Join Log in
Score:0
JoelCrypto avatar Server

No internet from OpenVPN (IPV6)

th flag
JoelCrypto

I've searched over this and this but still, I don't achieve to access Internet from VPN clients. My VPN is giving a local IPV4 (10.8.x.x) IP that allows to access local infrastructure. It allows give an IPV6 public IP. However, I cannot access internet from this ip. My ISP gives me a /64 block for my VPN (which is different from the block I have for eth0, my ISP giving a whole /56 block), here is the configuration of dhcpcd I used :

interface eth0
        ipv6rs
        ia_na 1
        ia_pd 2 tun0/0

This prefix is also written on my router page so I knew this works. ip addr gives :

2: eth0: <BROADCAST,MULTICAST,ALLMULTI,UP,LOWER_UP>
inet6 2a01:xxxx:xxxx:xxxx:db4:8d5b:2db9:41ad/64 scope global dynamic mngtmpaddr noprefixroute
   valid_lft 86362sec preferred_lft 562sec
inet6 fe80::2158:199b:59c2:aa05/64 scope link
   valid_lft forever preferred_lft forever
34: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 500
    link/none
    inet 10.8.0.1/16 scope global tun0
       valid_lft forever preferred_lft forever
    inet6 2a01:xxxx:xxxx:xxxx::1/64 scope global
       valid_lft forever preferred_lft forever
    inet6 fe80::dfd2:3a17:4381:4253/64 scope link stable-privacy
       valid_lft forever preferred_lft forever

When connecting through VPN, I can get ipv4 and ipv6 addresses but impossible to access Internet, here is my config:

group nogroup
persist-key
persist-tun
keepalive 10 120
topology subnet
server 10.8.0.0 255.255.0.0
server-ipv6 2a01:xxxx:xxxx:xxxx::/64
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 2001:4860:4860::8888"
push "dhcp-option DNS 2001:4860:4860::8844"
push "dhcp-option DNS 8.8.4.4"
push "redirect-gateway def1 bypass-dns"
push "redirect-gateway ipv6 bypass-dns"
dh none
ecdh-curve prime256v1
tls-crypt tls-crypt.key
#tls-export-cert /etc/openvpn/tempcrt
#crl-verify crl.pem
# Compress data to save bandwidth
#comp-lzo
#learn-address /etc/openvpn/learn-address
ca fullchain.crt
cert cert-server.pem
mute-replay-warnings
tls-verify /etc/openvpn/script.sh
key server-key.pem
auth SHA256
cipher AES-256-GCM
ncp-ciphers AES-256-GCM:AES-128-GCM
tls-server
tls-version-min 1.2
script-security 2
#tls-cipher TLS_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
client-config-dir /etc/openvpn/ccd
status /var/log/openvpn/status.log
log-append /var/log/openvpn/openvpn.log
verb 3
256
1 + 0
vpn
Score:0
JoelCrypto avatar Server
th flag
JoelCrypto

After many researches, here is what I find :

  1. On ipv4, I need to masquerade traffic coming from OpenVPN :

    sudo iptables -t nat -A POSTROUTING -i tun0 -s 10.8.0.0/24 -j MASQUERADE

This allows the traffic to come from your IP, this seems to be needed in ipv4.

  1. The traffic from IPv6 is working directly if your router is redirecting, which is my case. However, during tests, I was restarting OpenVPN and therefore the dhcpcd was removing the allocation and ping were not working anymore. You need to restart dhcpcd each time you restart OpenVPN as an IpV6 configuration.

  2. Finally, I have a public ipv6 address that comes that my VPN is allocating and ipv4 from the ip of my server. I don't know if ipv6 traffic comes through the VPN as well but it seems so.

This works only if your router redirects the assigned block to your machine.

+ 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.