Mixed results access IMAP via VPN

sdavies

I have successfully connected to OpenVPN 2.3.1 server running on a Linux box
using client apps on Samsung Android, iPhone and IPad but am getting strange
results when then trying to access an IMAP email base.

The server is behind an ADSL router which has a static IP address (165.x.x.x)
and forwards all traffic to the Linux server at 192.168.0.100. The relevant
firewall, hosts and relay domain entries have been made on the Linux server.

On the Android client, I have defined the incoming and outgoing servers as
192.168.0.100 and email access is working perfectly.

However, if I change the mail server addresses to the fqdn or IP of the
server-side ADSL box, email access fails with "cannot connect to server".

The Android box uses WIFI to reach my ADSL router and the world. It gets it's
IP from my real IP range (203.x.x.0) via DHCP. The ADSL box has a static
address from the same range.

On the iPad, it is the reverse: email access only works when the server
address is set to the fqdn of the ADSL box.
It gets it's private IP via WIFI from another ADSL box which has a static IP.
The iPad seems to not work at all when using 3G so 3G is switched off for these
tests.

The iPhone is different again.
It only works via 3G and with the email servers set to 192.168.0.100.

Yet another case is a roaming windoze laptop which connects first to a WIFI
device in the car and from there via 3G to Telstra. All IP addresses are
dynamic via DHCP from the telco.
I have yet to find a configuration for this box that works.

Could someone please explain to me why these differences should occur and,
hopefully, explain how to make the remaining bits work.

Cheers and thanks,
Stephen

Server config:

port 1194
proto udp
dev tun
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key # This file should be kept secret
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
server 10.55.66.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.0.0 255.255.255.0"
keepalive 10 120
cipher AES-128-CBC # AES
comp-lzo
user openvpn
group openvpn
persist-key
persist-tun
status openvpn-status.log
verb 3
float

Client config(s)

client
dev tun
proto udp
remote 165.228.168.21 1194
resolv-retry infinite
nobind
persist-key
persist-tun
<ca>
-----BEGIN CERTIFICATE-----
snip
-----END CERTIFICATE-----
</ca>
ns-cert-type server
cipher AES-128-CBC # AES
comp-lzo
verb 3

maikcat

some basic troubleshooting steps..

if you telnet to your imap servers real ip at port 143 from internet do you recieve IMAP servers banner?
if you recieve banner then port forwaring on router + fw rules are ok,

if you cant access port 143 from one location but you can access it from another then
location A maybe filters outgoing traffic...

you can use telnet to narrow down connection problems , also keep in mind that imap servers
logs are also your friend...

Michael.

sdavies

I will look for a telnet app for iPhone and iPad but doubt that it will help much.
The "cannot connect to server" messages suggests to me that the problem is one of routing/filtering/DNS/? so that nothing actually reaches the IMAP service from the iOS devices.
The lack of IMAP logs for the iOS devices supports this.

The Android tablet continues to work perfectly with the same OpenVPN config.

Further experimenting with recent models has led to success with the WIFI-to-3G routers.
Brand new routers work perfectly (with the IMAP server addresses set to 192.168.0.100) where older models do not.

No idea what is different inside these black boxes and they do not have any configuration that I can read.

sdavies

More information/confusion:

An iPad connecting via a WIFI-to-3G router only works when the IMAP server addresses are given as 192.168.0.100.

The same iPad connecting through a normal ADSL WIFI router only works when the addresses are www.xxx.com.au (which translates via DNS to the static external IP of the router).

This suggests to me that there is a DNS component to the problem.

In both cases, the iPad is getting it's IP and DNS server via DHCP from the router.

Any ideas?

Cheers and thanks,
Stephen