Tunnel problem over wifi, mobiledata works

janaha

Hello

I'm experiencing some issues with my openvpn server running on linux mint 12 x64.
When using mobile data on my android (using openvpn settings),I have no issues
connecting to my home network, but when on wifi I get my ISP's ip address but can't
connect to my home network or tunnel through it.
Wifi with nat loopback on my router works.

I have commented out the stuff that didn't work for me (found some guide online)

server.conf

port 443  
proto tcp
dev tun
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key  # This file should be kept secret
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS 193.213.112.4"
push "dhcp-option DNS 130.67.15.198"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
log-append openvpn.log
verb 3

DNS is the same as the one I get from my ISP

client.conf

client
dev tun
proto tcp
remote xxxxxxxxxxxxxxxx 443
resolv-retry infinite
nobind
persist-key
pkcs12 client1.p12
ns-cert-type server
comp-lzo
verb 3

I have successfully used openvpn settings for android in the past with openvpn server for synology nas and openwrt,
but neither of them have worked with "redirect-gateway"

Mimiko

but when on wifi I get my ISP's ip address but can't connect to my home network or tunnel through it.

Try using another Wifi access point.

janaha

Tried two.One public and one at my friends house.No difference

Mimiko

More info is needed, like routing table and interfaces configuration from both situation: connected to OpenVPN not fru Wifi, and when Wifi is enabled.

janaha

route -n

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG    0      0        0 eth0
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.8.0.2        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 eth0
192.168.1.0     0.0.0.0         255.255.255.0   U     1      0        0 eth0

interfaces configuration from both situation: connected to OpenVPN not fru Wifi, and when Wifi is enabled.

How do I do this?I'm not a very experienced linux user.

Mimiko

On Android install a tool for command line access. There use commands:

route -n
ifconfig

for both cases.

janaha

Wifi

route -n

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.8.0.5        128.0.0.0       UG    0      0        0 tun0
0.0.0.0         192.168.1.1     0.0.0.0         UG    0      0        0 wlan0
0.0.0.0         192.168.1.1     0.0.0.0         UG    344    0        0 wlan0
10.8.0.1        10.8.0.5        255.255.255.255 UGH   0      0        0 tun0
10.8.0.5        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
62.16.211.216   192.168.1.1     255.255.255.255 UGH   0      0        0 wlan0
128.0.0.0       10.8.0.5        128.0.0.0       UG    0      0        0 tun0
192.168.1.0     0.0.0.0         255.255.255.0   U     344    0        0 wlan0
192.168.1.1     0.0.0.0         255.255.255.255 UH    0      0        0 wlan0

ifconfig

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:12880 errors:0 dropped:0 overruns:0 frame:0
          TX packets:12880 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:15739761 (15.0 MiB)  TX bytes:15739761 (15.0 MiB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.6  P-t-P:10.8.0.5  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:107 errors:0 dropped:0 overruns:0 frame:0
          TX packets:157 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:500 
          RX bytes:51602 (50.3 KiB)  TX bytes:18328 (17.8 KiB)

wlan0     Link encap:Ethernet  HWaddr 04:46:65:97:07:3E  
          inet addr:192.168.1.135  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:788 errors:0 dropped:149 overruns:0 frame:0
          TX packets:361 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:155341 (151.7 KiB)  TX bytes:61400 (59.9 KiB)

Mobile data

route -n

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.8.0.5        128.0.0.0       UG    0      0        0 tun0
0.0.0.0         178.232.78.1    0.0.0.0         UG    0      0        0 rmnet0
10.8.0.1        10.8.0.5        255.255.255.255 UGH   0      0        0 tun0
10.8.0.5        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
62.16.211.216   178.232.78.1    255.255.255.255 UGH   0      0        0 rmnet0
128.0.0.0       10.8.0.5        128.0.0.0       UG    0      0        0 tun0
178.232.78.0    0.0.0.0         255.255.255.0   U     0      0        0 rmnet0
178.232.78.1    0.0.0.0         255.255.255.255 UH    0      0        0 rmnet0

ifconfig

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:13196 errors:0 dropped:0 overruns:0 frame:0
          TX packets:13196 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:15763642 (15.0 MiB)  TX bytes:15763642 (15.0 MiB)

rmnet0    Link encap:Point-to-Point Protocol  
          inet addr:178.232.78.8  P-t-P:178.232.78.8  Mask:255.255.255.0
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:69555 errors:0 dropped:0 overruns:0 frame:0
          TX packets:63752 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:58704277 (55.9 MiB)  TX bytes:8566182 (8.1 MiB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.6  P-t-P:10.8.0.5  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:500 
          RX bytes:0 (0.0 B)  TX bytes:884 (884.0 B)

Mimiko

I see that thru Wifi VPN is connected, you get the IP. Ping 10.8.0.5. If this will not work, then may be Wifi provider set some packet sniffer to block VPN packets.

janaha

I managed to find a public wifi that worked.
10.8.0.5 is not pingable from wifi or mobiledata.
The wifi AP over at my friends house is running dd-wrt on netgear wndr3700v2 (same as me), but still no go over wifi.
I doubt that there is anything blocking the packets on his router.

janaha

I've attached the log from openvpn-settings when using wifi.
As pointed out earlier I get my home IP, but no dice browsing my lan

Wed May 30 17:17:27 2012 OpenVPN 2.2.2 i686-pc-linux-gnu [SSL] [LZO2] [EPOLL] [eurephia] built on May 17 2012
Wed May 30 17:17:27 2012 MANAGEMENT: TCP Socket listening on 127.0.0.1:10532
Wed May 30 17:17:27 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed May 30 17:17:27 2012 WARNING: file 'client1.p12' is group or others accessible
Wed May 30 17:17:27 2012 LZO compression initialized
Wed May 30 17:17:27 2012 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Wed May 30 17:17:27 2012 Socket Buffers: R=[1048576->131072] S=[524288->131072]
Wed May 30 17:17:47 2012 RESOLVE: Cannot resolve host address: xxxxxxxxxxxxx: [TRY_AGAIN] A temporary error occurred on an authoritative name server.
Wed May 30 17:17:47 2012 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Wed May 30 17:17:47 2012 Local Options hash (VER=V4): '69109d17'
Wed May 30 17:17:47 2012 Expected Remote Options hash (VER=V4): 'c0103fa8'
Wed May 30 17:18:02 2012 Attempting to establish TCP connection with 62.16.211.216:443 [nonblock]
Wed May 30 17:18:02 2012 MANAGEMENT: Client connected from 127.0.0.1:10532
Wed May 30 17:18:02 2012 MANAGEMENT: CMD 'state'
Wed May 30 17:18:02 2012 MANAGEMENT: CMD 'state on'
Wed May 30 17:18:02 2012 MANAGEMENT: CMD 'bytecount 0'
Wed May 30 17:18:03 2012 TCP connection established with 62.16.211.216:443
Wed May 30 17:18:03 2012 TCPv4_CLIENT link local: [undef]
Wed May 30 17:18:03 2012 TCPv4_CLIENT link remote: 62.16.211.216:443
Wed May 30 17:18:03 2012 MANAGEMENT: >STATE:1338391083,WAIT,,,
Wed May 30 17:18:03 2012 MANAGEMENT: CMD 'bytecount 0'
Wed May 30 17:18:03 2012 MANAGEMENT: >STATE:1338391083,AUTH,,,
Wed May 30 17:18:03 2012 TLS: Initial packet from 62.16.211.216:443, sid=b418bcdc 26bfdcca
Wed May 30 17:18:03 2012 MANAGEMENT: CMD 'bytecount 0'
Wed May 30 17:18:04 2012 VERIFY OK: depth=1, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/CN=Fort-Funston_CA/emailAddress=me@myhost.mydomain
Wed May 30 17:18:04 2012 VERIFY OK: nsCertType=SERVER
Wed May 30 17:18:04 2012 VERIFY OK: depth=0, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/CN=server/emailAddress=me@myhost.mydomain
Wed May 30 17:18:05 2012 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed May 30 17:18:05 2012 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed May 30 17:18:05 2012 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed May 30 17:18:05 2012 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed May 30 17:18:05 2012 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed May 30 17:18:05 2012 [server] Peer Connection Initiated with 62.16.211.216:443
Wed May 30 17:18:06 2012 MANAGEMENT: >STATE:1338391086,GET_CONFIG,,,
Wed May 30 17:18:06 2012 MANAGEMENT: CMD 'bytecount 0'
Wed May 30 17:18:07 2012 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Wed May 30 17:18:07 2012 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 193.213.112.4,dhcp-option DNS 130.67.15.198,redirect-gateway def1,dhcp-option DNS 193.213.112.4,dhcp-option DNS 130.67.15.198,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Wed May 30 17:18:07 2012 OPTIONS IMPORT: timers and/or timeouts modified
Wed May 30 17:18:07 2012 OPTIONS IMPORT: --ifconfig/up options modified
Wed May 30 17:18:07 2012 OPTIONS IMPORT: route options modified
Wed May 30 17:18:07 2012 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed May 30 17:18:07 2012 ROUTE default_gateway=192.168.1.1
Wed May 30 17:18:07 2012 TUN/TAP device tun0 opened
Wed May 30 17:18:07 2012 MANAGEMENT: >STATE:1338391087,ASSIGN_IP,,10.8.0.6,
Wed May 30 17:18:07 2012 /system/bin/ip link set dev tun0 up mtu 1500
Wed May 30 17:18:07 2012 /system/bin/ip addr add dev tun0 local 10.8.0.6 peer 10.8.0.5
Wed May 30 17:18:07 2012 /system/bin/ip route add 62.16.211.216/32 via 192.168.1.1
Wed May 30 17:18:07 2012 /system/bin/ip route add 0.0.0.0/1 via 10.8.0.5
Wed May 30 17:18:07 2012 /system/bin/ip route add 128.0.0.0/1 via 10.8.0.5
Wed May 30 17:18:07 2012 MANAGEMENT: >STATE:1338391087,ADD_ROUTES,,,
Wed May 30 17:18:07 2012 /system/bin/ip route add 10.8.0.1/32 via 10.8.0.5
Wed May 30 17:18:07 2012 Initialization Sequence Completed
Wed May 30 17:18:07 2012 MANAGEMENT: >STATE:1338391087,CONNECTED,SUCCESS,10.8.0.6,62.16.211.216
Wed May 30 17:18:07 2012 MANAGEMENT: CMD 'bytecount 0'
Wed May 30 17:18:07 2012 MANAGEMENT: CMD 'bytecount 0'
Wed May 30 17:18:07 2012 MANAGEMENT: CMD 'bytecount 3'

I can ping 10.8.0.1

Mimiko

As pointed out earlier I get my home IP, but no dice browsing my lan

See this post for tips: https://forums.openvpn.net/topic9465.html

janaha

Success.I managed to connect to my lan using

push "route 192.168.1.0 255.255.255.0"

from your link.
However, I cannot access my router,as it has the same ip as the AP I'm connected to.
Anyway of fixing this?

Mimiko

As you can't differentiate the IP of router and AP, you can't connect to router. Use different IPs.