Tunnel connected but no internet

[ghost]

Ran the setup.sh script on a fresh install of Ubuntu Server 17.04 with no modifications to anything. I'm able to successfully connect to the VPN server but there's no traffic passing through the tunnel.

The VPN server is a virtual machine running on Vmware Workstation Pro 12.5.7. The virtual network adapter is set to bridge mode and it's pulling it's own IP address from the router.

iptables -L output:

Chain INPUT (policy ACCEPT)
target prot opt source destination
DROP all -- anywhere anywhere state NEW recent: UPDATE seconds: 60 hit_count: 12 name: DEFAULT side: source mask: 255.255.255.255
all -- anywhere anywhere state NEW recent: SET name: DEFAULT side: source mask: 255.255.255.255
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
DROP all -- anywhere anywhere state INVALID
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
ACCEPT udp -- anywhere anywhere udp dpt:isakmp
ACCEPT udp -- anywhere anywhere udp dpt:ipsec-nat-t
DROP all -- anywhere anywhere

Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- 10.10.10.0/24 anywhere policy match dir in pol ipsec proto esp
ACCEPT all -- anywhere 10.10.10.0/24 policy match dir out pol ipsec proto esp
DROP all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

/etc/ipsec.conf

config setup
strictcrlpolicy=yes
uniqueids=never

conn roadwarrior
auto=add
compress=no
type=tunnel
keyexchange=ikev2
fragmentation=yes
forceencaps=yes
ike=aes256gcm16-sha256-ecp521,aes256-sha256-ecp384!
esp=aes256gcm16-sha256!
dpdaction=clear
dpddelay=180s
rekey=no
left=%any
leftid=@[server hostname]
leftcert=cert.pem
leftsendcert=always
leftsubnet=0.0.0.0/0
right=%any
rightid=%any
rightauth=eap-mschapv2
eap_identity=%any
rightdns=8.8.8.8,8.8.4.4
rightsourceip=10.10.10.0/24
rightsendcert=never

truncated and sanitised /var/log/syslog

Aug 26 04:12:08 VPN charon: 05[NET] received packet: from [client][500] to [server][500] (300 bytes)
Aug 26 04:12:08 VPN charon: 05[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(REDIR_SUP) N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) ]
Aug 26 04:12:08 VPN charon: 05[IKE] [client] is initiating an IKE_SA
Aug 26 04:12:08 VPN charon: 05[IKE] local host is behind NAT, sending keep alives
Aug 26 04:12:08 VPN charon: 05[IKE] remote host is behind NAT
Aug 26 04:12:08 VPN charon: 05[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(MULT_AUTH) ]
Aug 26 04:12:08 VPN charon: 05[NET] sending packet: from [server][500] to [client][500] (316 bytes)
Aug 26 04:12:08 VPN charon: 03[NET] received packet: from [client][4500] to [server][4500] (352 bytes)
Aug 26 04:12:08 VPN charon: 03[ENC] unknown attribute type (25)
Aug 26 04:12:08 VPN charon: 03[ENC] parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) N(MOBIKE_SUP) IDr CPRQ(ADDR DHCP DNS MASK ADDR6 DHCP6 DNS6 (25)) N(ESP_TFC_PAD_N) N(NON_FIRST_FRAG) SA TSi TSr N(EAP_ONLY) ]
Aug 26 04:12:08 VPN charon: 03[CFG] looking for peer configs matching [server][server host name]...[client][server hostname]
Aug 26 04:12:08 VPN charon: 03[CFG] selected peer config 'roadwarrior'
Aug 26 04:12:08 VPN charon: 03[IKE] initiating EAP_IDENTITY method (id 0x00)
Aug 26 04:12:08 VPN charon: 03[IKE] received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding
Aug 26 04:12:08 VPN charon: 03[IKE] peer supports MOBIKE
Aug 26 04:12:08 VPN charon: 03[IKE] authentication of 'server hostname' (myself) with RSA signature successful
Aug 26 04:12:08 VPN charon: 03[IKE] sending end entity cert "CN=server hostname"
Aug 26 04:12:08 VPN charon: 03[IKE] sending issuer cert "C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3"
Aug 26 04:12:08 VPN charon: 03[ENC] generating IKE_AUTH response 1 [ IDr CERT CERT AUTH EAP/REQ/ID ]
Aug 26 04:12:08 VPN charon: 03[ENC] splitting IKE message with length of 3337 bytes into 3 fragments
Aug 26 04:12:08 VPN charon: 03[ENC] generating IKE_AUTH response 1 [ EF(1/3) ]
Aug 26 04:12:08 VPN charon: 03[ENC] generating IKE_AUTH response 1 [ EF(2/3) ]
Aug 26 04:12:08 VPN charon: 03[ENC] generating IKE_AUTH response 1 [ EF(3/3) ]
Aug 26 04:12:08 VPN charon: 03[NET] sending packet: from [server][4500] to [client][4500] (1248 bytes)
Aug 26 04:12:08 VPN charon: 03[NET] sending packet: from [server][4500] to [client][4500] (1248 bytes)
Aug 26 04:12:08 VPN charon: 03[NET] sending packet: from [server][4500] to [client][4500] (967 bytes)
Aug 26 04:12:08 VPN charon: 06[NET] received packet: from [client][4500] to [server][4500] (72 bytes)
Aug 26 04:12:08 VPN charon: 06[ENC] parsed IKE_AUTH request 2 [ EAP/RES/ID ]
Aug 26 04:12:08 VPN charon: 06[IKE] received EAP identity 'VPNuser'
Aug 26 04:12:08 VPN charon: 06[IKE] initiating EAP_MSCHAPV2 method (id 0x2C)
Aug 26 04:12:08 VPN charon: 06[ENC] generating IKE_AUTH response 2 [ EAP/REQ/MSCHAPV2 ]
Aug 26 04:12:08 VPN charon: 06[NET] sending packet: from [server][4500] to 10[client][4500] (97 bytes)
Aug 26 04:12:08 VPN charon: 04[NET] received packet: from [client][4500] to [server][4500] (128 bytes)
Aug 26 04:12:08 VPN charon: 04[ENC] parsed IKE_AUTH request 3 [ EAP/RES/MSCHAPV2 ]
Aug 26 04:12:08 VPN charon: 04[ENC] generating IKE_AUTH response 3 [ EAP/REQ/MSCHAPV2 ]
Aug 26 04:12:08 VPN charon: 04[NET] sending packet: from [server][4500] to [client][4500] (134 bytes)
Aug 26 04:12:08 VPN charon: 08[NET] received packet: from [client][4500] to [server][4500] (72 bytes)
Aug 26 04:12:08 VPN charon: 08[ENC] parsed IKE_AUTH request 4 [ EAP/RES/MSCHAPV2 ]
Aug 26 04:12:08 VPN charon: 08[IKE] EAP method EAP_MSCHAPV2 succeeded, MSK established
Aug 26 04:12:08 VPN charon: 08[ENC] generating IKE_AUTH response 4 [ EAP/SUCC ]
Aug 26 04:12:08 VPN charon: 08[NET] sending packet: from [server][4500] to [client][4500] (65 bytes)
Aug 26 04:12:08 VPN charon: 09[NET] received packet: from [client][4500] to [server][4500] (104 bytes)
Aug 26 04:12:08 VPN charon: 09[ENC] parsed IKE_AUTH request 5 [ AUTH ]
Aug 26 04:12:08 VPN charon: 09[IKE] authentication of 'server hostname' with EAP successful
Aug 26 04:12:08 VPN charon: 09[IKE] authentication of 'server hostname' (myself) with EAP
Aug 26 04:12:08 VPN charon: 09[IKE] IKE_SA roadwarrior[3] established between [server][server hostname]...[client][server hostname]
Aug 26 04:12:08 VPN charon: 09[IKE] peer requested virtual IP %any
Aug 26 04:12:08 VPN charon: 09[CFG] reassigning offline lease to 'VPNuser'
Aug 26 04:12:08 VPN charon: 09[IKE] assigning virtual IP 10.10.10.1 to peer 'VPNuser'
Aug 26 04:12:08 VPN charon: 09[IKE] peer requested virtual IP %any6
Aug 26 04:12:08 VPN charon: 09[IKE] no virtual IP found for %any6 requested by 'VPNuser'
Aug 26 04:12:08 VPN charon: 09[IKE] CHILD_SA roadwarrior{3} established with SPIs cd9e39cb_i 0652e9db_o and TS 0.0.0.0/0 === 10.10.10.1/32
Aug 26 04:12:08 VPN charon: 09[ENC] generating IKE_AUTH response 5 [ AUTH CPRP(ADDR DNS DNS) SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) ]
Aug 26 04:12:08 VPN charon: 09[NET] sending packet: from [server][4500] to [client][4500] (229 bytes)

[ivanzor]

I have the same problem...

[yen936]

Same here

[Nisthar]

@yen936 @ivanzor same issue with Digitalocean server
@jawj any solutions?