Tunnel connected but no internet

[ghost]

Ran the setup.sh script on a fresh install of Ubuntu Server 17.04 with no modifications to anything. I'm able to successfully connect to the VPN server but there's no traffic passing through the tunnel.

The VPN server is a virtual machine running on Vmware Workstation Pro 12.5.7. The virtual network adapter is set to bridge mode and it's pulling it's own IP address from the router.

iptables -L output:

Chain INPUT (policy ACCEPT) target prot opt source destination
DROP all -- anywhere anywhere state NEW recent: UPDATE seconds: 60 hit_count: 12 name: DEFAULT side: source mask: 255.255.255.255 all -- anywhere anywhere state NEW recent: SET name: DEFAULT side: source mask: 255.255.255.255 ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT all -- anywhere anywhere
DROP all -- anywhere anywhere state INVALID ACCEPT tcp -- anywhere anywhere tcp dpt:ssh ACCEPT udp -- anywhere anywhere udp dpt:isakmp ACCEPT udp -- anywhere anywhere udp dpt:ipsec-nat-t DROP all -- anywhere anywhere

Chain FORWARD (policy ACCEPT) target prot opt source destination
ACCEPT all -- 10.10.10.0/24 anywhere policy match dir in pol ipsec proto esp ACCEPT all -- anywhere 10.10.10.0/24 policy match dir out pol ipsec proto esp DROP all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT) target prot opt source destination

/etc/ipsec.conf

config setup strictcrlpolicy=yes uniqueids=never

conn roadwarrior auto=add compress=no type=tunnel keyexchange=ikev2 fragmentation=yes forceencaps=yes ike=aes256gcm16-sha256-ecp521,aes256-sha256-ecp384! esp=aes256gcm16-sha256! dpdaction=clear dpddelay=180s rekey=no left=%any leftid=@[server hostname] leftcert=cert.pem leftsendcert=always leftsubnet=0.0.0.0/0 right=%any rightid=%any rightauth=eap-mschapv2 eap_identity=%any rightdns=8.8.8.8,8.8.4.4 rightsourceip=10.10.10.0/24 rightsendcert=never

truncated and sanitised /var/log/syslog

Aug 26 04:12:08 VPN charon: 05[NET] received packet: from [client][500] to [server][500] (300 bytes) Aug 26 04:12:08 VPN charon: 05[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(REDIR_SUP) N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) ] Aug 26 04:12:08 VPN charon: 05[IKE] [client] is initiating an IKE_SA Aug 26 04:12:08 VPN charon: 05[IKE] local host is behind NAT, sending keep alives Aug 26 04:12:08 VPN charon: 05[IKE] remote host is behind NAT Aug 26 04:12:08 VPN charon: 05[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(MULT_AUTH) ] Aug 26 04:12:08 VPN charon: 05[NET] sending packet: from [server][500] to [client][500] (316 bytes) Aug 26 04:12:08 VPN charon: 03[NET] received packet: from [client][4500] to [server][4500] (352 bytes) Aug 26 04:12:08 VPN charon: 03[ENC] unknown attribute type (25) Aug 26 04:12:08 VPN charon: 03[ENC] parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) N(MOBIKE_SUP) IDr CPRQ(ADDR DHCP DNS MASK ADDR6 DHCP6 DNS6 (25)) N(ESP_TFC_PAD_N) N(NON_FIRST_FRAG) SA TSi TSr N(EAP_ONLY) ] Aug 26 04:12:08 VPN charon: 03[CFG] looking for peer configs matching [server][server host name]...[client][server hostname] Aug 26 04:12:08 VPN charon: 03[CFG] selected peer config 'roadwarrior' Aug 26 04:12:08 VPN charon: 03[IKE] initiating EAP_IDENTITY method (id 0x00) Aug 26 04:12:08 VPN charon: 03[IKE] received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding Aug 26 04:12:08 VPN charon: 03[IKE] peer supports MOBIKE Aug 26 04:12:08 VPN charon: 03[IKE] authentication of 'server hostname' (myself) with RSA signature successful Aug 26 04:12:08 VPN charon: 03[IKE] sending end entity cert "CN=server hostname" Aug 26 04:12:08 VPN charon: 03[IKE] sending issuer cert "C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3" Aug 26 04:12:08 VPN charon: 03[ENC] generating IKE_AUTH response 1 [ IDr CERT CERT AUTH EAP/REQ/ID ] Aug 26 04:12:08 VPN charon: 03[ENC] splitting IKE message with length of 3337 bytes into 3 fragments Aug 26 04:12:08 VPN charon: 03[ENC] generating IKE_AUTH response 1 [ EF(1/3) ] Aug 26 04:12:08 VPN charon: 03[ENC] generating IKE_AUTH response 1 [ EF(2/3) ] Aug 26 04:12:08 VPN charon: 03[ENC] generating IKE_AUTH response 1 [ EF(3/3) ] Aug 26 04:12:08 VPN charon: 03[NET] sending packet: from [server][4500] to [client][4500] (1248 bytes) Aug 26 04:12:08 VPN charon: 03[NET] sending packet: from [server][4500] to [client][4500] (1248 bytes) Aug 26 04:12:08 VPN charon: 03[NET] sending packet: from [server][4500] to [client][4500] (967 bytes) Aug 26 04:12:08 VPN charon: 06[NET] received packet: from [client][4500] to [server][4500] (72 bytes) Aug 26 04:12:08 VPN charon: 06[ENC] parsed IKE_AUTH request 2 [ EAP/RES/ID ] Aug 26 04:12:08 VPN charon: 06[IKE] received EAP identity 'VPNuser' Aug 26 04:12:08 VPN charon: 06[IKE] initiating EAP_MSCHAPV2 method (id 0x2C) Aug 26 04:12:08 VPN charon: 06[ENC] generating IKE_AUTH response 2 [ EAP/REQ/MSCHAPV2 ] Aug 26 04:12:08 VPN charon: 06[NET] sending packet: from [server][4500] to 10[client][4500] (97 bytes) Aug 26 04:12:08 VPN charon: 04[NET] received packet: from [client][4500] to [server][4500] (128 bytes) Aug 26 04:12:08 VPN charon: 04[ENC] parsed IKE_AUTH request 3 [ EAP/RES/MSCHAPV2 ] Aug 26 04:12:08 VPN charon: 04[ENC] generating IKE_AUTH response 3 [ EAP/REQ/MSCHAPV2 ] Aug 26 04:12:08 VPN charon: 04[NET] sending packet: from [server][4500] to [client][4500] (134 bytes) Aug 26 04:12:08 VPN charon: 08[NET] received packet: from [client][4500] to [server][4500] (72 bytes) Aug 26 04:12:08 VPN charon: 08[ENC] parsed IKE_AUTH request 4 [ EAP/RES/MSCHAPV2 ] Aug 26 04:12:08 VPN charon: 08[IKE] EAP method EAP_MSCHAPV2 succeeded, MSK established Aug 26 04:12:08 VPN charon: 08[ENC] generating IKE_AUTH response 4 [ EAP/SUCC ] Aug 26 04:12:08 VPN charon: 08[NET] sending packet: from [server][4500] to [client][4500] (65 bytes) Aug 26 04:12:08 VPN charon: 09[NET] received packet: from [client][4500] to [server][4500] (104 bytes) Aug 26 04:12:08 VPN charon: 09[ENC] parsed IKE_AUTH request 5 [ AUTH ] Aug 26 04:12:08 VPN charon: 09[IKE] authentication of 'server hostname' with EAP successful Aug 26 04:12:08 VPN charon: 09[IKE] authentication of 'server hostname' (myself) with EAP Aug 26 04:12:08 VPN charon: 09[IKE] IKE_SA roadwarrior[3] established between [server][server hostname]...[client][server hostname] Aug 26 04:12:08 VPN charon: 09[IKE] peer requested virtual IP %any Aug 26 04:12:08 VPN charon: 09[CFG] reassigning offline lease to 'VPNuser' Aug 26 04:12:08 VPN charon: 09[IKE] assigning virtual IP 10.10.10.1 to peer 'VPNuser' Aug 26 04:12:08 VPN charon: 09[IKE] peer requested virtual IP %any6 Aug 26 04:12:08 VPN charon: 09[IKE] no virtual IP found for %any6 requested by 'VPNuser' Aug 26 04:12:08 VPN charon: 09[IKE] CHILD_SA roadwarrior{3} established with SPIs cd9e39cb_i 0652e9db_o and TS 0.0.0.0/0 === 10.10.10.1/32 Aug 26 04:12:08 VPN charon: 09[ENC] generating IKE_AUTH response 5 [ AUTH CPRP(ADDR DNS DNS) SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) ] Aug 26 04:12:08 VPN charon: 09[NET] sending packet: from [server][4500] to [client][4500] (229 bytes)

[ivanzor]

I have the same problem...

[yen936]

Same here

[Nisthar]

@yen936 @ivanzor same issue with Digitalocean server @jawj any solutions?