[Solved]Raspberry Pi VPN-Can't connect at all outside of LAN

ThereGoesMySanity

Neither my laptop nor my phone can connect outside of my LAN - I've forwarded port 1194 TCP

Here's server.conf:

local 192.168.1.147
dev tun
proto tcp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/PiVPN.crt
key /etc/openvpn/easy-rsa/keys/PiVPN.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig 10.8.0.1 10.8.0.2
push "route 10.8.0.1 255.255.255.255"
push "route 10.8.0.0 255.255.255.0"
push "route 192.168.1.147 255.255.255.0"
push "dhcp-option DNS 8.8.8.8"
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 1

Here's an ifconfig with the VPN running:

eth0      Link encap:Ethernet  HWaddr b8:27:eb:92:ce:b9
          inet addr:192.168.1.147  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:612190 errors:0 dropped:185 overruns:0 frame:0
          TX packets:303151 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:226620402 (216.1 MiB)  TX bytes:64094113 (61.1 MiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:991 errors:0 dropped:0 overruns:0 frame:0
          TX packets:991 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:70213 (68.5 KiB)  TX bytes:70213 (68.5 KiB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

Honestly, I feel like it's a router issue but I don't know what it could be, considering I've already port forwarded

maikcat

posting your client config and both sides logs would help,

also you can safely remove these from server config:

ifconfig 10.8.0.1 10.8.0.2
push "route 10.8.0.1 255.255.255.255"
push "route 10.8.0.0 255.255.255.0"

also use verb 3 or higher for troubleshooting...

Michael.

Traffic

This is wrong:

ThereGoesMySanity wrotepush "route 192.168.1.147 255.255.255.0"

You mean either:

push "route 192.168.1.0 255.255.255.0"
.. or ..
push "route 192.168.1.147"

FYI:

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

ThereGoesMySanity

Traffic wroteThis is wrong:
ThereGoesMySanity wrotepush "route 192.168.1.147 255.255.255.0"
You mean either:
push "route 192.168.1.0 255.255.255.0"
.. or ..

push "route 192.168.1.147"
FYI:
NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

That server.conf is mostly from the tutorial, what's the difference between

push "route 192.168.1.0 255.255.255.0"
.. or ..
push "route 192.168.1.147"

and which one should I use?

Also, it isn't a routing conflict. The only place I've tried to connect from uses 10.252.X.X

maikcat

That server.conf is mostly from the tutorial, what's the difference between

push "route 192.168.1.0 255.255.255.0"
.. or ..
push "route 192.168.1.147"

and which one should I use?

the first one is a route to network but the second one is a route to host which
should use 32 bit mask instead of 24 -or- ommit the mask portion...

did you read my first response btw?

Michael.

ThereGoesMySanity

I can't figure out how to get the server log, but here's a client one

2015-04-16 08:00:05 LZO-ASYM init swap=0 asym=0
2015-04-16 08:00:05 EVENT: RESOLVE
2015-04-16 08:00:05 Contacting [external ip]:1194 via TCP
2015-04-16 08:00:05 EVENT: WAIT
2015-04-16 08:00:05 SetTunnelSocket returned 1
2015-04-16 08:00:15 Server poll timeout, trying next remote entry...
2015-04-16 08:00:15 EVENT: RECONNECTING
2015-04-16 08:00:15 LZO-ASYM init swap=0 asym=0
2015-04-16 08:00:15 EVENT: RESOLVE
2015-04-16 08:00:15 Contacting [external ip]:1194 via TCP
2015-04-16 08:00:15 EVENT: WAIT
2015-04-16 08:00:15 SetTunnelSocket returned 1
2015-04-16 08:00:25 Server poll timeout, trying next remote entry...
2015-04-16 08:00:25 EVENT: RECONNECTING
2015-04-16 08:00:25 LZO-ASYM init swap=0 asym=0
2015-04-16 08:00:25 EVENT: RESOLVE
2015-04-16 08:00:25 Contacting [external ip]:1194 via TCP
2015-04-16 08:00:25 EVENT: WAIT
2015-04-16 08:00:25 SetTunnelSocket returned 1
2015-04-16 08:00:35 Server poll timeout, trying next remote entry...

maikcat

log /var/log/openvpn.log

this is your log file,please post its contents...

Michael.

Traffic

ThereGoesMySanity wroteand which one should I use?

depends what you require but most likely you want push "route 192.168.1.0 255.255.255.0"

ThereGoesMySanity wrotemy laptop nor my phone can connect outside of my LAN

did you enable the supported NAT rule on your server ?

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

ThereGoesMySanity wroteit isn't a routing conflict. The only place I've tried to connect from uses 10.252.X.X

but when you go somewhere else it may cause a conflict .. you a strongly advised to change your server LAN ..

ThereGoesMySanity wrote2015-04-16 08:00:15 Server poll timeout, trying next remote entry...

looks like you have not setup port-forward on your server correctly .. or firewall is blocking you .. as Micheal asked .. post your server log and we may be able to determine which it is.

ThereGoesMySanity

Okay, cool. Here's the server log.

Thu Apr 16 20:04:09 2015 OpenVPN 2.2.1 arm-linux-gnueabihf [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Dec  1 2014
Thu Apr 16 20:04:09 2015 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Thu Apr 16 20:04:09 2015 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu Apr 16 20:04:09 2015 Diffie-Hellman initialized with 1024 bit key
Thu Apr 16 20:04:09 2015 Control Channel Authentication: using '/etc/openvpn/easy-rsa/keys/ta.key' as a OpenVPN static key file
Thu Apr 16 20:04:09 2015 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Apr 16 20:04:09 2015 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Apr 16 20:04:09 2015 TLS-Auth MTU parms [ L:1560 D:168 EF:68 EB:0 ET:0 EL:0 ]
Thu Apr 16 20:04:09 2015 Socket Buffers: R=[87380->131072] S=[16384->131072]
Thu Apr 16 20:04:09 2015 ROUTE default_gateway=192.168.1.254
Thu Apr 16 20:04:09 2015 TUN/TAP device tun0 opened
Thu Apr 16 20:04:09 2015 TUN/TAP TX queue length set to 100
Thu Apr 16 20:04:09 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Apr 16 20:04:09 2015 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Thu Apr 16 20:04:09 2015 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Thu Apr 16 20:04:09 2015 Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Apr 16 20:04:09 2015 GID set to nogroup
Thu Apr 16 20:04:09 2015 UID set to nobody
Thu Apr 16 20:04:09 2015 Listening for incoming TCP connection on [AF_INET]192.168.1.147:1194
Thu Apr 16 20:04:09 2015 TCPv4_SERVER link local (bound): [AF_INET]192.168.1.147:1194
Thu Apr 16 20:04:09 2015 TCPv4_SERVER link remote: [undef]
Thu Apr 16 20:04:09 2015 MULTI: multi_init called, r=256 v=256
Thu Apr 16 20:04:09 2015 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Thu Apr 16 20:04:09 2015 MULTI: TCP INIT maxclients=1024 maxevents=1028
Thu Apr 16 20:04:09 2015 Initialization Sequence Completed
Thu Apr 16 20:05:06 2015 TCP/UDP: Closing socket
Thu Apr 16 20:05:06 2015 /sbin/route del -net 10.8.0.0 netmask 255.255.255.0
SIOCDELRT: Operation not permitted
Thu Apr 16 20:05:06 2015 ERROR: Linux route delete command failed: external program exited with error status: 7
Thu Apr 16 20:05:06 2015 Closing TUN/TAP interface
Thu Apr 16 20:05:06 2015 /sbin/ifconfig tun0 0.0.0.0
SIOCSIFADDR: Permission denied
SIOCSIFFLAGS: Permission denied
Thu Apr 16 20:05:06 2015 Linux ip addr del failed: external program exited with error status: 255
Thu Apr 16 20:05:06 2015 SIGTERM[hard,] received, process exiting

Traffic

For testing remove this from your server:

user nobody
group nogroup

then try again ..

You need to leave your server up .. then try connecting from your client.
Your server log must show that the client attempts a connection.

Use --verb 4 in both server and client config.

ThereGoesMySanity

Is there any way to simulate connecting from outside of my LAN without actually being outside of my LAN?

Traffic

There are ways but they are far to complex for you to worry about. They involve virtual machines and multiple routers and all sorts of other shinnanigans that I am not prepared to discuss. However, you do have my sympathy that it is annoying to have to keep on changing locations.

The simplest thing to do is setup your client and leave it running then be at your server .. almost everything can be configured from the server and pushed to the client.

You can connect to your server while in the same LAN but expect a few minor errors which can be over looked until you are at your client site.

ThereGoesMySanity

Okay, so it appears to be fixed (I realized I could use my phone's data to test). It was partially my stupidity (I edited the port forwarding to include UDP and forgot to reapply it), and I believe that this was also part of the problem.

Traffic wroteThis is wrong:
ThereGoesMySanity wrotepush "route 192.168.1.147 255.255.255.0"

Thanks for all the help!

Traffic

Excellent :mrgreen: Well done .. always double check

Can we close this as solved ?

Regards

ThereGoesMySanity

Go ahead! (for 15 character limit)