Trouble connecting to local webserver with IOS

paulg1981

I am having some trouble with my openvpn installation. Everything is working properly from my home wifi and cellular, the issue is at work. I can connect to no problem and browse the internet but when I try to access a local (to the vpn) resource I get a cryptic error on my iphone:

"Safari cannot open the page because it could not establish a secure connection to the server"

I can browse the local website when connected from my work laptop via the vpn with no issues. When I look in the nginx logs there are no references to the iphone trying to connect so it must be losing the traffic before it hits the webserver but I am at a loss to see why if it works on my windows work laptop.

Here is my server.conf

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn.status
verb 4
crl-verify crl.pem
topology subnet

And here is the client config:

client
dev tun
proto udp
remote server.address.com 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ns-cert-type server
comp-lzo
verb 4
<ca>
-----BEGIN CERTIFICATE-----
xxx-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
xxx
</cert>
<key>
-----BEGIN PRIVATE KEY-----
xxxxx
-----END PRIVATE KEY-----
</key>

I have also tried using a vpn service via the same OpenVPN app on ios and I am able to reach the vpn server's websites no problem. So I am thinking there must be an issue with passing the local traffic through the vpn on the server but unfortunately I am unable to find the solution.

I have also double checked that ip_forwarding is enabled and I have a rule in iptables to allow forwarding as well as accept traffic from the devices:

-A POSTROUTING -s 10.8.0.0/8 -o p1p1 -j SNAT --to-source 123.456.789.000 (my public ip)

net.ipv4.ip_forward

-A INPUT -i tun+ -j ACCEPT

If someone could tell me where I went wrong or what I missed it would be greatly appreciated. Thanks for taking the time!

Paul

paulg1981

Just wanted to clarify that the webserver I am having trouble with is on the same server as the vpn.

Traffic

What is your server's LAN IP address ?

paulg1981

Traffic wroteWhat is your server's LAN IP address ?

10.8.0.1 is the local ip of the vpn (tun0)

Thanks for taking the time to reply

paulg1981

I hope I answered your question above. I only have one public facing ip. This machine is a rented dedicated server so I don't have it 'networked' locally as a home server or anything. Only have loopback, p1p1, and tun0 for network devices.

Traffic

paulg1981 wroteEverything is working properly from my home wifi and cellular, the issue is at work. I can connect to no problem and browse the internet but when I try to access a local (to the vpn) resource I get a cryptic error on my iphone:

"Safari cannot open the page because it could not establish a secure connection to the server"

I don't think the problem is with openvpn .. maybe you can ask for help from your server provider.

paulg1981

Could be, I am just confused as to why it works as expected everywhere but work?

Traffic

For testing disable the redirect-gateway option in the server config and try again.

Redirect-gateway sets up a specific route to your OpenVPN Server via your LAN
connection, otherwise you would route your vpn via your vpn, which breaks it.

paulg1981

Ok I will give it a shot tomorrow when I go in. Are you expecting for me to lose connectivity to everything via the vpn with redirect gateway removed? What should I be looking for?

Traffic

You are trying to this:

paulg1981 wroteat work. I can connect to no problem and browse the internet but when I try to access a local (to the vpn) resource I get a cryptic error on my iphone:

"Safari cannot open the page because it could not establish a secure connection to the server"

try loading that page again .. clear your browser cache if possible.

paulg1981

Okay so I solved the problem on one box simply by putting the openvpn server on a different IP on the same machine.

I would really like to know how to get it working on just a single ip for the webserver and openvpn. I think I understand the problem:

During a vpn session the client requests a webpage that is on the same ip as the openvpn server -> the requests doesn't reach the external facing ip as the vpn is connected over the same ip. The request is sent outside the vpn tunnel (i am guessing) so:

at work the request is dropped and I get the 'cannot connect error'
eslewhere where the request is not blocked the page loads.

So it would seem I need some way to tell the vpn server 10.8.0.0 how to route the requests for the local domain to the external facing ip on the same server?

I am just spitballing here and by no means have any expertise (obviously!) but if someone could tell me how to accomplish that I would appreciate it. I have googled a lot and I have seen answers that vary from setting a default route for the external ip, to running a bind instance to give the vpn another dns for connected users and I am just not sure which way to go!

Traffic

paulg1981 wroteOkay so I solved the problem on one box simply by putting the openvpn server on a different IP on the same machine.

Which is one way to go ..

paulg1981 wroteI would really like to know how to get it working on just a single ip for the webserver and openvpn

You can use the internal IP of the server. EG http://10.8.0.1:80/index.html - this will go via the tunnel and allow you to re-enable redirect-gateway ..