaign=router

CONCEPTUAL NETWORK TOPOLOGY

enter image description here

REAL NETWORK TOPOLOGY

enter image description here

SERVER CONFIGURATION

port 1194

proto udp

dev tun

ca "C:\Program Files (x86)\OpenVPN\config\ca.crt"

cert "C:\Program Files (x86)\OpenVPN\config\server.crt"

key "C:\Program Files (x86)\OpenVPN\config\server.key"

dh "C:\Program Files (x86)\OpenVPN\config\dh1024.pem"

server 10.8.0.0 255.255.255.0

ifconfig-pool-persist ipp.txt

push "redirect-gateway def1 bypass-dhcp"

push "dhcp-option DNS 208.67.222.222"

push "dhcp-option DNS 208.67.220.220"

keepalive 10 120

comp-lzo

persist-key

persist-tun

status openvpn-status.log

verb 9

CLIENT CONFIGURATION

client

dev tun

proto udp

remote 40.121.143.153 1194

resolv-retry infinite

nobind

persist-key

persist-tun

ca "C:\Vpn\ca.crt"

cert "C:\Vpn\mike-laptop.crt"

key "C:\Vpn\mike-laptop.key"

ns-cert-type server

comp-lzo

verb 9

ERROR AT MY HOUSE BEFORE AFTER push "redirect-gateway def1 bypass-dhcp enter image description here

BEFORE AND AFTER VPN enter image description here

ROUTING TABLE AT HOME enter image description here

ROUTING TABLE AT AZURE enter image description here

References:

Asus Router DSL-AC68U

https://www.asus.com/Networking/DSLAC68U/

  • Can you please describe your problem better? We don't know what your openvpn configuration contains, we don't know your servers details (IP address, version of software running, ...), we don't know anything about your router configuration. Your screenshots don't contain any useful information. – Tonin Dec 3 '15 at 11:25
  • Tonin thanks for the feedback. Just updated the post. – Rıfat Erdem Sahin Dec 3 '15 at 11:51
  • After reading this marguspala.com/… removed "redirect-gateway def1" from server to the client. We now do not get dns probe finished error but not using the gateway – Rıfat Erdem Sahin Dec 3 '15 at 22:32
  • If you disable redirect-gateway def1 then your DNS probe is not using the VPN. – dotvotdot Dec 4 '15 at 17:00
  • Moving this parameter on to the client config enables me to ping google from the client and also could ping azure. But the traffic does not go over vpn – Rıfat Erdem Sahin Dec 5 '15 at 7:56
1

This is one possible answer (not covered by your question):

  • Enable IP_Forwarding on the Azure Server.

Use Regedit:

  • Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
  • Select key IPEnableRouter REG_DWORD
  • Modify value = Hexadecimal 1
  • Reboot server

Note: This Registry key may not be the same for your version of Windows but you will still need to make sure IP_Forwarding is enabled on your server.

| improve this answer | |
  • tried that and it did not work. – Rıfat Erdem Sahin Dec 4 '15 at 21:46
  • So you had not enabled IP_Forwarding before hand ? – dotvotdot Dec 5 '15 at 0:58
  • I phrased it wrong. After your post I tried it but it did not work. The vpn connects I could access the resources in the Azure and could ping azure but can not redirect my internet traffic to Azure. – Rıfat Erdem Sahin Dec 5 '15 at 6:17
  • Do you have access to netsh.exe on your Server machine ? – dotvotdot Dec 5 '15 at 23:31
  • Yes. I am the local admin on that machine – Rıfat Erdem Sahin Dec 6 '15 at 4:17
1

the openvpn created a new network interface tap/tun. After telling the interface auto assign dns and ip address the issue was solved.Now connected via vpn.

enter image description here

| improve this answer | |
  • Is everything solved ? – dotvotdot Dec 7 '15 at 4:04
  • Other than performance it is working – Rıfat Erdem Sahin Dec 7 '15 at 5:08
  • It is worth noting: On Windows (as VPN server or client) the Windows DHCP Client Service is required to assign IP addresses to the Tun or Tap interface. – dotvotdot Dec 7 '15 at 22:01
  • True for dns probing to work over – Rıfat Erdem Sahin Dec 8 '15 at 5:05
  • Performance problem solved after removing the debug parameters...But there is room to improve. – Rıfat Erdem Sahin Dec 24 '15 at 9:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.