连接OpenVPN与Google Cloud VPC后无法访问互联网求助

Hey there, let's walk through troubleshooting your OpenVPN + GCP VPC issue step by step. You mentioned you're in Singapore, connected successfully to an India region VPC but can't access any websites—here are the most likely fixes to check off one by one:

• First, confirm your GCP VPC has a default route pointing to an Internet Gateway (IGW). Head to the GCP Console > VPC Network > Routes, and look for a route with destination 0.0.0.0/0 and next hop set to your IGW. If this route is missing, create it immediately—it's critical for outbound internet access.
• Also, check if the subnet hosting your OpenVPN instance has Private Google Access enabled (this helps with Google services, but is a common oversight that can break connectivity).

• On your OpenVPN instance, ensure IP forwarding is enabled (this lets traffic pass through the server to the internet):

  sudo sysctl -w net.ipv4.ip_forward=1
  sudo echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
  

• Verify GCP firewall rules allow outbound traffic from the OpenVPN instance. Check for an egress rule that permits 0.0.0.0/0 on all protocols/ports (or at least TCP/UDP 80/443 for web traffic). Don't forget to confirm the inbound rule for OpenVPN (usually UDP 1194) is applied to the instance's tag or public IP.

• Open your client .ovpn file and make sure it pushes the default route to send all traffic through the VPN. Look for this line:

  push "redirect-gateway def1 bypass-dhcp"
  

  If it's missing, add it to your OpenVPN server config, regenerate the client profile, and reconnect.
• Ensure DNS resolution works by adding these lines to the server config (pushes Google's public DNS to clients):

  push "dhcp-option DNS 8.8.8.8"
  push "dhcp-option DNS 8.8.4.4"
  

• Your OpenVPN server needs to translate client private IPs to its public IP using NAT. Run this iptables command (replace [OPENVPN_CLIENT_SUBNET] with your client subnet, e.g., 10.8.0.0):

  sudo iptables -t nat -A POSTROUTING -s [OPENVPN_CLIENT_SUBNET]/24 -o eth0 -j MASQUERADE
  

• Save the iptables rules so they persist after reboot:

  sudo iptables-save > /etc/iptables/rules.v4
  

  (On Debian/Ubuntu, you may need to install iptables-persistent first.)

• From your client, first ping a public IP like 8.8.8.8:
  • If pinging works but domain names don't resolve, it's a DNS problem (double-check the DNS push rules in step 3).
  • If pinging fails, SSH into your OpenVPN instance and run curl google.com. If that also fails, the issue is with the instance's own network access (not the VPN setup)—go back to checking VPC routes and firewalls.

After making these changes, restart the OpenVPN server with sudo systemctl restart openvpn and reconnect your client. Most of the time, missing NAT rules or incorrect route pushing are the root causes here.

内容的提问来源于stack exchange，提问作者Siddhpura Amit