OpenVPN 客户端已连接但无法访问互联网

Question

我在 centos 机器上设置了 Openvpn 服务器，我可以让客户端连接（osx），但无法访问互联网，甚至无法访问本地网络。我以为可能是 DNS，但无法通过 IP 访问任何网站。任何帮助，将不胜感激。我将在下面列出我的配置文件。

server.conf:::

port 1194 #- port
proto udp #- protocol
dev tun
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
reneg-sec 0
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh2048.pem
plugin /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so /etc/pam.d/login #- Comment this line if you are using FreeRADIUS
#plugin /etc/openvpn/radiusplugin.so /etc/openvpn/radiusplugin.cnf #- Uncomment this line if you are using FreeRADIUS
client-cert-not-required
username-as-common-name
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 5 30
comp-lzo
persist-key
persist-tun
status 1194.log
verb 3


client.conf:::

client
dev tun
proto udp
remote My server IP 1194 # - Your server IP and OpenVPN Port
resolv-retry infinite
nobind
tun-mtu 1500
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
auth-user-pass
comp-lzo
verb 3


ifconfig (client)::

    lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
    options=3<RXCSUM,TXCSUM>
    inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 
    inet 127.0.0.1 netmask 0xff000000 
    inet6 ::1 prefixlen 128 
gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
stf0: flags=0<> mtu 1280
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    ether 10:40:f3:88:27:6c 
    inet6 fe80::1240:f3ff:fe88:276c%en0 prefixlen 64 scopeid 0x4 
    inet 192.168.1.11 netmask 0xffffff00 broadcast 192.168.1.255
    media: autoselect
    status: active
p2p0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 2304
    ether 02:40:f3:88:27:6c 
    media: autoselect
    status: inactive
tun0: flags=8851<UP,POINTOPOINT,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    inet 10.8.0.6 --> 10.8.0.5 netmask 0xffffffff 
    open (pid 7494)

    ifconfig (server)::

eth0      Link encap:Ethernet  HWaddr 00:23:54:03:F2:BB
          inet addr:192.168.0.10  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: fe80::223:54ff:fe03:f2bb/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:113530 errors:0 dropped:0 overruns:0 frame:0
          TX packets:13376 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:25518343 (24.3 MiB)  TX bytes:1310138 (1.2 MiB)
          Interrupt:26 Base address:0xe000

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:6 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:828 (828.0 b)  TX bytes:828 (828.0 b)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:397 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100

Answer 1

在客户端框中，执行以下测试：

1. Ping 10.8.0.1, if not ok check client/server firewall let ICMP can pass through, then we can debug deeply.
2. Ping 192.168.0.10, if not ok check:
    A. Client routing table, where the traffic goes while destination network is 192.168.0.0/24, it should go to 10.8.0.5/tun0
    B. Server sysctl net.ipv4.ip_forward, it should be 1.
    C. Server NAT/MASQUERADE with iptables.
3. Traceroute 8.8.8.8, if not ok check which hop stopped the traffic.