No internet connection on iPhone after successful connection to VPN server Scaleway #1130
Comments
amarCosmospace
changed the title
|
Are you able to connect to an IP address directly? Try browsing to Please include the portion of the installation log directly below where it says |
|
using safari on my iphone and browsing to 1.1.1.1 keeps the page loading and shows nothing. i'm adding the logs. There is no error in the install process i think |
|
While I don't think DNS is the problem, could you SSH in to the server and then post the output of |
|
here what i got Sep 27 13:51:59 algo dnscrypt-proxy[3608]: dnscrypt-proxy 2.0.16 |
|
Thanks, that looks normal. The reason I was curious to see it was because you mentioned using 8.8.8.8 for DNS. FYI, if you leave the default setting of So DNS is configured properly, but I don't know why you can't connect through IPsec when using Scaleway. |
|
I guess the question is, what do you mean by "I use 8.8.8.8 as the DNS resolver". Did you edit config.cfg, or...? Also, what does |
|
@TC1977 no i didn't change it in the config file. But just in the wifi parameters. I've tried with and without it. @davidemyers i've also tried with the default configuration and i got the same issue that's wierd |
|
@amarCosmospace Sorry, autocorrect messed things up for me. I meant Also make sure you're connected to the VPN with at least one client when you type that. It should show at least one tunnel open. |
|
Yes no problem :) he it is. i'm connected with my iphone on the vpn |
|
@amarCosmospace Good, so the ipsec tunnel is up. Try loading some websites, then hit If this doesn't show any problems, then the next step would be checking your firewalls, both on your Algo server/Scaleway console and on the Mac. |
|
i tried to reach whoer.net and it keeps loading and never shows up. And the tail gave me file does not exist. |
|
You still show no bytes transferred. So this is a problem with either the Scaleway instance firewall, the Algo firewall, or your Mac. Check your Scaleway console and make sure ports UDP/500 and UDP/4500 are open. (I can't help you with that...no Scaleway account.) Actually check that, if those ports were closed then you wouldn't be able to even open a tunnel. Try googling the strongswan docs? |
|
Ok @amarCosmospace , I checked out this error in the strongswan docs. Try this: Then modify the file by inserting the line |
|
@TC1977 i've checked scaleway conf and this vps is widely open so no firewall for testing purpose. i've tried what are saying and it doesnt seem to work... that's wierd |
|
@amarCosmospace Huh. The next step would be to |
|
I'm with lte from the beginning of the test and tried from an hotel and from home :) i'll try a reboot and see how it's going thanks for your help :) |
|
After a reboot it's the same with 4G (lte)... it think there is an issue with scaleway |
|
@amarCosmospace if you read down to the end of the link I posted above, the guy had inadvertently set a firewall on his OVH console. I wonder if you've set a firewall on the security group on your Scaleway console somehow. Are you getting any error messages from the window showing |
|
I've edited the firewall policy to accept all on inbound and outbound so no firewall at all the tail gave me this
|
|
Add specific rules in that Scaleway console to accept TCP/22, UDP/500 and UDP/4500 inbound, and accept all ports outbound. If you're going to use Wireguard, also add a rule for UDP/51820 inbound. I guess your syslog isn't at |
|
Done and rebooted and test with lte (tried to reach whoer.net on google |
|
So your tunnel is still open, but no packets transferred? The next question is if iptables on your server is incorrect somehow. Do this on your Algo server, and post the output: |
|
seems good 🤔 |
|
Those iptables rules all look correct to me. One thing is bothering me. Why don't you have anything in |
|
Maybe your rsyslogd is down for some bizarre reason. Try using journalctl instead: |
|
it's a there is no error or suspect thing on the "sudo journalctl -u strongswa". i've installed rsyslogd cause it seems that it's not installed yet on this image. |
|
|
it always retry to send the packets and fail.... |
|
SSH in with another connection, leaving the window with |
|
@amarCosmospace All the logs you have there look like everything is working correctly. The only idea I have at this point is an MTU issue. Check out https://github.com/trailofbits/algo/blob/master/docs/troubleshooting.md#various-websites-appear-to-be-offline-through-the-vpn and also #1066 |
|
@TC1977 will give a try when i get some spare time, sorry 👍 |
|
I have done a retry on Scaleway - I do local installation from inside Scaleway instance. OS is Ubuntu 16.04. There is in fact something related to MTU as ping with MTU 1500 does not work. After reducing the MTU to values accepted I start to see difference in bytes sent/received. I have chosen max_mss: 1345, but I think low 14xx should also be fine with my basic tests Websites started to work using their IPs (like 1.1.1.1), but DNS resolution does not work and I have no idea how to trace it - could you give me any help? I see that dnscrypt-proxy fails and service cannot be started with error: [EDIT] It seems that I had to update |
|
@noofaq Ubuntu 16.04 is not supported. Use Ubuntu 18.04. |
|
@davidemyers I would love to use it, but on Scaleway 18.04 it is not available (at least for now) in smallest instance size (START1-XS) which is perfectly sufficient for my very little needs. AlgoVPN seems to work after changing MTU and mentioned dnscrypt-proxy configuration |
|
I'm facing similar issue, I can connect but websites don't load, some packets of messaging apps go through though. the output of iptables -S is when I clear the iptables it works, but the settings above come back and then it does not work anymore, my guess is that there are iptable rules that result in packets dropped which should not get dropped |
|
I'm not sure if it's related, but I've been trying Algo for the past few days and the VPN works absolutely great for a few hours and then websites just stop loading even if I'm able to successfully connect to the VPN. I've tried Lightsail, Digital Ocean, and Vultr and it's the same issue everywhere. The issues persists even after a system reboot. I still haven't deleted an instance which is misbehaving, so please let me know if there are some logs that would help debug the issue. |
|
I'm not on scaleaway but same issue here with both latest macos and ios clients: they both connect to the algo server but no DNS requests go through I tried changing only "workaround" I've found so far is to set |
|
@kristallizer @sid77 The general troubleshooting steps I'd check out while SSH'd into the Algo server are: |
dnscrypt-proxy was enabled and running, now I've stopped it since setting
not using it atm
working
all working
tried this as well, no effect |
@sid77 What do you mean by this? You initially deployed with Changing the setting on the config.cfg file won't change anything on an existing server after you've already deployed. |
this solves my issue as well (on ubuntu 18.04 on Hetzner install) but ideally this should not be necessary I guess? |
|
@TC1977 dnsmasq is getting killed on the VPN deployed with Trying to bring it back up also fails... |
|
@kristallizer Thanks for posting that output. Here's something to try to possibly get things going again and narrow down the issue: Remove (or move) the file: Run: Run: (Edited to add |
|
OK, I think it's not resource limits as I speculated above. 02:10 is when If |
|
I ran the commands mentioned in #1130 (comment) yesterday night and it started working fine again. There has been one scheduled |
|
This issue thread contains different failure reports, many of them not related to Scaleway, so I've opened a new issue #1221 to track the problem of If your problem is that you are able to connect to your VPN server but host name resolution stops working, and you have installed ad blocking with the option: Please follow the new issue. |
|
For people using Hetzner and other vendors: Check If you see IPv6 pools filling up ("virtual IP pool too large, limiting to [IPv6-address]") just open
and change this
Then restart with
I got it from here and it saved my day: |
|
The message: is actually normal and doesn't indicate a problem. Does your server have working IPv6? |
|
Looks like a dnscrypt-proxy bug, I'm able to reproduce it when |
|
any fix for this on hetzner? |
Does this have anything to do with Hetzner? It seems to be an issue with Algo. My Hetzner Algo server worked flawlessly with IPv6 for ~1 year. I just re-installed it because I wanted to try out WireGuard, and now VPN clients have no DNS when The server itself still has perfect IPv6 connectivity. |
|
@TC1977 I am having the same issue. I am using digitalocean ubuntu 19.04 x64. It ran the algo setup correctly. I connected through my android device but i am not getting internet connection. I ran the command Its saying 0 up. even though my android is connected. |
|
@Nisthar youre adding onto an old thread with what sounds like a different problem and a different cloud provider. Want to either post on Gitter chat, or open a new issue? ...but first, make sure you’re not actually using WireGuard, as Algo now uses WireGuard on default for Android. With your Android connected, try |
|
@TC1977 sent you a msg in gitter. |
The install finished without any error. i've added the mobileconfig profile to my mac book and iphone. there are installed correctly and i use 8.8.8.8 as dns resolver. But i cant get access to the web even google or anything else.
i've tried the same configuration with digitalocean and it works perfectly. I'm using scaleway because the don't limit the bandwith.
A clear and concise description of what the bug is.
install on scaleway
Expected behavior
A clear and concise description of what you expected to happen.
Additional context
Add any other context about the problem here.
Full log
The text was updated successfully, but these errors were encountered: