Trouble to connect to the OpenVPN server

Patrick

Hello,

I've a Raspberry pi and I want to make a VPN server on this device.
I think the installation has been succeed, i've import my certificate to my mac with Tunnelblick.

But I can't get a connection, I've checked everything but it seems that my '2' routers gives the problem.
- First: I've a Horizon router with modem from UPC (my ISP, so my first router).
If I do a portscan on my own IP (from somewhere else) with NMAP on poort 1194 UDP it's OPEN.
I've give this router (192.168.100.0) a port forwarding to my second router 192.168.0.1 (because he can't see my local IP from my Raspberry PI).
And I tried to set the port filter on 1194 UDP

- Second: i've an own router from sitecom (where my raspberry is on)
If I do a portscan on my local IP with NMAP on poort 1194 UDP it's OPEN.
I've give this router 192.168.0.1 a port forwarding to my local IP-adress from my raspberry PI 192.168.0.104
And I tried to set the port filter on 1194 UDP without my local IP-adress

Can anybody help me out?
Thank you!!

maikcat

can you please post a detailed diagram of your installation...?

also post configs.

Michael.

Patrick

I used this 2 tutorials, step by step (i used only the 2048 key)
http://readwrite.com/2014/04/10/raspberry-pi-vpn-tutorial-server-secure-web-browsing
http://readwrite.com/2014/04/11/building-a-raspberry-pi-vpn-part-two-creating-an-encrypted-client-side#awesm=~oB89WBfWrt21bV

Server.conf (grep -vE '^#|^;|^$' server.conf)

local 192.168.0.104 # SWAP THIS NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
dev tun
proto udp #Some people prefer to use tcp. Don't change it if you don't know.
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/Server.crt # SWAP WITH YOUR CRT NAME
key /etc/openvpn/easy-rsa/keys/Server.key # SWAP WITH YOUR KEY NAME
dh /etc/openvpn/easy-rsa/keys/dh2048.pem # If you changed to 2048, change that here!
server 10.8.0.0 255.255.255.0
ifconfig 10.8.0.1 10.8.0.2
push "route 10.8.0.1 255.255.255.255"
push "route 10.8.0.0 255.255.255.0"
push "route 192.168.0.104 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
push "dhcp-option DNS 192.168.0.1" # This should already match your router address and not need to be changed.
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 1

openvpn-status.log

OpenVPN CLIENT LIST
Updated,Tue Aug 5 07:24:18 2014 (raspberry pi statup time, this morning)
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
GLOBAL STATS
Max bcast/mcast queue length,0
END

openvpn.log

Mon Jul 28 20:17:18 2014 OpenVPN 2.2.1 arm-linux-gnueabihf [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Oct 12 2013
Mon Jul 28 20:17:18 2014 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Mon Jul 28 20:17:18 2014 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Jul 28 20:17:18 2014 Control Channel Authentication: using '/etc/openvpn/easy-rsa/keys/ta.key' as a OpenVPN static key file
Mon Jul 28 20:17:18 2014 TUN/TAP device tun0 opened
Mon Jul 28 20:17:18 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Jul 28 20:17:18 2014 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Mon Jul 28 20:17:18 2014 GID set to nogroup
Mon Jul 28 20:17:18 2014 UID set to nobody
Mon Jul 28 20:17:18 2014 UDPv4 link local (bound): [AF_INET]192.168.0.104:1194
Mon Jul 28 20:17:18 2014 UDPv4 link remote: [undef]
Mon Jul 28 20:17:18 2014 Initialization Sequence Completed

ifconfig

eth0 Link encap:Ethernet HWaddr b8:27:eb:64:55:1b
inet addr:192.168.0.104 Bcast:192.168.0.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:2860 errors:0 dropped:0 overruns:0 frame:0
TX packets:2077 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:393438 (384.2 KiB) TX bytes:240429 (234.7 KiB)

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

maikcat

please post more info about your network topology...

Michael.

Patrick

In my first post i did tell something about my network topology.
But I will discripe this again.

I have a Horizon router with modem from UPC (my ISP, so my first router) local ip: 192.168.100.1
This router does have a connection with my sitecom router, local ip: 192.168.0.1.
On this sitecom router is my my raspberry on, local ip:192.168.0.104)

So: Horizon router --> Sitecom router --> Raspberry PI

maikcat

I have a Horizon router with modem from UPC (my ISP, so my first router) local ip: 192.168.100.1
This router does have a connection with my sitecom router, local ip: 192.168.0.1.
On this sitecom router is my my raspberry on, local ip:192.168.0.104)

So: Horizon router --> Sitecom router --> Raspberry PI

not enough info...

are your routers connected back-to-back?
are the perform NAT? if yes,both? to which interface?
PI has as default gw your sitecom?

i have reasons to insist on providing more info about your topology...

Michael.

Patrick

thanks for helping, but I dont understand you're question

Back-to-back? (just with an normal cable...)
Yes there are bot NAT
GW?

maikcat

gw = gateway

how each one is connected to each other?
how many ports they have?
Which traffic are NATed?

Michael.

Patrick

Thanks,
Yes the pi have default gateway on my sitecom..

I just describe how the network is connected..?
All traffic is nated

Patrick

Yes, all clients are in the same lan as my Raspberry PI (on the sitecom).

On your Horizon rtr you must Port-Forward UPD:1194 to your Sitecom WAN interface (Details you have not provided)
WAN interface is the 192.168.0.1 right or where can i find that?

Sitecom:

Horizon:

Patrick

I have scan the ports with nmap: nmap -sU -p 1194 -Pn 192.168.0.104 and nmap -sU -p 1194 -Pn [Public ip]
And the ports are on both IP open, but i can't connect.

Host is up.
PORT STATE SERVICE
1194/udp open|filtered openvpn
Nmap done: 1 IP address (1 host up) scanned in 3.58 seconds

Patrick

You mean the android or mac config?
I can't find a client.conf on my raspberry pi :S

So .. fill in the blanks {*} below:

Horizon:
WAN: Public.IP (We do not need to know this)
LAN: 192.168.100.0

Sitecom:
WAN: 192.168.0.1
LAN: 192.168.0.100/200

Pi:
eth0: 192.168.0.104

I hope that this is the information you need.
Next week I go to Indonesia, so i hope that this server work, thanks.