Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have setup an openvpn access server in my vps. And now l'm living China, the goverment blocks the many foreign sites such as facebook and twitter.

I can use the vpn server the cross the firewall of China to access twitter and so on through my desktop running the windows xp.

However, my laptop running xubuntu 12.04 cannot break through the national firewall. I can connnet the vpn server by the openvpn termial client in ubuntu by the command "sudo openvpn --config client.ovpn"

As the desktop works okay, I think the setting of the vpn access server is okay. Is there any sepcial setting in ubuntu client? I didn't change the configuration provided by the openvpn access server.

I googled the problem a lot, the iptables instructions made me quite confused. And I open the ip forward in ubuntu as well. Still not works.

The original route table in xubuntu:         UG    0      0        0 wlan0     U     1000   0        0 wlan0 UGH   0      0        0 wlan0   U     2      0        0 wlan0

The route table after connecting to the vpn:       UG    0      0        0 tun0         UG    0      0        0 wlan0   U     0      0        0 tun0
    46.x.x.x UGH   0      0        0 wlan0       UG    0      0        0 tun0     U     1000   0        0 wlan0 UGH   0      0        0 wlan0   U     2      0        0 wlan0

46.x.x.x is the public ip of my vps.


    server-poll-timeout 4
    remote 46.x.x.x 1194 udp
    remote 46.x.x.x 1194 udp
    remote 46.x.x.x 443 tcp
    remote 46.x.x.x 1194 udp
    remote 46.x.x.x 1194 udp
    remote 46.x.x.x 1194 udp
    remote 46.x.x.x 1194 udp
    remote 46.x.x.x 1194 udp
    dev tun
    dev-type tun
    ns-cert-type server
    reneg-sec 604800
    sndbuf 100000
    rcvbuf 100000
    # NOTE: LZO commands are pushed by the Access Server at connect time.
    # NOTE: The below line doesn't disable LZO.
    comp-lzo no
    verb 3
    setenv PUSH_PEER_INFO

I omit the ca, keys, etc.

Thanks in advance.

share|improve this question
It would help if you posted the output of openvpn and the result of telneting what you need to access – Marcelo Morales Jul 13 '12 at 21:30
@MarceloMorales Thanks. I have found out the solution. – zfz Nov 7 '12 at 11:54
up vote 1 down vote accepted

I have found out the problem! It is caused by the Chinese National Firewall.

The DNS servers in China are all polluted, so that the website such as "twitter" and "facebook" has been redirects to the non-exsits targets. Through this way, the websites cannot be access in China. See the link for DNS cache poisoning.

So using VPN server to do dns lookup can solve this problem, just adding two lines to the openvpn configuration file(client.ovpn):

up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

Also ensure the resolvconf package is installed on the client, as this script depends on it.

Now the OpenVPN access server works fine for me to break through the Chinese National Firewall.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.