Connection to openvpn works fine but no Internet ip4 vs ip6

steini

Hi there,

I would need your help as I've been scratching my head on getting my openvpn server to work properly with my raspberry pi.

I have basically setup a server on a raspberry pi and trying to connect to it with an iOS device. The server is up and running and the client can connect to it seamlessly. Note that the server is outside the home network (effectively at my parents place in another country) and I use the service dydns to connect to the pi with the external ip address.

The issue is that, once connected to the server, I cannot access internet. I believe the issue is because the router that is behind the server has some sort of ip4 to ip6 routing which I am not at all knowledgeable about. Anyway, enough said, here are the logs and ifconfig output. Hopefully someone can help me - that would be much appreciated.

Thanks

Server log

Tue Aug 12 08:17:20 2014 OpenVPN 2.2.1 arm-linux-gnueabihf [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Oct 12 2013
Tue Aug 12 08:17:20 2014 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you con$
Tue Aug 12 08:17:20 2014 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Aug 12 08:17:21 2014 Control Channel Authentication: using '/etc/openvpn/easy-rsa/keys/ta.key' as a OpenVPN static key file
Tue Aug 12 08:17:21 2014 TUN/TAP device tun0 opened
Tue Aug 12 08:17:21 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Aug 12 08:17:21 2014 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Tue Aug 12 08:17:21 2014 GID set to nogroup
Tue Aug 12 08:17:21 2014 UID set to nobody
Tue Aug 12 08:17:21 2014 UDPv4 link local (bound): [AF_INET]192.168.0.99:1194
Tue Aug 12 08:17:21 2014 UDPv4 link remote: [undef]
Tue Aug 12 08:17:21 2014 Initialization Sequence Completed
Thu Aug 14 11:15:33 2014 85.255.235.115:53825 Re-using SSL/TLS context
Thu Aug 14 11:15:33 2014 85.255.235.115:53825 LZO compression initialized
Thu Aug 14 11:15:35 2014 85.255.235.115:53825 [client2] Peer Connection Initiated with [AF_INET]85.255.235.115:53825
Thu Aug 14 11:15:35 2014 client2/85.255.235.115:53825 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=bccd:800:8ced:200:14c2:700:94b5:5701
Thu Aug 14 11:15:36 2014 client2/85.255.235.115:53825 send_push_reply(): safe_cap=960
Wed Sep  3 23:07:28 2014 86.143.84.115:64526 Re-using SSL/TLS context
Wed Sep  3 23:07:28 2014 86.143.84.115:64526 LZO compression initialized
Wed Sep  3 23:07:29 2014 86.143.84.115:64526 [client2] Peer Connection Initiated with [AF_INET]86.143.84.115:64526
Wed Sep  3 23:07:29 2014 client2/86.143.84.115:64526 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=bccd:800:8ced:200:14c2:700:dcb5:5901
Wed Sep  3 23:07:30 2014 client2/86.143.84.115:64526 send_push_reply(): safe_cap=960

ifconfig

eth0 Link encap:Ethernet HWaddr b8:27:eb:b8:77:6c
inet addr:192.168.0.99 Bcast:192.168.0.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1493755 errors:0 dropped:1358 overruns:0 frame:0
TX packets:1335322 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:655537691 (625.1 MiB) TX bytes:687144207 (655.3 MiB)

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:4 errors:0 dropped:0 overruns:0 frame:0
TX packets:4 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:552 (552.0 B) TX bytes:552 (552.0 B)

tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:379 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:21140 (20.6 KiB) TX bytes:0 (0.0 B)

And finally the client log (iOS)

2014-09-04 00:07:28 ----- OpenVPN Start (iOS 32-bit) -----
2014-09-04 00:07:28 UNUSED OPTIONS
3 [resolv-retry] [infinite]
4 [nobind]
5 [persist-key]
6 [persist-tun]
7 [mute-replay-warnings]
12 [verb] [1]
13 [mute] [20]

2014-09-04 00:07:28 LZO-ASYM init swap=0 asym=0
2014-09-04 00:07:28 EVENT: RESOLVE
2014-09-04 00:07:28 Contacting xx.xx.xxx.xxx:1194 via UDP
2014-09-04 00:07:28 EVENT: WAIT
2014-09-04 00:07:28 Connecting to xxx.dnsdynamic.com:1194 (xx.xx.xxx.xxx) via UDPv4
2014-09-04 00:07:28 EVENT: CONNECTING
2014-09-04 00:07:28 Tunnel Options:V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-128-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client
2014-09-04 00:07:28 Peer Info:
IV_GUI_VER=net.openvpn.connect.ios 1.0.4-140
IV_VER=3.0
IV_PLAT=ios
IV_NCP=1
IV_LZO=1

2014-09-04 00:07:29 VERIFY OK: depth=1
cert. version : 3
serial number : 9B:D0:9D:16:98:C5:0F:13
issuer name : C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=changeme, CN=changeme, 0x29=changeme, emailAddress=mail@host.domain
subject name : C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=changeme, CN=changeme, 0x29=changeme, emailAddress=mail@host.domain
issued on : 2014-04-07 21:38:39
expires on : 2024-04-04 21:38:39
signed using : RSA+SHA1
RSA key size : 1024 bits

2014-09-04 00:07:29 VERIFY OK: depth=0
cert. version : 3
serial number : 01
issuer name : C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=changeme, CN=changeme, 0x29=changeme, emailAddress=mail@host.domain
subject name : C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=changeme, CN=delemont, 0x29=changeme, emailAddress=mail@host.domain
issued on : 2014-04-07 21:39:29
expires on : 2024-04-04 21:39:29
signed using : RSA+SHA1
RSA key size : 1024 bits

2014-09-04 00:07:29 SSL Handshake: TLSv1.0/TLS-DHE-RSA-WITH-AES-256-CBC-SHA
2014-09-04 00:07:29 Session is ACTIVE
2014-09-04 00:07:30 EVENT: GET_CONFIG
2014-09-04 00:07:30 Sending PUSH_REQUEST to server...
2014-09-04 00:07:30 OPTIONS:
0 [route] [10.8.0.1] [255.255.255.255]
1 [route] [10.8.0.0] [255.255.255.0]
2 [route] [192.168.0.0] [255.255.255.0]
3 [dhcp-option] [DNS] [192.168.0.1]
4 [redirect-gateway] [def1]
5 [explicit-exit-notify] [3]
6 [route] [10.8.0.0] [255.255.255.0]
7 [topology] [net30]
8 [ping] [10]
9 [ping-restart] [120]
10 [ifconfig] [10.8.0.6] [10.8.0.5]

2014-09-04 00:07:30 LZO-ASYM init swap=0 asym=0
2014-09-04 00:07:30 EVENT: ASSIGN_IP
2014-09-04 00:07:30 Connected via tun
2014-09-04 00:07:30 EVENT: CONNECTED @xxx.dnsdynamic.com:1194 (xx.xx.xxx.xxx) via /UDPv4 on tun/10.8.0.6/
2014-09-04 00:07:30 NET Internet:ReachableViaWiFi/-R t----l-
2014-09-04 00:10:02 TUN teardown
2014-09-04 00:10:02 EVENT: DISCONNECTED
2014-09-04 00:10:02 Raw stats on disconnect:
BYTES_IN : 6210
BYTES_OUT : 41311
PACKETS_IN : 55
PACKETS_OUT : 384
TUN_BYTES_IN : 19896
TUN_PACKETS_IN : 341
2014-09-04 00:10:02 Performance stats on disconnect:
CPU usage (microseconds): 172893
Tunnel compression ratio (downlink): inf
Network bytes per CPU second: 274857
Tunnel bytes per CPU second: 115076
2014-09-04 00:10:02 ----- OpenVPN Stop -----
2014-09-04 00:10:02 NET Internet:ReachableViaWiFi/-R -----l-

steini

Apologies forgot the client and server config file. See below.

Traffic wrotesteini wrote:
The issue is that, once connected to the server, I cannot access internet. I believe the issue is because the router that is behind the server has some sort of ip4 to ip6 routing which I am not at all knowledgeable about.
You cannot access the internet from your iOS device once you connect to your raspberry pi ?

Yes that's the issue.

Thanks again for your help

server

local 192.168.0.99
dev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/delemont.crt
key /etc/openvpn/easy-rsa/keys/delemont.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
# server and remote endpoints
ifconfig 10.8.0.1 10.8.0.2
# Add route to Client routing table for the OpenVPN Server
push "route 10.8.0.1 255.255.255.255"
# Add route to Client routing table for the OpenVPN Subnet
push "route 10.8.0.0 255.255.255.0"
# your local subnet
push "route 192.168.0.0 255.255.255.0"
# Set primary domain name server address to the SOHO Router
# If your router does not do DNS, you can use Google DNS 8.8.8.8
push "dhcp-option DNS 192.168.0.1"
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
push "explicit-exit-notify 3"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 1

client

client
dev tun
remote xxx.dnsdynamic.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ns-cert-type server
key-direction 1
cipher AES-128-CBC
comp-lzo
verb 1
mute 20
<ca>

+ the keys thereafter which I have removed

I saw your link and I believe I'm settup properly with IP tables I have a script that loads the following line on booting up the pi

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.0.99

steini

I believe I do, I can try changing that on the server side. However, where I'm connecting from is a different subnet 172.16.0.64 - 172.16.255.254 whereas where the server is connected is the common one indeed. Hence I don't think that's the issue here. Would you agree?

steini

Traffic wroteYour current setup [192.168.0/24 vs 172.16.0/24] is not going to cause a problem .. but what happens when you use your iOS device on a different network .. which is also 192.168.0/24 ?

Yes, agreed I should change that. But need to get it first to work with my setup I think. No point going to spend time to get that working from a different network if I cannot get it to work from my network.

Traffic wroteYour iptables rule seems suitable although it is not the official method, but I have double checked and it works.
What other rules have you configured ?

I don't think I have any other rules configures. The tutorial I followed is [Copyrighted Material which is not available without Registration - Removed]. I'll read it through again to see if anything else was setup. But I don't think there's anything else

Traffic wroteI presume you have enabled IP Forwarding ?

I assume you mean the udp port that I use for the openvpn. Yes, that was done for both udp and tcp.

Thanks again for your hel

steini

Then it's forwarding (as the name suggest...) the external request of port 1194 to the ip Of the raspberry pi. Yes I have also done that and the address of the pj is setup as static also.

steini

Sincere apologies I didn't see that link you posted in the first place...

So yes I believe I have that ip forwarding is enabled given:

The line net.ipv4.ip_forward=1 is uncommented in /etc/sysctl.conf as well as applying the change by typing sysctl - p to apply changes in the server.