newbe server setup: addr pair mask parse error

nlaurens

Dear all,

I tried to set up a openvpn server on my raspberry pi using this tutorial. http://readwrite.com/2014/04/10/raspberry-pi-vpn-tutorial-server-secure-web-browsing
To test if it did work I used the openvpn app on ios. I managed to get a connection (the app at least says connected) but there isn't any data transmission (ie a few kb) and the app is spitting out errors.

these are AddrMaskPair (addr pair_mask_parse_error) and ip_exception (error parsing route IP addres). The second also says 192.168.178.14/24/225.225.0

This is how I configured server.conf

GNU nano 2.2.6                                     Bestand: /etc/openvpn/server.conf                                                                                 

local 192.168.178.14 # SWAP THIS NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
dev tun
proto udp #Some people prefer to use tcp. Don't change it if you don't know.
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt # SWAP WITH YOUR CRT NAME
key /etc/openvpn/easy-rsa/keys/server.key # SWAP WITH YOUR KEY NAME
dh /etc/openvpn/easy-rsa/keys/dh1024.pem # If you changed to 2048, change that here!
server 10.8.0.0 255.255.255.0
# server and remote endpoints
ifconfig 10.8.0.1 10.8.0.2
# Add route to Client routing table for the OpenVPN Server
push "route 10.8.0.1 255.255.255.255"
# Add route to Client routing table for the OpenVPN Subnet
push "route 10.8.0.0 255.255.255.0"
# your local subnet
push "route 192.168.178.14 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
# Set primary domain name server address to the SOHO Router
# If your router does not do DNS, you can use Google DNS 8.8.8.8
push "dhcp-option DNS 192.168.178.14" # This should already match your router address and not need to be changed.
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client 
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 1

My ifconfig echoes:

pi@laurenspi ~ $ ifconfig
eth0      Link encap:Ethernet  HWaddr b8:27:eb:6e:02:9f  
          inet addr:192.168.178.14  Bcast:192.168.178.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:29907 errors:0 dropped:0 overruns:0 frame:0
          TX packets:34421 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:3480366 (3.3 MiB)  TX bytes:10784140 (10.2 MiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:35171 errors:0 dropped:0 overruns:0 frame:0
          TX packets:35171 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:393862962 (375.6 MiB)  TX bytes:393862962 (375.6 MiB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

my router is at 192.168.178.1 and the pi has a fixed local ip

After doing a search online I found a few users with kind off the same issue, but nothing did work.
So I'm at a blank, what is the solution?

p.s. What do I have to get besides 1194 a tunnel on port 110 as well? (to bypass nasty non net neutral hotel wifi, which usually just is port filtering)

Any help would be much appreciated!

Kind gerards

Laurens

Traffic

nlaurens wroteip_exception (error parsing route IP addres)

Change this in your server config:

nlaurens wrotepush "route 192.168.178.14 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERRY PI IP ADDRESS

push "route 192.168.178.0 255.255.255.0"

nlaurens wrotep.s. What do I have to get besides 1194 a tunnel on port 110 as well? (to bypass nasty non net neutral hotel wifi, which usually just is port filtering)

Usually, your best option is to use TCP:443 (HTTPS) as your server proto:port .. change your client to match.

nlaurens

Thanks a lot! I finally got time to test it today and the errors are gone. Although connection appears to be successful (both on ios and windows clients) I don't manage to receive any data through the tunnel. Ie pages still won't load and after 5 minutes approx 55kb went out and got 6kb went in, most of the incoming traffic was at the time of connecting.

Do you perhaps have any clue?

Laurens

Traffic

Have you enabled ip forwarding and NAT on your server ?

nlaurens

I did do port forwarding on my router. I assigned the pi to 192.168.178.14 and enabled port forwarding on port 1194 to my pi. I did the same for a few other ports, they (apache, owncloud and drp) are up and running. A port test using Nmap reported: 1194/udp open|filtered openvpn .

Does this rule out a firewall issue or not? Might it be a subnet related issue then? (although I would expect an error in the client logfile then)

kind gegards

laurens

nlaurens

I have enabled ip forwarding on my router. NAT not that I'm aware of. (i.e. it wasn't stated in the readwrite / sans manual)

The things I'm suspecting causing issues are: router and server not having dhcp, iptables / firewall iussue, or perhaps still a subnet conflict (althow the last should cause an error on the client, which there isn't). What might be the clue?

nlaurens

Ip forwarding is enabled on my router on port 1194. (i can rdp into my pi from anywhere, so i suppose port 1194 is working as well) The internal ip is fixed. NAT is not enabled, or not that I'm aware of. It was not on the sans / readwrite manual that I followed. Might that be the issue?

Other things I'm suspecting or not shure of are: an iptables firewall issue, not having dhcp on the router / server, or perhaps still a subnet issue (what might be strange since there are no errors on clients).

What might be the key?

kind gerards

laurens