OpenVPN server only connects local clients

BobAGI

I have tried to set up an OpenVPN server on a Raspberry Pi using this tutorial and some help from the StmLabs forum.
I am using the Android OpenVPN Connect app to verify the server and my problem is this:
- If the phone is on the 3G or 4G mobile network it fails to connect, there is a timeout
- if the phone is on another network with WiFi it also fails to connect
- but if it is by WiFi on the same LAN as the server, then it connects just fine

I have checked the port forward of UDP1194 to the Raspberry Pi server's IP address and it works just fine.

So my conclusion is that the Pi is in some way misconfigured so it does not communicate with clients having a "foreign" IP address.

Since I am very new to Linux on the Raspberry Pi I am really lost here, please help.

Setup details:
My Pi is running a distribution named raspbmc from Dec 2013 and it main purpose is to act as an XBMC server.
I have already installed a PPTP VPN server on this pi and this works fine after I disabled the built-in firewall on the raspbmc distribution.
I have struggled with the differences between raspbmc and the distributions used by the tutorials and some of this is in regard to networking where I was helped to identify the file to put iptables commands into on this thread at the StmLabs forum.
I have a fiber connection to the Internet and I use a DLINK DIR-655 router into my local network.

BobAGI

OK: Following the rules as far as I can will make this a LONG post.
Problem
I can connect to the server from my Android phone running the OpenVPN Connect app when the phone is connected to a WiFi LAN.
It can be the same LAN as where the server runs or a different LAN, in which case the traffic is routed via the Internet (two routers involved in my house).

But even though the connection is successful I cannot reach anything at all on the server LAN or the Internet when OpenVPN is connected!
This is contrary to how it works with PPTP VPN, where I can access all resources on my home LAN and also browse the internet while connected.
So there is some difference in configuration somewhere....

1. Server config files
/etc/openvpn/server.conf

local 192.168.0.150
dev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/BBOpenVPN.crt
key /etc/openvpn/easy-rsa/keys/BBOpenVPN.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig 10.8.0.1 10.8.0.2
push "route 10.8.0.1 255.255.255.255"
push "route 10.8.0.0 255.255.255.0"
push "route 192.168.0.150 255.255.255.0"
push "dhcp-option DNS 192.168.0.129"
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 1

/etc/sysctl.conf

net.ipv4.ip_forward=1
vm.panic_on_oom = 0
vm.dirty_expire_centisecs = 1000
vm.dirty_writeback_centisecs = 1500
kernel.random.write_wakeup_threshold=128
kernel.random.read_wakeup_threshold=32
kernel.random.poolsize=512
kernel.random.entropy_avail=4096
vm.min_free_kbytes=16384
vm.swappiness=10

/etc/network/if-up.d/secure-rmc

#!/bin/bash

dec_to_bin() {
  local remainder=''
  local string=''
  local number=$1
  while [ 1 ]
  do
    let "remainder = $number % 2"
    let "result = ($number / 2)"
    number=$result
    string=$remainder$string
    if [ "$result" == 0 ]
      then
      break
    fi
  done
  echo $string
}

bin_to_dec() {
  local toprocess=$1
  local result=0
  while [ 1 ]
  do
    let "result = ($result*2)+${toprocess:0:1}"
    toprocess=${toprocess:1}
    if [ "$toprocess" == "" ]
    then
      break
    fi
  done
  echo $result
}

ip_octet_to_bin() {
  local oct=`dec_to_bin $1`
  while [ ${#oct} -lt 8 ] ; do
    oct=0$oct
  done
  echo $oct
}

ip_to_bin() {
  local ip=$1
  local first=`echo $ip | cut -d. -f1 | awk '{print $1}'`
  local second=`echo $ip | cut -d. -f2 | awk '{print $1}'`
  local third=`echo $ip | cut -d. -f3 | awk '{print $1}'`
  local fourth=`echo $ip | cut -d. -f4 | awk '{print $1}'`

  first=`ip_octet_to_bin $first`
  second=`ip_octet_to_bin $second`
  third=`ip_octet_to_bin $third`
  fourth=`ip_octet_to_bin $fourth`

  echo $first$second$third$fourth
}

bin_to_ip() {
  local first=${1:0:8}
  local second=${1:8:8}
  local third=${1:16:8}
  local fourth=${1:24:8}

  first=`bin_to_dec $first`
  second=`bin_to_dec $second`
  third=`bin_to_dec $third`
  fourth=`bin_to_dec $fourth`

  echo $first.$second.$third.$fourth
}

bit_and() {
  local in1=$1
  local in2=$2
  local out=''

  while [ 1 ] ; do
    local toadd=0
    if [ "${in1:0:1}" == 1 ] ; then
      if [ "${in2:0:1}" == 1 ] ; then
        toadd=1
      fi
    fi
    out=$out$toadd
    in1=${in1:1}
    in2=${in2:1}
    if [ ${#in1} == 0 ] ; then
      break
    fi
  done

  echo $out;
}


get_subnet() {
  local ip=`/sbin/ifconfig $1  | grep 'inet addr:'| grep -v '127.0.0.1' | cut -d: -f2 | awk '{ print $1}'`
  local mask=`/sbin/ifconfig $1 | grep 'inet addr:'| grep -v '127.0.0.1' | cut -d: -f4 | awk '{ print $1}'`

  ip=`ip_to_bin $ip`
  if [ ${#ip} -eq 0 ]; then
  logger -t secure-rmc "$1 has no IP"
  exit 1
  fi
  mask=`ip_to_bin $mask`

  local subnet=`bit_and $ip $mask`

  local counter=0
  local todo=$mask
  while [ 1 ] ; do
    if [ "${todo:0:1}" == 1 ] ; then
       let "counter = $counter + 1"
    fi
    todo=${todo:1}
    if [ "${#todo}" == 0 ] ; then
      break
    fi
  done

  subnet=`bin_to_ip $subnet`

  subnet=$subnet/$counter

  echo $subnet
}

logger -t iptables "Configuring ip tables for interface $IFACE"
if [ "$IFACE" != "lo" ]; then
    NETMASK=$(get_subnet $IFACE)
    if [ ${#NETMASK} -eq 0 ]; then
        logger -t secure-rmc "netmask not found"
        exit 1
   fi
    iptables -A INPUT -s $NETMASK -i $IFACE -j ACCEPT
    iptables -t nat -A INPUT -i eth0 -p udp -m udp --dport 1194 -j ACCEPT
    iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.0.150
    iptables -A INPUT -i $IFACE -j DROP
fi

/etc/firewall-openvpn-rules.sh

#!/bin/sh
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.0.150

2. My goal
Run an OpenVPN server on my home LAN such that I can connect to it from places like public WiFi, hotels abroad etc and securely do my stuff like I was back home in my own house.

3. Server Logfiles
/var/log/openvpn.log
These are the log entries following a successful connect attempt from an Android client on the same LAN as the server:

Tue May  6 01:53:24 2014 us=500585 MULTI: multi_create_instance called
Tue May  6 01:53:24 2014 us=501520 192.168.0.141:60884 Re-using SSL/TLS context
Tue May  6 01:53:24 2014 us=512470 192.168.0.141:60884 LZO compression initialized
Tue May  6 01:53:24 2014 us=582730 192.168.0.141:60884 Control Channel MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]
Tue May  6 01:53:24 2014 us=583081 192.168.0.141:60884 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Tue May  6 01:53:24 2014 us=583901 192.168.0.141:60884 Local Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher AES-128-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Tue May  6 01:53:24 2014 us=584093 192.168.0.141:60884 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-128-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Tue May  6 01:53:24 2014 us=584779 192.168.0.141:60884 Local Options hash (VER=V4): 'a2e63101'
Tue May  6 01:53:24 2014 us=585070 192.168.0.141:60884 Expected Remote Options hash (VER=V4): '272f1b58'
Tue May  6 01:53:24 2014 us=585652 192.168.0.141:60884 TLS: Initial packet from [AF_INET]192.168.0.141:60884, sid=9e66a288 233f6d54
Tue May  6 01:53:24 2014 us=785840 192.168.0.141:60884 VERIFY OK: depth=1, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/OU=changeme/CN=changeme/name=changeme/emailAddress=mail@host.domain
Tue May  6 01:53:24 2014 us=788086 192.168.0.141:60884 VERIFY OK: depth=0, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/OU=changeme/CN=BosseS4M/name=changeme/emailAddress=mail@host.domain
Tue May  6 01:53:24 2014 us=835097 192.168.0.141:60884 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Tue May  6 01:53:24 2014 us=839758 192.168.0.141:60884 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue May  6 01:53:24 2014 us=840010 192.168.0.141:60884 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Tue May  6 01:53:24 2014 us=840227 192.168.0.141:60884 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue May  6 01:53:24 2014 us=844813 192.168.0.141:60884 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue May  6 01:53:24 2014 us=845271 192.168.0.141:60884 [BosseS4M] Peer Connection Initiated with [AF_INET]192.168.0.141:60884
Tue May  6 01:53:24 2014 us=845894 BosseS4M/192.168.0.141:60884 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=bccd:800:8ced:200:14c2:700:5c68:5201
Tue May  6 01:53:24 2014 us=846510 BosseS4M/192.168.0.141:60884 MULTI: Learn: 10.8.0.6 -> BosseS4M/192.168.0.141:60884
Tue May  6 01:53:24 2014 us=846732 BosseS4M/192.168.0.141:60884 MULTI: primary virtual IP for BosseS4M/192.168.0.141:60884: 10.8.0.6
Tue May  6 01:53:25 2014 us=857041 BosseS4M/192.168.0.141:60884 PUSH: Received control message: 'PUSH_REQUEST'
Tue May  6 01:53:25 2014 us=857354 BosseS4M/192.168.0.141:60884 send_push_reply(): safe_cap=960
Tue May  6 01:53:25 2014 us=857907 BosseS4M/192.168.0.141:60884 SENT CONTROL [BosseS4M]: 'PUSH_REPLY,route 10.8.0.1 255.255.255.255,route 10.8.0.0 255.255.255.0,route 192.168.0.150 255.255.255.0,dhcp-option DNS 192.168.0.129,redirect-gateway def1,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)

/var/log/openvpn.log
These are the log entries following a successful connect attempt from an Android client on a different LAN as the server:

Tue May  6 02:03:25 2014 us=969635 MULTI: multi_create_instance called
Tue May  6 02:03:25 2014 us=970235 88.129.163.74:43632 Re-using SSL/TLS context
Tue May  6 02:03:25 2014 us=970514 88.129.163.74:43632 LZO compression initialized
Tue May  6 02:03:25 2014 us=971292 88.129.163.74:43632 Control Channel MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]
Tue May  6 02:03:25 2014 us=971549 88.129.163.74:43632 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Tue May  6 02:03:25 2014 us=972089 88.129.163.74:43632 Local Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher AES-128-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Tue May  6 02:03:25 2014 us=972399 88.129.163.74:43632 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-128-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Tue May  6 02:03:25 2014 us=972728 88.129.163.74:43632 Local Options hash (VER=V4): 'a2e63101'
Tue May  6 02:03:25 2014 us=973005 88.129.163.74:43632 Expected Remote Options hash (VER=V4): '272f1b58'
Tue May  6 02:03:25 2014 us=973390 88.129.163.74:43632 TLS: Initial packet from [AF_INET]88.129.163.74:43632, sid=ce82ec77 5e3057e7
Tue May  6 02:03:26 2014 us=211346 88.129.163.74:43632 VERIFY OK: depth=1, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/OU=changeme/CN=changeme/name=changeme/emailAddress=mail@host.domain
Tue May  6 02:03:26 2014 us=213695 88.129.163.74:43632 VERIFY OK: depth=0, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/OU=changeme/CN=BosseS4M/name=changeme/emailAddress=mail@host.domain
Tue May  6 02:03:26 2014 us=263651 88.129.163.74:43632 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Tue May  6 02:03:26 2014 us=263989 88.129.163.74:43632 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue May  6 02:03:26 2014 us=264188 88.129.163.74:43632 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Tue May  6 02:03:26 2014 us=264396 88.129.163.74:43632 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue May  6 02:03:26 2014 us=273090 88.129.163.74:43632 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue May  6 02:03:26 2014 us=273520 88.129.163.74:43632 [BosseS4M] Peer Connection Initiated with [AF_INET]88.129.163.74:43632
Tue May  6 02:03:26 2014 us=273926 BosseS4M/88.129.163.74:43632 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=bccd:800:8ced:200:14c2:700:f408:5101
Tue May  6 02:03:26 2014 us=274516 BosseS4M/88.129.163.74:43632 MULTI: Learn: 10.8.0.6 -> BosseS4M/88.129.163.74:43632
Tue May  6 02:03:26 2014 us=274717 BosseS4M/88.129.163.74:43632 MULTI: primary virtual IP for BosseS4M/88.129.163.74:43632: 10.8.0.6
Tue May  6 02:03:27 2014 us=285953 BosseS4M/88.129.163.74:43632 PUSH: Received control message: 'PUSH_REQUEST'
Tue May  6 02:03:27 2014 us=286300 BosseS4M/88.129.163.74:43632 send_push_reply(): safe_cap=960
Tue May  6 02:03:27 2014 us=286844 BosseS4M/88.129.163.74:43632 SENT CONTROL [BosseS4M]: 'PUSH_REPLY,route 10.8.0.1 255.255.255.255,route 10.8.0.0 255.255.255.0,route 192.168.0.150 255.255.255.0,dhcp-option DNS 192.168.0.129,redirect-gateway def1,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)

4. Client files
I have no idea how I can find the log or conf files on the Android OpenVPN Connect client!
I have looked in both the phone memory and in the SD-card but found nothing.

BobAGI

Quick update before I retire for today:
Contrary to my earlier claim I can now connect from all places (same LAN as server, other WiFi network and mobile 3G network).
Don't know why, but as part of the previous post I modified server.conf by changing verb1 into verb4 and restarted the server.
Apart from this I don't think I have changed anything.
Very strange.

But my problem has changed to the fact that once connected I can do absolutely nothing network related. Can't reach anywhere....

I also checked with the PPTP VPN connection and this connected instantly and let me access all local resources as well as the Internet.

BobAGI

Well, changing the network base address is not a simple proposition because I have so many devices connected on the network and all need some kind of handling, which is like a hen-and-egg problem.
There are WiFi units set up to autoconnect to the network using a fixed address and this must be reconfigured individually on them.
I have a NAS which also has a fixed address because it is accessed by my XBMC Pi where the address of teh NAS is somehow hidden inside after setup. Very difficult to move about and change.
So I would rather postpone that part until I can convince myself that the OpenVPN is really a viable VPN alternative.
So far after working on it for several days it has proven a disappointment.....

The last straw was the fact that after first not allowing any connections and then all of a sudden it can be connected to from everywhere, but still does not does not allow any usage at all. Then it does for a short while so I can access both local devices and browse the Internet and then it is OFF again.
All without me doing any obvious change that can explain the behavior.
Seems completely random.

There should really be an official OpenVPN installation document that exactly describes the procedure to perform geared toward the Linux illiterate, like me.
There are so many different files to edit and to top it off they seem to be named differently and located in different directories depending on the Linux distribution! Weird....

BobAGI

debbie10t wrote
BobAGI wrote/etc/network/if-up.d/secure-rmc
I have no idea what this is doing ... Try removing it for testing.

In fact this is coming from advice at the StmLabs forum since apparently on the raspbmc distribution there is no /etc/network/interfaces file and this file is where an edit should be made according to the tutorial I followed. I asked and got the reply that the secure-rmc file is a replacement for the interfaces file.
This is one instance of the different filename - different location problem I have encountered when trying to follow tutorials...

BobAGI wrote/etc/sysctl.conf
I have no idea what most of these settings will do .. the only thing you need for OpenVPN is net.ipv4.ip_forward=1 .. Try removing the other settings.

The only thing I changed in this file from what it was at the beginning is the ip_forward line...

If you are linux illiterate why did you buy a linux machine ? Besides there are plenty of resources on the internet for Linux support.

Because I need a way to VPN into my home network when I am away. Visiting my daughter in the USA is one such case. When I am there and I need the data from my NAS for example VPN is needed. Also when I visit Swedish websites with streaming content from her house I want to signal that I am located in Sweden.
And I don't have a 24/7 computer sitting on my home LAN that can serve as a VPN server except this Raspberry Pi

Finally, before you give up and walk away .. there are thousands of people (probably more) who have all done exactly what you are trying to do. What you need to do is strip out all the stuff you do not understand (ie. the points I made above) and work through the OpenVPN HOWTO until you get it working. Instead of trying to do everything at once, work in steps like so:

I will see what I find inthe OpenVPN HOWTO (if I find it) and compare to what I have done.

Using Easy-RSA (the version that ships with OpenVPN) to Setup your PKI

Setup a simple VPN with all your firewalls etc disabled

Connect from your client
Once you have a working connection then is the time to start customising it
Do one thing at a time and test it before moving on to the next item

What is PKI? The tutorial used Easy-RSA and I was able to use that to complete all the certificates and keys.
A simple VPN is what I aim for in the first place and PPTP seemed to fill the order until I read that it is compromised and I should use OpenVPN...
Right now I have a working OpenVPN client connection from my Android phone, but it won't let me out on the local network...

Some other notes:

BobAGI wrote

server 10.8.0.0 255.255.255.0              # This is good
ifconfig 10.8.0.1 10.8.0.2                 # Remove this as it is not required due to use of --server
push "route 10.8.0.1 255.255.255.255"      # Remove this as it is incorrect
push "route 10.8.0.0 255.255.255.0"        # Remove this as it is not required due to use of --server
push "route 192.168.0.150 255.255.255.0"   # Remove this as it is incorrect and not required for testing
push "dhcp-option DNS 192.168.0.129"       # Disable this for testing - is 192.168.0.129 really a DNS server ?
push "redirect-gateway def1"               # Disable this for testing
verb 1                                     # Increase to verb 4 for testing

Once you make those changes check your log files for errors and warnings.

I have now done what you suggested regarding server.conf edits and restarted the server.
The result is as follows:

1) The client connect still works, it connects in a few seconds only.
2) When I open a browser with OpenVPN connected and then go to myipaddress.com it displays a different address from my router's public address. In fact it seems like my webpage read is done directly from the phone using the mobile network and not via the VPN tunnel!
Same if I first connect my phone to another WiFi LAN and then connect OpenVPN (but then it is a different IP of course).
3) Trying to access the local resources (the NAS in this case) fails after a timeout.

So what this did was to direct web browsing onto the client network like on a forked VPN connection while still not getting access to the VPN network.

I would have shown the Android client log if I had any way of accessing it except via the "show log" menu command. This only shows part of the log in a gui window.
The Pi openvpn.log shows nothing from the attempt at looking at the NAS via OpenVPN.