I'm currently working on a homelab project and built a home server using VMWare ESXI 7. On this Hypervisor i run two ubuntu 22.04 server images, one for file sharing and one to serve as a vpn server.
My goal is to be able to remotely access my homenetwork from my laptop. That's why I tried to setup a vpn server using openvpn.
In order to set-up my vpn I used the following script I found on github : https://github.com/angristan/openvpn-install
Despite the script working completely fine I'm unable to establish a connection between my client and the server.
Client log :
client log(coudn't post those in text format because of the spam warning)
And server logs :
Fragment of server logs (coudn't post those in text format because of the spam warning)
I've tried connecting both from within and from outside (phone network sharing) my home network and got those exact same result each time.
Since my vpn server is behind a NAT I have two ipv4 addresses :
here is the $ ip result :
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:0c:29:6a:f0:7c brd ff:ff:ff:ff:ff:ff
altname enp3s0
inet 192.168.1.30/24 metric 100 brd 192.168.1.255 scope global dynamic ens160
valid_lft 82561sec preferred_lft 82561sec
inet6 2a01:cb10:590:cb00:20c:29ff:fe6a:f07c/64 scope global dynamic mngtmpaddr noprefixroute
valid_lft 86378sec preferred_lft 578sec
inet6 fe80::20c:29ff:fe6a:f07c/64 scope link
valid_lft forever preferred_lft forever
3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 500
link/none
inet 10.8.0.1/24 scope global tun0
valid_lft forever preferred_lft forever
inet6 fd42:42:42:42::1/112 scope global
valid_lft forever preferred_lft forever
inet6 fe80::3fb6:59d8:f6a4:278d/64 scope link stable-privacy
valid_lft forever preferred_lft forever
And when I interrogate the opendns i get this :
Using domain server:
Name: resolver1.opendns.com
Address: 208.67.222.222#53
Aliases:
myip.opendns.com has address A.B.C.D
However this parameter seemed to have been taken into account in the script aforementionned and all config files look Ok.
My openvpn server config looks liks this :
port 1194
proto udp6
dev tun
user nobody
group nogroup
persist-key
persist-tun
keepalive 10 120
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 94.140.14.14"
push "dhcp-option DNS 94.140.15.15"
push "redirect-gateway def1 bypass-dhcp"
server-ipv6 fd42:42:42:42::/112
tun-ipv6
push tun-ipv6
push "route-ipv6 2000::/3"
push "redirect-gateway ipv6"
dh none
ecdh-curve prime256v1
tls-crypt tls-crypt.key
crl-verify crl.pem
ca ca.crt
cert server_G6hxio5CQJ6lKNV4.crt
key server_G6hxio5CQJ6lKNV4.key
auth SHA256
cipher AES-128-GCM
ncp-ciphers AES-128-GCM
tls-server
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
client-config-dir /etc/openvpn/ccd
status /var/log/openvpn/status.log
verb 3
Iptables :
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE all -- * ens160 10.8.0.0/24 0.0.0.0/0
and
#!/bin/sh
iptables -t nat -I POSTROUTING 1 -s 10.8.0.0/24 -o ens160 -j MASQUERADE
iptables -I INPUT 1 -i tun0 -j ACCEPT
iptables -I FORWARD 1 -i ens160 -o tun0 -j ACCEPT
iptables -I FORWARD 1 -i tun0 -o ens160 -j ACCEPT
iptables -I INPUT 1 -i ens160 -p udp --dport 1194 -j ACCEPT
ip6tables -t nat -I POSTROUTING 1 -s fd42:42:42:42::/112 -o ens160 -j MASQUERADE
ip6tables -I INPUT 1 -i tun0 -j ACCEPT
ip6tables -I FORWARD 1 -i ens160 -o tun0 -j ACCEPT
ip6tables -I FORWARD 1 -i tun0 -o ens160 -j ACCEPT
ip6tables -I INPUT 1 -i ens160 -p udp --dport 1194 -j ACCEPT
I checked the ip forwarding and it seems to be properly enabled.
The server status is ok :
● openvpn@server.service - OpenVPN connection to server
Loaded: loaded (/etc/systemd/system/openvpn@.service; enabled; vendor preset: enabled)
Active: active (running) since Fri 2022-08-05 23:26:08 UTC; 59min left
Docs: man:openvpn(8)
https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
https://community.openvpn.net/openvpn/wiki/HOWTO
Main PID: 887 (openvpn)
Status: "Initialization Sequence Completed"
Tasks: 1 (limit: 1033)
Memory: 3.1M
CPU: 77ms
CGroup: /system.slice/system-openvpn.slice/openvpn@server.service
└─887 /usr/sbin/openvpn --daemon ovpn-server --status /run/openvpn/server.status 10 --cd /etc/openvpn --script-security 2 --config /etc/openvpn/server.conf --writepid /run/openvpn/server.pid
UDPv6 link local (bound): [AF_INET6][undef]:1194
UDPv6 link remote: [AF_UNSPEC]
GID set to nogroup
UID set to nobody
MULTI: multi_init called, r=256 v=256
IFCONFIG POOL IPv4: base=10.8.0.2 size=253
IFCONFIG POOL IPv6: base=fd42:42:42:42::2 size=65534 netbits=112
NOTE: IPv4 pool size is 253, IPv6 pool size is 65534. IPv4 pool size limits the number of clients
that can be served from the pool
IFCONFIG POOL LIST
Initialization Sequence Completed
I did find quite a few anomalies (blocked home network requests) in the ufw log however whitelisting the homenetwork ip addresses did nothing.
In addition I tried connecting whith all firewalls disabled (client server and isp box) but it didn't solved the problem.
Supprisingly when I used nmap on my public ip address using the port 1194 and it worked :
Starting Nmap 7.80 ( https://nmap.org ) at 2022-08-06 00:35 CEST
Nmap scan report for areims-XXX-X-XX-XXX.wXX-XXX.abo.wanadoo.fr (A.B.C.D)
Host is up (0.0048s latency).
PORT STATE SERVICE
1194/udp open|filtered openvpn
Nmap done: 1 IP address (1 host up) scanned in 0.38 seconds
The nmap result is the same from within and outside the home network.
So yeah, I tried quite a few things to troubleshoot this vpn with no luck. I didn't managed to get a connection. So if you have an idea or if you need some further information let me know.
Thanks a lot!
