[Solved] Problem with Openvpn. Can successfullly connect and ping but can't access website or smb share

Networking
, ,
1

Hello,

I am trying to setup OpenVPN but am currently stuck.
I am connecting from laptop using mobile network, so completely separate from my home network.
I can connect to the server.
I can ping resources inside my network.
I can ping resources outside my network, both 8.8.8.8 and google.com, so it’s not DNS issue.

Looking into packet capture it looks like the devices are talking to each other. Server is responding to client hello and sending application data.

obraz
obraz1904×677 85.1 KB

And yet, it doesn’t work. :frowning:

Has anyone encountered issue like this before?

2

Oh yes,

Looking at the Wireshark capture, the packet sizes for the TLS data are smaller than the usual Ethernet MTU, so it looks like there is a smaller MTU specified on the VPN or on the interface the VPN is running on. Shouldn’t be a problem, but the hosts remote to the server side of the VPN need to know the real TCP MSS.

The ICMP fragmentation needed response looks to be in response to one of the earlier outbound TCP frames, but the timestamps between packets 21 and 23 look too short for 10.28.30.1 to be the VPN IP of the VPN server - strange.

Do these work while connected on the VPN?

  1. ping -4 -s 1200 cloudflare.com
  2. ping -4 -s 1440 cloudflare.com

If 1 does and 2 returns fragmentation needed, try OpenVPN options on the client: mssfix 1200.

If that works, then you can try increasing the value for more performance (lower per-packet overhead), but I suspect at some point arround 1330 it will break.

1 Like
3

No, both commands does not work.

5

Whats the output?

6

No response found.

obraz
obraz2542×606 85.2 KB

7

Can you screenshot the ping command and the output in the CMD window?

8

What’s the largest packet size you can ping google.com with? What if you try pinging cloudflare with a smaller size? It sounds like PMTUD is broken which points at some sort of ICMP filtering. Do you admin the firewalls on the local and remote network to check the ICMP rules?

1 Like
9

Best I can do is this:

image
image737×213 42.4 KB

ping -a -4 -s 548 google.com is the highest I can go when I try to ping google or cloudflare and get response.

No not really. Firewall rule for that interface is now allowing everything for now.

image
image1557×73 9.74 KB

I do not have Suricata set up.

I am testing Zenarmor, but I disabled the service completely for the purpose of troubleshooting this.

10

For sure looks like an MTU issue

3 Likes
11

Yeah, you are right, but it is affecting not only VPN. I checked and on my LAN, the highest I can go is 500 packet size.

image

Fixing that, will probably fix vpn as well. If I find what is it is I will report back.
Thanks for help with troubleshooting this, it gave me something to investigate and focus on.

1 Like
12

OK, after finding out that this is problem also on my LAN I focused on it.

Turns out all i needed to do was to set MTU on my WAN port to 1492. (1500 gave me instability in opening websites).

image
image1346×870 23.8 KB

After setting that value and rebooting opnsense it fixed my issue with devices connected through opnvpn.

It also fixed my issue with sometimes “sluggish” network, where some sites would open slightly longer than they should be.

Thank you very much @FunnyPossum @xzpfzxds for helping me solve this issue.

2 Likes