0

I have a problem with connection with OpenVPN. I am connected to my WiFi, but no internet access, almost. I get response when ping 8.8.8.8 but not with domains like google.com etc.

I followed the guide here: https://www.ovpn.com/en/guides/debian

I used the command:

openvpn --config /etc/openvpn/ovpn.conf --daemon

And after that the connection died.

This is the output of ping, taken once I've connected to the VPN:

root@xxx:/tmp# ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=120 time=115 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=120 time=90.7 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=120 time=121 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=120 time=115 ms
64 bytes from 8.8.8.8: icmp_seq=5 ttl=120 time=149 ms
64 bytes from 8.8.8.8: icmp_seq=6 ttl=120 time=118 ms

root@xxx:/tmp# ping google.com
ping: google.com: Name or service not known

root@xxx:/tmp# ping stackoverflow.com
ping: ovpn.se: Name or service not known

And while I'm still connected, this is the content of /etc/resolv.conf (bredbandsbolaget.se is my ISP):

root@xxx:/tmp# cat /etc/resolv.conf 
# Generated by NetworkManager
search bredbandsbolaget.se
nameserver 81.26.228.3
nameserver 81.26.227.3

This is my config file:

root@xxx:/var/log# cat /etc/openvpn/ovpn.conf 
client
dev tun
remote-random

proto tcp
remote domain.com 443

remote-cert-tls server
cipher aes-256-cbc
ncp-ciphers XXX
pull

nobind
reneg-sec 432000
resolv-retry infinite

compress lzo
verb 3

persist-key
persist-tun
auth-user-pass /etc/openvpn/credentials
ca /etc/openvpn/ovpn-ca.crt
tls-auth /etc/openvpn/ovpn-tls.key 1
log /tmp/openvpn.log
script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

Log output:

Tue Mar  5 20:11:55 2019 WARNING: file '/etc/openvpn/ovpn-tls.key' is group or others accessible
Tue Mar  5 20:11:55 2019 WARNING: file '/etc/openvpn/credentials' is group or others accessible
Tue Mar  5 20:11:55 2019 OpenVPN 2.4.0 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Oct 14 2018
Tue Mar  5 20:11:55 2019 library versions: OpenSSL 1.0.2r  26 Feb 2019, LZO 2.08
Tue Mar  5 20:11:55 2019 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Tue Mar  5 20:11:55 2019 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar  5 20:11:55 2019 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar  5 20:11:55 2019 TCP/UDP: Preserving recently used remote address: [AF_INET]149.13.91.8:443
Tue Mar  5 20:11:55 2019 Socket Buffers: R=[87380->87380] S=[16384->16384]
Tue Mar  5 20:11:55 2019 Attempting to establish TCP connection with [AF_INET]149.13.91.8:443 [nonblock]
Tue Mar  5 20:11:56 2019 TCP connection established with [AF_INET]149.13.91.8:443
Tue Mar  5 20:11:56 2019 TCP_CLIENT link local: (not bound)
Tue Mar  5 20:11:56 2019 TCP_CLIENT link remote: [AF_INET]149.13.91.8:443
Tue Mar  5 20:11:57 2019 TLS: Initial packet from [AF_INET]149.13.91.8:443, sid=a2a916e3 6e86cce1
Tue Mar  5 20:11:57 2019 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Mar  5 20:11:57 2019 VERIFY OK: depth=1, C=SE, ST=Stockholm, L=Stockholm, OU=Firma David Wibergh, CN=ovpn.se ca, emailAddress=info@ovpn.se
Tue Mar  5 20:11:57 2019 Validating certificate key usage
Tue Mar  5 20:11:57 2019 ++ Certificate has key usage  00a0, expects 00a0
Tue Mar  5 20:11:57 2019 VERIFY KU OK
Tue Mar  5 20:11:57 2019 Validating certificate extended key usage
Tue Mar  5 20:11:57 2019 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Mar  5 20:11:57 2019 VERIFY EKU OK
Tue Mar  5 20:11:57 2019 VERIFY OK: depth=0, CN=vpn19.prd.frankfurt.ovpn.com
Tue Mar  5 20:11:57 2019 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Tue Mar  5 20:11:57 2019 [vpn19.prd.frankfurt.ovpn.com] Peer Connection Initiated with [AF_INET]149.13.91.8:443
Tue Mar  5 20:11:58 2019 SENT CONTROL [vpn19.prd.frankfurt.ovpn.com]: 'PUSH_REQUEST' (status=1)
Tue Mar  5 20:12:03 2019 SENT CONTROL [vpn19.prd.frankfurt.ovpn.com]: 'PUSH_REQUEST' (status=1)
Tue Mar  5 20:12:03 2019 PUSH: Received control message: 'PUSH_REPLY,ping 10,ping-restart 60,persist-key,redirect-gateway def1,explicit-exit-notify 2,comp-lzo yes,route-gateway 10.134.0.1,topology subnet,tun-ipv6,route-ipv6 2000::/3,dhcp-option DNS 2001:67c:750:1:cafe:cd45::1,dhcp-option DNS 2a07:a880:4601:10f0:cd45::1,dhcp-option DNS 46.227.67.134,dhcp-option DNS 192.165.9.158,ifconfig-ipv6 2001:978:902:1908:8bc1:ab3:5d72:cb1c/64 2001:978:902:1908::1,ifconfig 10.134.146.253 255.255.0.0,peer-id 0,cipher AES-256-GCM'
Tue Mar  5 20:12:03 2019 Option 'explicit-exit-notify' in [PUSH-OPTIONS]:5 is ignored by previous <connection> blocks 
Tue Mar  5 20:12:03 2019 Note: option tun-ipv6 is ignored because modern operating systems do not need special IPv6 tun handling anymore.
Tue Mar  5 20:12:03 2019 OPTIONS IMPORT: timers and/or timeouts modified
Tue Mar  5 20:12:03 2019 OPTIONS IMPORT: --explicit-exit-notify can only be used with --proto udp
Tue Mar  5 20:12:03 2019 OPTIONS IMPORT: compression parms modified
Tue Mar  5 20:12:03 2019 OPTIONS IMPORT: --persist options modified
Tue Mar  5 20:12:03 2019 OPTIONS IMPORT: --ifconfig/up options modified
Tue Mar  5 20:12:03 2019 OPTIONS IMPORT: route options modified
Tue Mar  5 20:12:03 2019 OPTIONS IMPORT: route-related options modified
Tue Mar  5 20:12:03 2019 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Mar  5 20:12:03 2019 OPTIONS IMPORT: peer-id set
Tue Mar  5 20:12:03 2019 OPTIONS IMPORT: adjusting link_mtu to 1627
Tue Mar  5 20:12:03 2019 OPTIONS IMPORT: data channel crypto options modified
Tue Mar  5 20:12:03 2019 Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Mar  5 20:12:03 2019 Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Mar  5 20:12:03 2019 ROUTE_GATEWAY 192.168.1.1/255.255.255.0 IFACE=wlp2s0 HWADDR=28:cf:e9:52:dc:e7
Tue Mar  5 20:12:03 2019 GDG6: remote_host_ipv6=n/a
Tue Mar  5 20:12:03 2019 ROUTE6: default_gateway=UNDEF
Tue Mar  5 20:12:03 2019 TUN/TAP device tun0 opened
Tue Mar  5 20:12:03 2019 TUN/TAP TX queue length set to 100
Tue Mar  5 20:12:03 2019 do_ifconfig, tt->did_ifconfig_ipv6_setup=1
Tue Mar  5 20:12:03 2019 /sbin/ip link set dev tun0 up mtu 1500
Tue Mar  5 20:12:03 2019 /sbin/ip addr add dev tun0 10.134.146.253/16 broadcast 10.134.255.255
Tue Mar  5 20:12:03 2019 /sbin/ip -6 addr add 2001:978:902:1908:8bc1:ab3:5d72:cb1c/64 dev tun0
Tue Mar  5 20:12:03 2019 /etc/openvpn/update-resolv-conf tun0 1500 1555 10.134.146.253 255.255.0.0 init
Tue Mar  5 20:12:03 2019 /sbin/ip route add 149.13.91.8/32 via 192.168.1.1
Tue Mar  5 20:12:03 2019 /sbin/ip route add 0.0.0.0/1 via 10.134.0.1
Tue Mar  5 20:12:03 2019 /sbin/ip route add 128.0.0.0/1 via 10.134.0.1
Tue Mar  5 20:12:03 2019 add_route_ipv6(2000::/3 -> 2001:978:902:1908::1 metric -1) dev tun0
Tue Mar  5 20:12:03 2019 /sbin/ip -6 route add 2000::/3 dev tun0
Tue Mar  5 20:12:03 2019 Initialization Sequence Completed
Tue Mar  5 20:22:25 2019 event_wait : Interrupted system call (code=4)
Tue Mar  5 20:22:25 2019 /sbin/ip route del 149.13.91.8/32
Tue Mar  5 20:22:25 2019 /sbin/ip route del 0.0.0.0/1
Tue Mar  5 20:22:25 2019 /sbin/ip route del 128.0.0.0/1
Tue Mar  5 20:22:25 2019 delete_route_ipv6(2000::/3)
Tue Mar  5 20:22:25 2019 /sbin/ip -6 route del 2000::/3 dev tun0
Tue Mar  5 20:22:25 2019 Closing TUN/TAP interface
Tue Mar  5 20:22:25 2019 /sbin/ip addr del dev tun0 10.134.146.253/16
Tue Mar  5 20:22:25 2019 /sbin/ip -6 addr del 2001:978:902:1908:8bc1:ab3:5d72:cb1c/64 dev tun0
Tue Mar  5 20:22:25 2019 /etc/openvpn/update-resolv-conf tun0 1500 1555 10.134.146.253 255.255.0.0 init
Tue Mar  5 20:22:25 2019 SIGTERM[hard,] received, process exiting

I really don't know what I could be looking into here what's wrong.

  • You said that you didn't have Internet access, but then showed a ping successfully contacting Google's nameservers. I think you meant to say that you had Internet access but without any translation of Names to IP Addresses. – roaima Mar 6 at 15:15
0

I solved my problem with adding a prepend nameserver to the dhclient.conf. Why I do not know.

prepend domain-name-servers IP1, IP2;

Under /etc/dhcp/dhclient.conf

  • You've already got nameservers in your /etc/resolv.conf. So adding them again isn't going to make any rational difference. – roaima Mar 6 at 15:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.