Hi,
I'm trying to set up OpenVPN on a RaspberryPi (Raspbian/Debian 3.18.5-1~exp1+rpi9).
I've followed the tutorial on
http://readwrite.com/2014/04/10/raspberry-pi-vpn-tutorial-server-secure-web-browsing.
Now I can connect to the RasPi and I can ping both its virtual IP and its IP in its local network, but I can't ping other computers on the LAN or on the 'net. I also can't see the SAMBA shares the RasPi publishes on the local network.
Any help getting a) the connection to the outside 'net through the RasPi and b) access to the SAMBA shares working would be greatly appreciated.
Technical details:
I've tried connecting from a Windows and with a Linux Laptop. The Linux Laptop has previously been used to connect to other VPNs successfully (though not OpenVPN).
server config:
local 192.168.0.150
dev tun
proto udp
port 4500
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/[some name].crt
key /etc/openvpn/easy-rsa/keys/[some name].key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig 10.8.0.1 10.8.0.2
push "route 10.8.0.1 255.255.255.255"
push "route 10.8.0.0 255.255.255.0"
push "route 192.168.0.0 255.255.255.0"
push "dhcp-option DNS 192.168.0.1"
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 1
Client config:
client
dev tun
proto udp
remote [a dynamic hostname that is resolved via DuckDNS] 4500
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ns-cert-type server
key-direction 1
cipher AES-128-CBC
comp-lzo
verb 1
mute 20
(Plus NetworkManager-side configuration of keys.)
The only firewall rule I apply is this:
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.0.150
Consequently,
iptables -t nat -L
gives me
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
SNAT all -- 10.8.0.0/24 anywhere to:192.168.0.150
all -- anywhere anywhere
All other chains (PREROUTING, INPUT, OUTPUT, FORWARD) are empty and have policy ACCEPT.
Forwarding is enabled:
root@VPNPI:~# sysctl -p
net.ipv4.ip_forward = 1
Hmm... I feel like there's some other diagnostic info I could give, but I can't think of it right now. Let me know if anything is missing.
Thank you,
Johannes
