[Resolved] Port Forwarding Non VPN Traffic alongside Client

thompson

I've got a raspberry pi running an OpenVPN client and connected to a server and it all works well except I'm unable to connect to it via our ISP IP.

I've googled a ton on this the past two days to some avail, but none of it ever seems to stick beyond a reboot.

Basically when I start the VPN connection all those ports appear closed to the checking websites, and I'm unable to connect to them using using an external IP (in this instance, provided by my cell phone). But as soon as I turn off the VPN connection I can connect to them all again.

I've tried adding IPTable rules with some success but as I mentioned, upon reboot the rules are lost & I can't seem to replicate them again.

I've also played around with a few of the settings in the ovpn files but they don't seem to have any beneficial effect.

Any help is greatly appreciated as this is doing my head in proper.

thompson

Sorry about that, should have known better.

Client ovpn

remote ca4.ibvpn.com 1194 udp
remote 184.75.220.162 80 udp
remote 184.75.220.162 443 udp
remote 184.75.220.162 53 udp
client
dev tap
resolv-retry infinite
persist-key
mute-replay-warnings
ca ibvpn.com.crt
comp-lzo
verb 3
mute 20
ns-cert-type server
fragment 1300
route-delay 2
script-security 3 system
max-routes 5000
auth-user-pass "/etc/openvpn/user.txt"
auth-nocache yes
reneg-sec 0
explicit-exit-notify 3
link-mtu 1578
up "/etc/openvpn/change_resolv_conf.sh up"
down "/etc/openvpn/change_resolv_conf.sh down"

I've looked around & Googled for the default client log location but not finding one?

Here is netstat - nr readout in case that's relevant.

Iptables give no rules when I run iptables -L, and I'm not near the computer atm so if I start the vpn I can't gain access.

thompson

Thanks

Here's the log from a quit start

Mon Jan 27 23:55:34 2014 us=431851 Current Parameter Settings:
Mon Jan 27 23:55:34 2014 us=432878   config = 'ibVPN-CA-Toronto2 (P2P).ovpn'
Mon Jan 27 23:55:34 2014 us=433082   mode = 0
Mon Jan 27 23:55:34 2014 us=433278   persist_config = DISABLED
Mon Jan 27 23:55:34 2014 us=433449   persist_mode = 1
Mon Jan 27 23:55:34 2014 us=433614   show_ciphers = DISABLED
Mon Jan 27 23:55:34 2014 us=433778   show_digests = DISABLED
Mon Jan 27 23:55:34 2014 us=433935   show_engines = DISABLED
Mon Jan 27 23:55:34 2014 us=434095   genkey = DISABLED
Mon Jan 27 23:55:34 2014 us=434256   key_pass_file = '[UNDEF]'
Mon Jan 27 23:55:34 2014 us=434480   show_tls_ciphers = DISABLED
Mon Jan 27 23:55:34 2014 us=434693 Connection profiles [default]:
Mon Jan 27 23:55:34 2014 us=434858   proto = udp
Mon Jan 27 23:55:34 2014 us=435022   local = '[UNDEF]'
Mon Jan 27 23:55:34 2014 us=435182   local_port = 1194
Mon Jan 27 23:55:34 2014 us=435338   remote = '[UNDEF]'
Mon Jan 27 23:55:34 2014 us=435503   remote_port = 1194
Mon Jan 27 23:55:34 2014 us=435662   remote_float = DISABLED
Mon Jan 27 23:55:34 2014 us=435823   bind_defined = DISABLED
Mon Jan 27 23:55:34 2014 us=435987   bind_local = ENABLED
Mon Jan 27 23:55:34 2014 us=436146 NOTE: --mute triggered...
Mon Jan 27 23:55:34 2014 us=436418 313 variation(s) on previous 20 message(s) suppressed by --mute
Mon Jan 27 23:55:34 2014 us=436601 OpenVPN 2.2.1 arm-linux-gnueabihf [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Oct 12 2013
Mon Jan 27 23:55:34 2014 us=438662 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA.  OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Mon Jan 27 23:55:34 2014 us=438930 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Mon Jan 27 23:55:34 2014 us=439085 NOTE: --script-security method='system' is deprecated due to the fact that passed parameters will be subject to shell expansion
Mon Jan 27 23:55:34 2014 us=452008 LZO compression initialized
Mon Jan 27 23:55:34 2014 us=453197 Control Channel MTU parms [ L:1578 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Jan 27 23:55:34 2014 us=453839 Socket Buffers: R=[163840->131072] S=[163840->131072]
Mon Jan 27 23:55:34 2014 us=631748 Data Channel MTU parms [ L:1578 D:1450 EF:46 EB:135 ET:32 EL:0 AF:3/1 ]
Mon Jan 27 23:55:34 2014 us=632064 Fragmentation MTU parms [ L:1578 D:1300 EF:45 EB:135 ET:33 EL:0 AF:3/1 ]
Mon Jan 27 23:55:34 2014 us=632427 Local Options String: 'V4,dev-type tap,link-mtu 1578,tun-mtu 1532,proto UDPv4,comp-lzo,mtu-dynamic,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Mon Jan 27 23:55:34 2014 us=632604 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1578,tun-mtu 1532,proto UDPv4,comp-lzo,mtu-dynamic,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Mon Jan 27 23:55:34 2014 us=633000 Local Options hash (VER=V4): '9a22532e'
Mon Jan 27 23:55:34 2014 us=633257 Expected Remote Options hash (VER=V4): 'e2a912d8'
Mon Jan 27 23:55:34 2014 us=633487 UDPv4 link local (bound): [undef]
Mon Jan 27 23:55:34 2014 us=633719 UDPv4 link remote: [AF_INET]184.75.220.162:1194
Mon Jan 27 23:55:34 2014 us=773625 TLS: Initial packet from [AF_INET]184.75.220.162:1194, sid=aa90dfca 6ee7b25c
Mon Jan 27 23:55:35 2014 us=252599 VERIFY OK: depth=1, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/CN=Fort-Funston_CA/emailAddress=me@myhost.mydomain
Mon Jan 27 23:55:35 2014 us=255831 VERIFY OK: nsCertType=SERVER
Mon Jan 27 23:55:35 2014 us=256079 VERIFY OK: depth=0, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/CN=server/emailAddress=me@myhost.mydomain
Mon Jan 27 23:55:35 2014 us=638214 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Jan 27 23:55:35 2014 us=638656 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jan 27 23:55:35 2014 us=639200 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Jan 27 23:55:35 2014 us=639439 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jan 27 23:55:35 2014 us=640357 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Mon Jan 27 23:55:35 2014 us=640747 [server] Peer Connection Initiated with [AF_INET]184.75.220.162:1194
Mon Jan 27 23:55:38 2014 us=10036 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Mon Jan 27 23:55:38 2014 us=102202 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.10.10.0 255.255.255.0 vpn_gateway,show-net-up,route-gateway 10.10.10.1,ping 10,ping-restart 60,ifconfig 10.10.10.24 255.255.255.0'
Mon Jan 27 23:55:38 2014 us=103215 Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:5: show-net-up (2.2.1)
Mon Jan 27 23:55:38 2014 us=103658 OPTIONS IMPORT: timers and/or timeouts modified
Mon Jan 27 23:55:38 2014 us=103852 OPTIONS IMPORT: --ifconfig/up options modified
Mon Jan 27 23:55:38 2014 us=104013 OPTIONS IMPORT: route options modified
Mon Jan 27 23:55:38 2014 us=104162 OPTIONS IMPORT: route-related options modified
Mon Jan 27 23:55:38 2014 us=104312 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Mon Jan 27 23:55:38 2014 us=106340 ROUTE default_gateway=192.168.2.2
Mon Jan 27 23:55:38 2014 us=119262 TUN/TAP device tap0 opened
Mon Jan 27 23:55:38 2014 us=119622 TUN/TAP TX queue length set to 100
Mon Jan 27 23:55:38 2014 us=119866 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Jan 27 23:55:38 2014 us=120261 /sbin/ifconfig tap0 10.10.10.24 netmask 255.255.255.0 mtu 1500 broadcast 10.10.10.255
Mon Jan 27 23:55:38 2014 us=159011 /etc/openvpn/change_resolv_conf.sh up tap0 1500 1578 10.10.10.24 255.255.255.0 init
Mon Jan 27 23:55:40 2014 us=792722 /sbin/route add -net 184.75.220.162 netmask 255.255.255.255 gw 192.168.2.2
Mon Jan 27 23:55:40 2014 us=810802 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 10.10.10.1
Mon Jan 27 23:55:40 2014 us=829193 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 10.10.10.1
Mon Jan 27 23:55:40 2014 us=848016 /sbin/route add -net 10.10.10.0 netmask 255.255.255.0 gw 10.10.10.1
Mon Jan 27 23:55:40 2014 us=866465 Initialization Sequence Completed
Mon Jan 27 23:56:20 2014 us=534991 event_wait : Interrupted system call (code=4)
Mon Jan 27 23:56:20 2014 us=535396 SIGTERM received, sending exit notification to peer
Mon Jan 27 23:56:23 2014 us=758511 TCP/UDP: Closing socket
Mon Jan 27 23:56:23 2014 us=759037 /sbin/route del -net 10.10.10.0 netmask 255.255.255.0
Mon Jan 27 23:56:23 2014 us=776855 /sbin/route del -net 184.75.220.162 netmask 255.255.255.255
Mon Jan 27 23:56:23 2014 us=795049 /sbin/route del -net 0.0.0.0 netmask 128.0.0.0
Mon Jan 27 23:56:23 2014 us=813809 /sbin/route del -net 128.0.0.0 netmask 128.0.0.0
Mon Jan 27 23:56:23 2014 us=832184 Closing TUN/TAP interface
Mon Jan 27 23:56:23 2014 us=832585 /sbin/ifconfig tap0 0.0.0.0
Mon Jan 27 23:56:23 2014 us=879123 /etc/openvpn/change_resolv_conf.sh down tap0 1500 1578 10.10.10.24 255.255.255.0 init
Mon Jan 27 23:56:23 2014 us=980384 SIGTERM[soft,exit-with-notification] received, process exiting

thompson

http://www.ibVPN.com