Can't get vpn to work

[humming]

Hey

I wanted to switch from Mullvad to IVPN.
As IVPN has an official Qubes guide I tried that first (IVPN on Qubes OS - IVPN Help)

but I couldn’t get it working correctly (dns leaked)

So I tried to make it work through the mullvad guide (WireGuard on Qubes OS - Guides | Mullvad VPN)
This worked fine for me in the past ( had many connections issues but it connected)

But wg-quick for some reason refuses to work with my ivpn config files. First, I can’t start them from the home dir ( invalid name, or can’t find it). Only works when I copy them to /etc/wireguard/. But even then I can’t get Internet through the proxy VM.

Would also be nice if I can get port forwarding to work and the connection issues resolved (maybe because ICMP is disabled? I have hybrid Internet via. DSL and LTE when I force connection through DSL most issues go away(Also does blocking ICMP improve privacy?)

How do I troubleshoot this? Are there better way’s to get VPN working?

I know obviously almost nothing about networking and have wasted dozens of hours on this issue.

PLS help me.

[solene]

Hi,

If you already have the VPN configuration file, you could spin a VPN Qube with fedora-38 (latest fedora available right now) and import the configuration file in its network manager.

I wrote a bit about using wireguard this way earlier this week Wireguard VPN setup

[disp6252]

@humming

Would also be nice if I can get port forwarding to work and the connection issues resolved (maybe because ICMP is disabled? I have hybrid Internet via. DSL and LTE when I force connection through DSL most issues go away(Also does blocking ICMP improve privacy?)

With ICMP disabled you may encounter MTU issue like this one:

Mullvad Proxy-VMs suddenly stop working (except for mozilla.org, redcross.org and wikipedia.org)

So my proxy-vms have suddenly stopped working (again). They were working yesterday, but today they just don’t. I didn’t do anything I am aware of. A restart hasn’t helped. I’m using Mullvad, connecting to two different servers using Wireguard. They were set up using Mullvad’s instructions and worked perfectly for a couple of weeks. I can ping 8.8.8.8, www.google.com and 10.64.0.1 in proxy-vms and app-vms. But Firefox (in the app-vm) remains inoperative (connections time out). Bizarre fact: Fo…

More information on MTU issues:

What exactly is the MTU/MRU issue, what it is caused by and how to fix it?

[humming]

Why does mullvad recommend turning off icmp? Do their nomal clients also block it?

[humming]

do I have to modify something in the iptable rules? If I want use something other than mullvad? What dns should I put here? What is the IP address of your DNS servers? - IVPN Help

I replaced 10.64.0.1 with 172.16.0.1 (the same as in the .conf) and 10.0.254.2 but still does not work.

# replace 10.137.0.47 with the IP address of your vif* interface
virtualif=10.137.0.47
vpndns1=10.64.0.1
iptables -F OUTPUT
iptables -I FORWARD -o eth0 -j DROP
iptables -I FORWARD -i eth0 -j DROP
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS  --clamp-mss-to-pmtu
iptables -F PR-QBS -t nat
iptables -A PR-QBS -t nat -d $virtualif -p udp --dport 53 -j DNAT --to $vpndns1
iptables -A PR-QBS -t nat -d $virtualif -p tcp --dport 53 -j DNAT --to $vpndns1

I think the main issue is dns. WG seems to work ok now. But no idea how to get dns working.

[disp6252]

@humming

Why does mullvad recommend turning off icmp? Do their nomal clients also block it?

Is it a bad idea for a firewall to block ICMP?

@humming

do I have to modify something in the iptable rules?

Did you change virtualif to your VPN qube vif IP?
Also do you have Qubes OS 4.1 or Qubes OS 4.2?
If it’s Qubes 4.2 then you’ll need to use nftables instead of iptables:

[4.2] VPN configuration: iptables: No chain/target/match by that name in Qubes 4.2.rc1

Hello, I upgraded to 4.2 rc1 and I can’t get my openvpn DNS script working in the new app qubes (tried fedaora 37 and 38). Openvpn works fine, but the script that uses iptables to take over DNS requests fails. For example: # sudo iptables -t nat -A PR-QBS -i vif+ -p udp --dport 53 -j DNAT --to 10.3.0.1 iptables: No chain/target/match by that name. The VPN is working, just no automatic DNS Everything works fine on Qubes 4.2 with a fedora 36 qube restored from Qubes 4.1 backups). …

[humming]

@disp6252

network - Is it a bad idea for a firewall to block ICMP? - Information Security Stack Exchange

I would like do you hear your opinion in regards to qubes os and mullvad on this. Should I allow icmp?

@disp6252

Also do you have Qubes OS 4.1 or Qubes OS 4.2?

Still using 4.1

[humming]

@humming

do I have to modify something in the iptable rules? If I want use something other than mullvad? What dns should I put here? What is the IP address of your DNS servers? - IVPN Help

What is the “right” dns server I should put in the rules I don’t really understand

If I put 172.16.0.1 or 10.64.0.1 I get timeout error with the upstream appVM DNS server when I do dig duckduckgo.com (inside the proxyVM)

curl ip.me returns the address of the vpn server and ping 1.1.1.1 also works

[disp6252]

@humming

I would like do you hear your opinion in regards to qubes os and mullvad on this. Should I allow icmp?

There are some ICMP attacks:

Understanding ICMP: The Most Used Protocol in Networking | Infosec

But blocking all ICMP outright can break something in your connections and then you’ll be stuck figuring out why do you have problems with connection.
I’d at least allow path MTU discovery.

@humming

What is the “right” dns server I should put in the rules I don’t really understand

If I put 172.16.0.1 or 10.64.0.1 I get timeout error with the upstream appVM DNS server when I do dig duckduckgo.com (inside the proxyVM)

curl ip.me returns the address of the vpn server and ping 1.1.1.1 also works

I don’t know which IVPN DNS you should use. You can ask IVPN about it.
You can try to use public DNS (9.9.9.9 / 1.1.1.1 / 8.8.8.8 / etc) to check if the problem is with DNS server IP or somewhere else.

[humming]

@disp6252

I’d at least allow path MTU discovery.

how do I allow this in qubes firewall?

[humming]

@disp6252

I don’t know which IVPN DNS you should use. You can ask IVPN about it.
You can try to use public DNS (9.9.9.9 / 1.1.1.1 / 8.8.8.8 / etc) to check if the problem is with DNS server IP or somewhere else.

No matter what dns server I put here

@humming

vpndns1=10.64.0.1

I get timeout error with the upstream proxyVM DNS

;; communications error to 10.139.1.1#53: timed out

Should I change the dns server in the wireguard config?

[disp6252]

@humming

how do I allow this in qubes firewall?

iptables -I INPUT -p icmp --icmp-type fragmentation-needed -m state --state RELATED -j ACCEPT

@humming

I get timeout error with the upstream proxyVM DNS

Do you try to resolve DNS in your VPN qube or in the qube connected to the VPN qube?

@humming

Should I change the dns server in the wireguard config?

You should.

[humming]

@disp6252

Do you try to resolve DNS in your VPN qube or in the qube connected to the VPN qube?

both. A few hours ago I got dns in the appVM connected to the proxyVM but it just leaked DNS

I put 1.1.1.1 in the wireguard config and iptable rules but still get that error. No idea wha’s wrong now.
In new vm I also get the same error.

[disp6252]

@humming

If I put 172.16.0.1 or 10.64.0.1 I get timeout error with the upstream appVM DNS server when I do dig duckduckgo.com (inside the proxyVM)

curl ip.me returns the address of the vpn server and ping 1.1.1.1 also works

So if you dig ip.me in ProxyVM it’ll fail but if you curl ip.me it’ll work?

[humming]

ip a returns

inet 10.137.0.63/32 scope global eth0

[humming]

Yes. no Idea what’s happening

[disp6252]

What’s your ProxyVM template?

[humming]

Fedora 38. I normarly use DISP for my vpn qubes. But I also tried fresh AppVM’s

When I swap the ivpn config with a mullvad config everything works fine.
The configs have the same amount of lines and probably also characters…

When I use IVPN, wg-quick doesn’t want them from the home dir and then dig always gives timeout errors

@humming

But wg-quick for some reason refuses to work with my ivpn config files. First, I can’t start them from the home dir ( invalid name, or can’t find it). Only works when I copy them to /etc/wireguard/.

This is my ivpn config.

[Interface]
PrivateKey = X
Address = X
DNS = 172.16.0.1

[Peer]
PublicKey = X
AllowedIPs = 0.0.0.0/0,::0/0
Endpoint = xxxx:xxxx

And Mullvad is the same.
I really don’t get it

How can I troubleshoot this??
Does wireguard not apply the conf correctly somehow?

Also I can’t post any replies anymore. The forum blocks me for 12 hours

@disp6252

What do you have in ProxyVM:

iptables -L -n -v
iptables -t nat -L -n -v
ip a
cat /etc/resolv.conf

https://pastebin.com/N88ciKMC

@disp6252

Make sure that you have started an AppVM that has the Networking set to MullvadVPN, otherwise the “vif” IP address will not be visible.

I did that

This is not just an issue with ivpn. Just tried it with proton same issue. Only mullvad works

@disp6252

Your iptables rules are clearly not configured correctly.
Run these command in ProxyVM and check if DNS will work in AppVM connected to your ProxyVM:

sudo iptables -F PR-QBS -t nat
sudo iptables -A PR-QBS -t nat -i vif+ -p udp --dport 53 -j DNAT --to 1.1.1.1
sudo iptables -A PR-QBS -t nat -i vif+ -p tcp --dport 53 -j DNAT --to 1.1.1.1

Changed the dns in the wireguard config and the dns hijacking scriipt restarted and run the commands. Still no dns

@disp6252

UPD:
Also don’t add rules:

iptables -A INPUT -j DROP
iptables -A FORWARD -j DROP

I did not add these rules. Sorry did i mention that I have the ivpn-proxy behind a mullvad-proxy (with the exact mullvad setup). I only tried to get it working behind the mullvad-proxy. I guess that might be the issue? But the GUI client from IVPN worked fine. Just leaked the mullvad DNS… Almost the same as the current config…

@disp6252

And what’s the output of this command in ProxyVM now?

iptables -t nat -L PR-QBS -n -v

sudo iptables -t nat -L PR-QBS -n -v
Chain PR-QBS (1 references)
pkts bytes target prot opt in out source destination
0 0 DNAT 17 – vif+ * 0.0.0.0/0 0.0.0.0/0 udp dpt:53 to:1.1.1.1
0 0 DNAT 6 – vif+ * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 to:1.1.1.1

@humming

Changed the dns in the wireguard config and the dns hijacking scriipt restarted and run the commands. Still no dns

i changed the dns to 1.1.1.1 BTW

@disp6252

By ivpn-proxy behind a mullvad-proxy you mean setup like this?
sys-net -> sys-firewall -> mullvad-proxy -> ivpn-proxy -> test-appvm
Where mullvad-proxy and ivpn-proxy are configured to connect to mullvad and ivpn wireguard servers?
And you’ve configured mullvad-proxy and ivpn-proxy the same way but just with different IPs and keys?
Where did INPUT and FORWARD DROP iptables rules came from then?

Jup exactly

@disp6252

Where did INPUT and FORWARD DROP iptables rules came from then?

No idea. Sorry this is my first time in networking where i don’t just follow guides that just work. I really appreciate your help

@humming

I know obviously almost nothing about networking

A0:

@disp6252

Maybe the guide is outdated.

no it appears they are updating it regulary.

@disp6252

You can change it to insert to add it at the top of the chain rules:

like this i guess?

# replace 10.137.0.47 with the IP address of your vif* interface
virtualif=10.137.0.47
vpndns1=10.64.0.1
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS  --clamp-mss-to-pmtu
iptables -F OUTPUT
iptables -I FORWARD -o eth0 -j DROP
iptables -I FORWARD -i eth0 -j DROP
iptables -F PR-QBS -t nat
iptables -A PR-QBS -t nat -d $virtualif -p udp --dport 53 -j DNAT --to $vpndns1
iptables -A PR-QBS -t nat -d $virtualif -p tcp --dport 53 -j DNAT --to $vpndns1

@disp6252

Are you testing the DNS from test-appvm or from ivpn-proxy?
Because I don’t see the packets from test-appvm arriving to ivpn-proxy based on the packet counters in iptables rules for PR-QBS chain. 0 packets are received.

I tested also from the test-appvm but currently just the ivpn-proxy. I mean i am restarting all the time.

Changed it like that. With every dns set to 1.1.1.1 and also

@disp6252

sudo iptables -F PR-QBS -t nat
sudo iptables -A PR-QBS -t nat -i vif+ -p udp --dport 53 -j DNAT --to 1.1.1.1
sudo iptables -A PR-QBS -t nat -i vif+ -p tcp --dport 53 -j DNAT --to 1.1.1.1

@humming

# replace 10.137.0.47 with the IP address of your vif* interface
virtualif=10.137.0.47
vpndns1=10.64.0.1
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS  --clamp-mss-to-pmtu
iptables -F OUTPUT
iptables -I FORWARD -o eth0 -j DROP
iptables -I FORWARD -i eth0 -j DROP
iptables -F PR-QBS -t nat
iptables -A PR-QBS -t nat -d $virtualif -p udp --dport 53 -j DNAT --to $vpndns1
iptables -A PR-QBS -t nat -d $virtualif -p tcp --dport 53 -j DNAT --to $vpndns1

but still this error

;; communications error to 10.139.1.1#53: timed out

Also this time form the test-appvm

@disp6252

And what’s the output of this command in ProxyVM now?

iptables -t nat -L PR-QBS -n -v

sudo iptables -t nat -L PR-QBS -n -v
Chain PR-QBS (1 references)
pkts bytes target prot opt in out source destination
4 248 DNAT 17 – vif+ * 0.0.0.0/0 0.0.0.0/0 udp dpt:53 to:1.1.1.1
0 0 DNAT 6 – vif+ * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 to:1.1.1.1

curled ip.me this works fine for some reason

@disp6252

Can you try to setup your mullvad and ivpn ProxyVMs using Qubes-vpn-support instead of mullvad guide?
GitHub - tasket/Qubes-vpn-support: VPN configuration in Qubes OS
Wireguard VPN connections in Qubes OS · tasket/Qubes-vpn-support Wiki · GitHub

I am using this for openvpn. But is the wireguard support good enough?

@disp6252

And if you run dig ip.me then will it work or not?

does not work

@disp6252

No, you need to use:
iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

changed it like this does still not work

virtualif=10.137.0.63
vpndns1=1.1.1.1
iptables -F OUTPUT
iptables -I FORWARD -o eth0 -j DROP
iptables -I FORWARD -i eth0 -j DROP
iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -F PR-QBS -t nat
iptables -A PR-QBS -t nat -d $virtualif -p udp --dport 53 -j DNAT --to $vpndns1
iptables -A PR-QBS -t nat -d $virtualif -p tcp --dport 53 -j DNAT --to $vpndns1

@disp6252

Yes, it works for wireguard without a problem.

BTW where is taskets puplic key?

@disp6252

Yes, it works for wireguard without a problem.

I shows connection established but dig still returns nothing. So the same as the mullvad guide I guess. Curl ip.me also works… i should mention that tasket-ivpn is behind mullvad-proxy. I will convert mullvad also to tasket… wait

Tasket behind Tasket gives the same error…
Just IVPN in tasket gives also no dig reply…

[disp6252]

What do you have in ProxyVM:

iptables -L -n -v
iptables -t nat -L -n -v
ip a
cat /etc/resolv.conf

[disp6252]

Chain PR-QBS (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DNAT       17   --  *      *       0.0.0.0/0            10.139.1.1           udp dpt:53 to:10.139.1.1
    0     0 DNAT       6    --  *      *       0.0.0.0/0            10.139.1.1           tcp dpt:53 to:10.139.1.1
    0     0 DNAT       17   --  *      *       0.0.0.0/0            10.139.1.2           udp dpt:53 to:10.139.1.2
    0     0 DNAT       6    --  *      *       0.0.0.0/0            10.139.1.2           tcp dpt:53 to:10.139.1.2

Add DNS hijacking rules

Now we will add firewall rules to redirect DNS requests to 10.64.0.1 (the DNS on the VPN server) for all AppVMs that use the MullvadVPN ProxyVM.

Make sure that you have started an AppVM that has the Networking set to MullvadVPN, otherwise the “vif” IP address will not be visible.

Still in the MullvadVPN Terminal:

1. To find out your vif* IP address, run ip a | grep -i vif
2. Edit the firewall user file with nano:
   sudo nano /rw/config/qubes-firewall-user-script
3. Copy and paste the following in the bottom. Replace 10.137.0.47 with your own vif* IP address:

# replace 10.137.0.47 with the IP address of your vif* interface
virtualif=10.137.0.47
vpndns1=10.64.0.1
iptables -F OUTPUT
iptables -I FORWARD -o eth0 -j DROP
iptables -I FORWARD -i eth0 -j DROP
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS  --clamp-mss-to-pmtu
iptables -F PR-QBS -t nat
iptables -A PR-QBS -t nat -d $virtualif -p udp --dport 53 -j DNAT --to $vpndns1
iptables -A PR-QBS -t nat -d $virtualif -p tcp --dport 53 -j DNAT --to $vpndns1

4. Press Ctrl+O (Enter) and then Ctrl+X to save and exit.

Make sure that you have started an AppVM that has the Networking set to MullvadVPN, otherwise the “vif” IP address will not be visible.