Firstly, apologies if this post is in the wrong area of the forum. I've been working with OpenVPN for the last eighteen months and consider myself an amateur when it comes to OpenVPN so if any of these questions appear to have glaringly obvious answers it's because I have no no formal education dealing with the protocol; if I come off as a noob it's because I am! I have a Raspberry Pi acting as an OpenVPN server [tun1 - 10.40.0.0] for my home network. I can connect to this server from off the network without issue. On the same Pi when the server is brought down, I can successfully establish a connection to the external VPN [tun0 - 10.4.0.0] and with iptables, can get it to act as an OpenVPN gateway for other machines I would like to setup a client config on the pi to connect to an external VPN service for secure web browsing while the server config is up and I want to learn how to get the server config and client config to interact with each other on the same system without conflicting with one another. Server Config [code]local 192.168.1.1 dev tun1 proto udp #Some people prefer to use tcp. Don't change it if you don't know. port 1194 ca /etc/openvpn/easy-rsa/keys/ca.crt cert /etc/openvpn/easy-rsa/keys/Server.crt # SWAP WITH YOUR CRT NAME key /etc/openvpn/easy-rsa/keys/Server.key # SWAP WITH YOUR KEY NAME dh /etc/openvpn/easy-rsa/keys/dh1024.pem # If you changed to 2048, change that here! server 10.40.0.0 255.255.255.0 # server and remote endpoints ifconfig 10.40.0.1 10.40.0.2 # Add route to Client routing table for the OpenVPN Server push "route 10.40.0.1 255.255.255.255" # Add route to Client routing table for the OpenVPN Subnet push "route 10.40.0.0 255.255.255.0" # your local subnet push "route 192.168.1.1 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERRY PI IP ADDRESS # Set primary domain name server address to the SOHO Router # If your router does not do DNS, you can use Google DNS 8.8.8.8 push "dhcp-option DNS 8.8.8.8" # This should already match your router address and not need to be changed. # Override the Client default gateway by using 0.0.0.0/1 and # 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of # overriding but not wiping out the original default gateway. push "redirect-gateway def1" client-to-client duplicate-cn keepalive 10 120 tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0 cipher AES-128-CBC comp-lzo user nobody group nogroup persist-key persist-tun status /var/log/openvpn-status.log 20 log /var/log/openvpn.log verb 1[/code] Server iptables -t nat -S [code]-A POSTROUTING -s 10.40.0.0/24 -o eth0 -j SNAT --to-source 192.168.1.1[/code] Server Routing Table [code]Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 192.168.1.254 0.0.0.0 UG 0 0 0 eth0 0.0.0.0 192.168.1.254 0.0.0.0 UG 202 0 0 eth0 10.40.0.0 10.40.0.2 255.255.255.0 UG 0 0 0 tun1 10.40.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun1 192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 192.168.1.0 0.0.0.0 255.255.255.0 U 202 0 0 eth0[/code] Client config [code]client dev tun0 proto udp remote 443 resolv-retry infinite nobind persist-key persist-tun remote-cert-tls server cipher AES-256-CBC comp-lzo no route-delay 5 verb 3 explicit-exit-notify 5 [/code] Client iptables [code]sudo iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE sudo iptables -A FORWARD -i tun0 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT sudo iptables -A FORWARD -i eth0 -o tun0 -j ACCEPT[/code] Client route -n [code]Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 10.4.0.1 128.0.0.0 UG 0 0 0 tun0 0.0.0.0 192.168.1.254 0.0.0.0 UG 0 0 0 eth0 0.0.0.0 192.168.1.254 0.0.0.0 UG 202 0 0 eth0 10.4.0.0 0.0.0.0 255.255.0.0 U 0 0 0 tun0 128.0.0.0 10.4.0.1 128.0.0.0 UG 0 0 0 tun0 192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 192.168.1.0 0.0.0.0 255.255.255.0 U 202 0 0 eth0 199.19.94.61 192.168.1.254 255.255.255.255 UGH 0 0 0 eth0[/code] Routing table (Service and Client running simultaneously [code]Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 10.4.0.1 128.0.0.0 UG 0 0 0 tun0 0.0.0.0 192.168.1.254 0.0.0.0 UG 0 0 0 eth0 0.0.0.0 192.168.1.254 0.0.0.0 UG 202 0 0 eth0 10.4.0.0 0.0.0.0 255.255.0.0 U 0 0 0 tun0 10.40.0.0 10.40.0.2 255.255.255.0 UG 0 0 0 tun1 10.40.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun1 128.0.0.0 10.4.0.1 128.0.0.0 UG 0 0 0 tun0 192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 192.168.1.0 0.0.0.0 255.255.255.0 U 202 0 0 eth0 199.19.94.61 192.168.1.254 255.255.255.255 UGH 0 0 0 eth0[/code] ifconfig [code]eth0 Link encap:Ethernet HWaddr xx:xx:xx:xx:xx:xx inet addr:192.168.1.1 Bcast:255.255.255.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:22244 errors:0 dropped:5 overruns:0 frame:0 TX packets:20446 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:9612163 (9.1 MiB) TX bytes:9960920 (9.4 MiB) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:10.4.15.101 P-t-P:10.4.15.101 Mask:255.255.0.0 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 RX packets:291 errors:0 dropped:0 overruns:0 frame:0 TX packets:348 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:60264 (58.8 KiB) TX bytes:52590 (51.3 KiB) tun1 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:10.40.0.1 P-t-P:10.40.0.2 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)[/code] I'm completely at a loss as so how to troubleshoot this issue and given the specific nature of the iptables or route required to get the two to function simultaneously, I finally had to bite the bullet and register here and ask for the help of those who actually know what they're doing! My guess is that these aren't the best iptables to use for this setup or I need to add an extra route. And if you could take me through things step by step and offer the exact codes and syntax I should input I'd be very grateful. If you need to see logs or anything else, please ask. Thanks for reading this and I appreciate any help you can offer!

First: [list]NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create [b]routing conflicts[/b] if you connect to the VPN server from public locations such as internet cafes that use the same subnet.[/list] When you connect your client to your server this works but when you connect your server to the external VPN your own VPN breaks ?

Server and client on the same machine simultaneously

sooprtruffaut

Firstly, apologies if this post is in the wrong area of the forum.
I've been working with OpenVPN for the last eighteen months and consider myself an amateur when it comes to OpenVPN so if any of these questions appear to have glaringly obvious answers it's because I have no no formal education dealing with the protocol; if I come off as a noob it's because I am!

I have a Raspberry Pi acting as an OpenVPN server [tun1 - 10.40.0.0] for my home network. I can connect to this server from off the network without issue.

On the same Pi when the server is brought down, I can successfully establish a connection to the external VPN [tun0 - 10.4.0.0] and with iptables, can get it to act as an OpenVPN gateway for other machines

I would like to setup a client config on the pi to connect to an external VPN service for secure web browsing while the server config is up and I want to learn how to get the server config and client config to interact with each other on the same system without conflicting with one another.

Server Config

local 192.168.1.1
dev tun1 
proto udp #Some people prefer to use tcp. Don't change it if you don't know.
port 1194 
ca /etc/openvpn/easy-rsa/keys/ca.crt 
cert /etc/openvpn/easy-rsa/keys/Server.crt # SWAP WITH YOUR CRT NAME
key /etc/openvpn/easy-rsa/keys/Server.key # SWAP WITH YOUR KEY NAME
dh /etc/openvpn/easy-rsa/keys/dh1024.pem # If you changed to 2048, change that here!
server 10.40.0.0 255.255.255.0 
# server and remote endpoints 
ifconfig 10.40.0.1 10.40.0.2 
# Add route to Client routing table for the OpenVPN Server 
push "route 10.40.0.1 255.255.255.255" 
# Add route to Client routing table for the OpenVPN Subnet 
push "route 10.40.0.0 255.255.255.0" 
# your local subnet 
push "route 192.168.1.1 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
# Set primary domain name server address to the SOHO Router 
# If your router does not do DNS, you can use Google DNS 8.8.8.8 
push "dhcp-option DNS 8.8.8.8" # This should already match your router address and not need to be changed.
# Override the Client default gateway by using 0.0.0.0/1 and 
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of 
# overriding but not wiping out the original default gateway. 
push "redirect-gateway def1" 
client-to-client 
duplicate-cn 
keepalive 10 120 
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0 
cipher AES-128-CBC 
comp-lzo 
user nobody 
group nogroup 
persist-key 
persist-tun 
status /var/log/openvpn-status.log 20 
log /var/log/openvpn.log 
verb 1

Server iptables -t nat -S

-A POSTROUTING -s 10.40.0.0/24 -o eth0 -j SNAT --to-source 192.168.1.1

Server Routing Table

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.254   0.0.0.0         UG    0      0        0 eth0
0.0.0.0         192.168.1.254   0.0.0.0         UG    202    0        0 eth0
10.40.0.0       10.40.0.2       255.255.255.0   UG    0      0        0 tun1
10.40.0.2       0.0.0.0         255.255.255.255 UH    0      0        0 tun1
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
192.168.1.0     0.0.0.0         255.255.255.0   U     202    0        0 eth0

Client config

client
dev tun0
proto udp
remote <remote IP> 443
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-CBC
comp-lzo no
route-delay 5
verb 3
explicit-exit-notify 5
<ca>

Client iptables

sudo iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
sudo iptables -A FORWARD -i tun0 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A FORWARD -i eth0 -o tun0 -j ACCEPT

Client route -n

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.4.0.1        128.0.0.0       UG    0      0        0 tun0
0.0.0.0         192.168.1.254   0.0.0.0         UG    0      0        0 eth0
0.0.0.0         192.168.1.254   0.0.0.0         UG    202    0        0 eth0
10.4.0.0        0.0.0.0         255.255.0.0     U     0      0        0 tun0
128.0.0.0       10.4.0.1        128.0.0.0       UG    0      0        0 tun0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
192.168.1.0     0.0.0.0         255.255.255.0   U     202    0        0 eth0
199.19.94.61    192.168.1.254   255.255.255.255 UGH   0      0        0 eth0

Routing table (Service and Client running simultaneously

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.4.0.1        128.0.0.0       UG    0      0        0 tun0
0.0.0.0         192.168.1.254   0.0.0.0         UG    0      0        0 eth0
0.0.0.0         192.168.1.254   0.0.0.0         UG    202    0        0 eth0
10.4.0.0        0.0.0.0         255.255.0.0     U     0      0        0 tun0
10.40.0.0       10.40.0.2       255.255.255.0   UG    0      0        0 tun1
10.40.0.2       0.0.0.0         255.255.255.255 UH    0      0        0 tun1
128.0.0.0       10.4.0.1        128.0.0.0       UG    0      0        0 tun0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
192.168.1.0     0.0.0.0         255.255.255.0   U     202    0        0 eth0
199.19.94.61    192.168.1.254   255.255.255.255 UGH   0      0        0 eth0

ifconfig

eth0      Link encap:Ethernet  HWaddr xx:xx:xx:xx:xx:xx  
          inet addr:192.168.1.1  Bcast:255.255.255.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:22244 errors:0 dropped:5 overruns:0 frame:0
          TX packets:20446 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:9612163 (9.1 MiB)  TX bytes:9960920 (9.4 MiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.4.15.101  P-t-P:10.4.15.101  Mask:255.255.0.0
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:291 errors:0 dropped:0 overruns:0 frame:0
          TX packets:348 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:60264 (58.8 KiB)  TX bytes:52590 (51.3 KiB)

tun1      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.40.0.1  P-t-P:10.40.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

I'm completely at a loss as so how to troubleshoot this issue and given the specific nature of the iptables or route required to get the two to function simultaneously, I finally had to bite the bullet and register here and ask for the help of those who actually know what they're doing!

My guess is that these aren't the best iptables to use for this setup or I need to add an extra route. And if you could take me through things step by step and offer the exact codes and syntax I should input I'd be very grateful. If you need to see logs or anything else, please ask.

Thanks for reading this and I appreciate any help you can offer!

Traffic

First:

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

When you connect your client to your server this works but when you connect your server to the external VPN your own VPN breaks ?

sooprtruffaut

Hello, thanks for getting back to me!

When I bring the client config on the Raspberry Pi up and connect it to the paid VPN service it connects and gives me the new WAN IP of the offsite VPN.

The problem is when I try to connect my phone on mobile data to the server config on the Raspberry Pi it times out when trying to reach my home network, so connecting to VPN service means my phone can no longer connect to my LAN.

ifmifmh

Bump.

I would like to do something similar to what the OP is trying to do: though, I want to connect to my home server and obtain my home dynamic ip (given to me by my isp), but also have a client connected on the home server to a different openvpn service provider (e.g., PIA, Torguard, IVPN, etc.).

I don't know if this is even possible! Could anyone help?!

GandhiLives

I have this same issue. I can get either to work, but not both simultaneously. Any advice would be appreciated.