Hi,
I'm using Raspbian on a Raspberry Pi and used the scripted install at
https://github.com/StarshipEngineer/OpenVPN-Setup which has worked successfully for others.
Symptoms/notes:-
- iOS OpenVPN Client connects but no internet. No errors in client log
- A couple of errors in the server log
- Made some changes to the original scripted configuration to change subnet from 255.255.255.0 to 255.255.255.255 and also in the iptables rules to use 32 rather than 24. This fixed an error I was originally seeing in the client
- I have a home network on 192.168.0.* to which I'd like to connect to from the internet. I would also like to be able to connect to local PCs on my home LAN.
- Also added key direction directive to get rid of another error
Any help greatly appreciated! I've been trying to get this to work for 2 weeks now and getting nowhere....
Server config:-
local 192.168.0.11
dev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
# server and remote endpoints
ifconfig 10.8.0.1 10.8.0.2
# Add route to Client routing table for the OpenVPN Server
push "route 10.8.0.1 255.255.255.255"
# Add route to Client routing table for the OPenVPN Subnet
push "route 10.8.0.0 255.255.255.0"
# your local subnet
push "route 192.168.0.11 255.255.255.255"
# Set your primary domain name server address to Google DNS 8.8.8.8
push "dhcp-option DNS 8.8.8.8"
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 1
# This configuration file was originally written by Lauren Orsini at ReadWrite.
key-direction 0
My server log is:-
Fri May 15 04:18:41 2015 OpenVPN 2.2.1 arm-linux-gnueabihf [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Dec 1 2014
Fri May 15 04:18:41 2015 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Fri May 15 04:18:41 2015 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Fri May 15 04:18:41 2015 Control Channel Authentication: using '/etc/openvpn/easy-rsa/keys/ta.key' as a OpenVPN static key file
Fri May 15 04:18:41 2015 TUN/TAP device tun0 opened
Fri May 15 04:18:41 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri May 15 04:18:41 2015 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Fri May 15 04:18:41 2015 GID set to nogroup
Fri May 15 04:18:41 2015 UID set to nobody
Fri May 15 04:18:41 2015 UDPv4 link local (bound): [AF_INET]192.168.0.11:1194
Fri May 15 04:18:41 2015 UDPv4 link remote: [undef]
Fri May 15 04:18:41 2015 Initialization Sequence Completed
Fri May 15 04:20:20 2015 188.29.164.93:62514 Re-using SSL/TLS context
Fri May 15 04:20:20 2015 188.29.164.93:62514 LZO compression initialized
Fri May 15 04:20:20 2015 188.29.164.93:62514 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1431663613) Fri May 15 04:20:13 2015 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Fri May 15 04:20:20 2015 188.29.164.93:62514 TLS Error: incoming packet authentication failed from [AF_INET]188.29.164.93:62514
Fri May 15 04:20:22 2015 188.29.164.93:62514 [chris-iphone] Peer Connection Initiated with [AF_INET]188.29.164.93:62514
Fri May 15 04:20:22 2015 chris-iphone/188.29.164.93:62514 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=e816:aebe:804e:f5b6:347b:fab6:c463:6cb8
Fri May 15 04:20:22 2015 chris-iphone/188.29.164.93:62514 send_push_reply(): safe_cap=960
Fri May 15 04:29:20 2015 188.29.164.93:62516 Re-using SSL/TLS context
Fri May 15 04:29:20 2015 188.29.164.93:62516 LZO compression initialized
Fri May 15 04:29:20 2015 188.29.164.93:62516 [chris-iphone] Peer Connection Initiated with [AF_INET]188.29.164.93:62516
Fri May 15 04:29:20 2015 chris-iphone/188.29.164.93:62516 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=e816:aebe:804e:f5b6:347b:fab6:44e8:6eb8
Fri May 15 04:29:20 2015 chris-iphone/188.29.164.93:62516 send_push_reply(): safe_cap=960
Fri May 15 04:29:31 2015 read UDPv4 [ECONNREFUSED|ECONNREFUSED]: Connection refused (code=111)
Fri May 15 04:29:34 2015 188.29.164.93:62517 Re-using SSL/TLS context
Fri May 15 04:29:34 2015 188.29.164.93:62517 LZO compression initialized
Fri May 15 04:29:35 2015 188.29.164.93:62517 [chris-iphone] Peer Connection Initiated with [AF_INET]188.29.164.93:62517
Fri May 15 04:29:35 2015 chris-iphone/188.29.164.93:62517 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=e816:aebe:804e:f5b6:347b:fab6:3c53:6bb8
Fri May 15 04:29:35 2015 chris-iphone/188.29.164.93:62517 send_push_reply(): safe_cap=960
Fri May 15 04:29:47 2015 188.29.164.93:62518 Re-using SSL/TLS context
Fri May 15 04:29:47 2015 188.29.164.93:62518 LZO compression initialized
Fri May 15 04:29:47 2015 188.29.164.93:62518 [chris-iphone] Peer Connection Initiated with [AF_INET]188.29.164.93:62518
My iOS client log file extract:-
2015-05-15 05:31:24 Connecting to me.duckdns.org:1194 (whatever) via UDPv4
2015-05-15 05:31:24 EVENT: CONNECTING
2015-05-15 05:31:24 Tunnel Options:V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-128-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client
2015-05-15 05:31:24 Peer Info:
IV_GUI_VER=net.openvpn.connect.ios 1.0.5-177
IV_VER=3.0
IV_PLAT=ios
IV_NCP=1
IV_LZO=1
2015-05-15 05:31:26 VERIFY OK: depth=1
cert. version : 3
serial number : B2:6D:3A:BB:B9:C8:39:54
issuer name : C=CO, ST=ST, L=CITY, O=ORG, OU=ORG-UNIT, CN=COMMON-NAME, ??=NAME, emailAddress=EMAIL
subject name : C=CO, ST=ST, L=CITY, O=ORG, OU=ORG-UNIT, CN=COMMON-NAME, ??=NAME, emailAddress=EMAIL
issued on : 2015-05-14 20:41:15
expires on : 2025-05-11 20:41:15
signed using : RSA with SHA1
RSA key size : 1024 bits
basic constraints : CA=true
2015-05-15 05:31:26 VERIFY OK: depth=0
cert. version : 3
serial number : 01
issuer name : C=CO, ST=ST, L=CITY, O=ORG, OU=ORG-UNIT, CN=COMMON-NAME, ??=NAME, emailAddress=EMAIL
subject name : C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=changeme, CN=server, ??=changeme, emailAddress=mail@host.domain
issued on : 2015-05-14 20:41:26
expires on : 2025-05-11 20:41:26
signed using : RSA with SHA1
RSA key size : 1024 bits
basic constraints : CA=false
cert. type : SSL Server
key usage : Digital Signature, Key Encipherment
ext key usage : TLS Web Server Authentication
2015-05-15 05:31:26 SSL Handshake: TLSv1.0/TLS-DHE-RSA-WITH-AES-256-CBC-SHA
2015-05-15 05:31:26 Session is ACTIVE
2015-05-15 05:31:26 EVENT: GET_CONFIG
2015-05-15 05:31:26 Sending PUSH_REQUEST to server...
2015-05-15 05:31:26 OPTIONS:
0 [route] [10.8.0.1] [255.255.255.255]
1 [route] [10.8.0.0] [255.255.255.0]
2 [route] [192.168.0.11] [255.255.255.255]
3 [dhcp-option] [DNS] [8.8.8.8]
4 [redirect-gateway] [def1]
5 [route] [10.8.0.0] [255.255.255.0]
6 [topology] [net30]
7 [ping] [10]
8 [ping-restart] [120]
9 [ifconfig] [10.8.0.6] [10.8.0.5]
2015-05-15 05:31:26 LZO-ASYM init swap=0 asym=0
2015-05-15 05:31:26 EVENT: ASSIGN_IP
2015-05-15 05:31:26 Connected via tun
2015-05-15 05:31:26 EVENT: CONNECTED @me.duckdns.org:1194 (82.43.187.68) via /UDPv4 on tun/10.8.0.6/
2015-05-15 05:31:26 NET WiFi:NotReachable/WR t------
2015-05-15 05:31:26 NET Internet:ReachableViaWWAN/WR t----l-
2015-05-15 05:31:26 SetStatus Connected
2015-05-15 05:32:13 NET WiFi:ReachableViaWiFi/-R ------d
