After connection stablished can't access any of the VPNs websites #1128
Comments
|
Can you ping the IP address of the website but not the DNS name? Can you ping the DNS name? Also please read Reporting issues. We'll see whether logs are needed after you answer the above questions. |
|
I can't do either, the only thing that resolves is the actual address of the VPN. I'll add more information as in the reporting issues section |
|
Have you built the latest openfortivpn version? Used the RPM package? |
|
Updated this information on the issue description |
|
Then I guess routing hasn't been properly set. It would be useful to see routes before/after running the VPN: |
|
They were, I verified the routes before and after the VPN starts and also initialized the openfortivpn on debug mode just to see what it did. The routes look a lot like the ones that are set up on my Windows machine when I connect using the official VPN client. Same thing with the resolv.conf file, it gets updated with two addresses for a nameserver and a search statement with lots of domains from the VPN. |
This comment was marked as off-topic.
This comment was marked as off-topic.
This comment was marked as off-topic.
This comment was marked as off-topic.
This comment was marked as off-topic.
This comment was marked as off-topic.
This comment was marked as off-topic.
This comment was marked as off-topic.
This comment was marked as off-topic.
This comment was marked as off-topic.
|
@DimitriPapadopoulos any thoughts on how can I make any discovery about this problem? I can provide the log output from pppd and also the route/interface output. |
|
You could try FortiClient in addition to openfortivpn and compare routing after starting either VPN. Possible issues:
Perhaps a detailed log ( |
|
I know for sure that I won't be using IPv6 and the official client doesn't work for some reason, it fails with the error I have the routing table from both programs (one in Linux and the other in Windows) and I'll compare them). What would be the other routing issue from what I told you about? |
|
I was worried that my requests were not being forwarded through the ppp0 interface created by openfortivpn so is there any way of debugging that? can I use iptables in some way to get more information about this problem? |
|
It could be the firewall, which doesn't allow the traffic that you would expect - either that your local iptables doesn't allow traffic to the ppp0 device, or the Fortigate at the other end of the tunnel. But if nothing is allowed per policy on the Fortigate, it wouldn't even push the routes. Maybe endpoit detection is active and the Fortigate only allows specific clients (e.g. official windows Forticlient instances) - I have no experience, but I know this feature has been added to FortiOS |
|
Indeed, endpoint detection might be the issue here. Have you tried FortiClient? |
|
@DimitriPapadopoulos, yes I tried as I wrote in the previous comment. So I happen to connect to the endpoint successfully and I do have routes configured just right. @mrbaseman I tried to disable the firewall before and even change the selinux policy to permissive but it didn't work as I was expecting. I'll try to disable the firewall and then have a look at the IP tables and maybe add a rule to the VPN interface created by openfortivpn (?). I even tried to reverse engineer the official client to see where the failure point was being thrown and I'm leaning towards the conclusion of the client not having the right set of permissions to configure routes or whatever it actually tries to do (it's very hard to read disassembled code) |
|
The Windows client relies on IPSec by default, while the Linux client is an SSL VPN. Perhaps VPN SSL is not enabled on that VPN server.
What happened since then? Upgrade of the VPN server? Upgrade of your own Linux machine? |
|
I meant that I was happy that openfortivpn was able to connect to the VPN server as the official client couldn't. Even though I connect to the VPN server successfully I'm unable to access any of the websites over that VPN for some reason. Let me show you the debug information for the openfortivpn client. Don't worry because all of the personal information is redacted in some way. openfortivpn -v
firewall configuration
|
|
That's the code that emits the if (rtfound == 0) {
// should not occur anymore unless there is no default route
log_debug("Route not found.\n");By the way, are you able to ping the DNS servers |
|
Yes, both of them are accessible by ping just fine. Interestingly, the address from that |
This comment was marked as off-topic.
This comment was marked as off-topic.
This comment was marked as off-topic.
This comment was marked as off-topic.
This comment was marked as off-topic.
This comment was marked as off-topic.
This comment was marked as off-topic.
This comment was marked as off-topic.
This comment was marked as off-topic.
This comment was marked as off-topic.
This comment was marked as off-topic.
This comment was marked as off-topic.
|
I'm enjoying quite a lot of these other comments about the same problem. Gonna try to connect again in a few hours and try to do what you did @klaverjan. |
|
Similar problem here. I am on Linux Mint. Worked fine for a few days then just stopped working suddenly. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Hi, I'm on Fedora and when connecting to a given VPN it does create a network device (ppp0), updates the routes and also prepends information on the DNS file resolve.conf with new entries. The problem is that I can't seem to access any of the services over that VPN, whenever I try to access a website that should be accessible there's no route to it.
I even tried the
tunbranch version but to no avail, it still doesn't work. If you want I can provide some logs. I tried to use two versions of the openfortivpn, the first is the package provided by my operating system (Fedora 38) with version 1.19.0 and the other I compiled myself from the branchtun(revision v1.20.4+git5.gbeefa44).I don't know the version of FortiOS on the other end of the VPN.
The text was updated successfully, but these errors were encountered: