Repository: trailofbits/algo

Issue #210: Unable to access Google or interact with GCE via the Google SDK (gcloud)
Created: 2017-01-07T07:04:25Z
OS / Environment
Ubuntu 16.04.1 LTS
Ansible version
2.2.0.0
Version of components from requirements.txt
Name: boto
Version: 2.38.0
Name: dopy
Version: 0.3.5
Name: azure
Version: 2.0.0rc5
Name: apache-libcloud
Version: 1.5.0
Name: six
Version: 1.10.0
Name: pyOpenSSL
Version: 16.2.0
Summary of the problem
I am in the process of transitioning from OpenVPN to Algo on a Google Cloud hosted instance. The Algo deployment script has been run locally on the VPN server and configured itself easily - connections can be made to Algo successfully and traffic is routable internally.
The problem is that traffic to *.google.com is not working when connected to the Algo VPN. I am also unable to use the Google SDK (gcloud) to interact with the Google Cloud Console. I am able to access other websites (github, bitbucket etc.), and services fine. A traceroute is made to google.com and Google DNS servers (8.8.8.8) without issue, however wget google.com does not work when connected to Algo. I am able to access *.google.com and use the Google SDK when connected to OpenVPN as an alternative.
I have tried amending iptables routing rules as per this and this; neither have made Google accessible. All traffic within the VPN Subnet has been opened through a Google Cloud Firewall rule.
Does Algo or the VPN instance need to be configured differently?
Steps to reproduce the behavior

Connect to Algo VPN
gcloud compute ssh algo-vpn (for example), alternatively
Browse to google

The way of deployment (cloud or local)
Local deployment on Google Cloud instance
Expected behavior
Successful connection to the Algo VPN server via the gcloud SDK
Actual behavior
Connection to the server times out. google.com, cloud.google.com are also inaccessible.
Full log
When connected to Algo:


ifconfig:
$ ifconfig
ipsec0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1400
	inet 10.19.48.1 --> 10.19.48.1 netmask 0xff000000 
	inet6 fe80::ca69:cdff:fe8e:903a%ipsec0 prefixlen 64 scopeid 0xa 
	inet6 fd9d:bc11:4020::1 prefixlen 64 
	nd6 options=201<PERFORMNUD,DAD>


traceroute
$ traceroute google.com
traceroute: Warning: google.com has multiple addresses; using 64.233.188.100
traceroute to google.com (64.233.188.100), 64 hops max, 52 byte packets
1  10.0.0.2 (10.0.0.2)  190.221 ms  190.884 ms  187.699 ms
2  tk-in-f100.1e100.net (64.233.188.100)  188.655 ms  189.236 ms  189.405 ms


wget
$ wget google.com
--2017-01-07 17:43:55--  http://google.com/
Resolving google.com... 64.233.188.101, 64.233.188.100, 64.233.188.138, ...
Connecting to google.com|64.233.188.101|:80... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: http://www.google.com/ [following]
--2017-01-07 17:43:55--  http://www.google.com/
Resolving www.google.com... 64.233.188.147, 64.233.188.106, 64.233.188.99, ...
Connecting to www.google.com|64.233.188.147|:80... connected.
HTTP request sent, awaiting response... 


On the VPN instance:


iptables -L
root@algo-vpn:~$ iptables -L
sudo: unable to resolve host management-vpn
Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     esp  --  anywhere             anywhere            
ACCEPT     ah   --  anywhere             anywhere            
DROP       icmp --  anywhere             anywhere             icmp echo-request limit: up to 5/sec burst 5 mode srcip
ACCEPT     udp  --  anywhere             anywhere             multiport dports isakmp,ipsec-nat-t
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh ctstate NEW
ACCEPT     ipencap--  anywhere             anywhere             policy match dir in pol ipsec proto esp
ACCEPT     udp  --  anywhere             172.16.0.1           udp dpt:domain
ACCEPT     tcp  --  anywhere             172.16.0.1           multiport dports http-alt,8118
Chain FORWARD (policy DROP)
target     prot opt source               destination         
DROP       all  --  10.19.48.0/24        10.19.48.0/24       
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DROP       tcp  --  anywhere             anywhere             tcp dpt:microsoft-ds
DROP       udp  --  anywhere             anywhere             multiport ports netbios-ns,netbios-dgm
DROP       tcp  --  anywhere             anywhere             multiport ports netbios-ns,netbios-ssn
ACCEPT     all  --  10.19.48.0/24        anywhere             ctstate NEW policy match dir in pol ipsec
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination 


iptables -t nat -L
root@algo-vpn:~$ iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  10.19.48.0/24        anywhere             policy match dir out pol none

Duplicate issue #310: Can connect to VPN but sites do not respond
Created: 2017-03-30T00:42:37Z
OS / Environment
MacOS 10.12.4
iOS 10.3
Ansible version

Version of components from requirements.txt

Summary of the problem
Successfully deployed Algo to google cloud engine. Installed mobileconfig profile to both Mac and iPhone. Both connect to VPN immediately. They stay connected, but I can't get any sites to load. Browser just sits there waiting for a response.
I tried adding google DNS servers, what else should I be looking at or trying?
Steps to reproduce the behavior
The way of deployment (cloud or local)
Expected behavior
Actual behavior
Full log

Closing comment (2017-03-30T19:43:57Z): Not the same as #210, I can't get traffic to any site. Glad to see someoelse else is having the issue. Does anyone using google cloud have Algo working? Both of these are closed without being resolved :(
(I'm using Google because no other server is free!)