Raspberry PI VPN Problems - Probably Very Basic

smith7955

Hi,

I've been trying to set up a VPN using OpenVPN and a Raspberry Pi for what feels like months. I've followed a few different tutorials all without success - I keep getting stuck, think about giving up and then try again a few days later.

The latest tutorial I've tried is this one http://www.bbc.co.uk/news/technology-33548728. I got all the way to the end but I'm unable to connect using my adroid phone.

My IP address is 192.168.1.85.
I'm using NoIP to create a static public IP address.
I'm using a BT Home Hub, forwarding port 1194 to the Raspberry Pi.
I've imaginatively named the server 'Server'

My server configuration is as follows

local 192.168.1.85 # SWAP THIS NUMBER WITH YOUR RASPBERRY PI IP ADDRESS

dev tun

proto udp

port 1194

ca /etc/openvpn/easy-rsa/keys/ca.crt

cert /etc/openvpn/easy-rsa/keys/Server.crt # SWAP XX WITH YOUR SERVER NAME

key /etc/openvpn/easy-rsa/keys/Server.key # SWAP XX WITH YOUR SERVER NAME

dh /etc/openvpn/easy-rsa/keys/dh1024.pem # IF YOU CHANGED YOUR ENCRYPTION TO 2048, CHANGE THAT HERE

server 10.8.0.0 255.255.255.0

# server and remote endpoints

ifconfig 10.8.0.1 10.8.0.2

# Add route to Client routing table for the OpenVPN Server

push "route 10.8.0.1 255.255.255.255"

# Add route to Client routing table for the OpenVPN Subnet

push "route 10.8.0.0 255.255.255.0"

# your local subnet

push "route 192.168.1.85 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERRY PI IP ADDRESS

# Set primary domain name server address to the SOHO Router

# If your router does not do DNS, you can use Google DNS 8.8.8.8

push "dhcp-option DNS 192.168.0.1" # THIS SHOULD ALREADY MATCH YOUR OWN ROUTER ADDRESS AND SHOULD NOT NEED TO BE CHANGED

# Override the Client default gateway by using 0.0.0.0/1 and

# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of

# overriding but not wiping out the original default gateway.

push "redirect-gateway def1"

client-to-client

duplicate-cn

keepalive 10 120

tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0

cipher AES-128-CBC

comp-lzo

user nobody

group nogroup

persist-key

persist-tun

status /var/log/openvpn-status.log 20

log /var/log/openvpn.log

verb 1

The log file is as follows.

Sun Aug 23 20:12:49 2015 OpenVPN 2.2.1 arm-linux-gnueabihf [SSL] [LZO2] [EPOLL]$
Sun Aug 23 20:12:49 2015 NOTE: your local LAN uses the extremely common subnet $
Sun Aug 23 20:12:49 2015 NOTE: OpenVPN 2.1 requires '--script-security 2' or hi$
Sun Aug 23 20:12:49 2015 Control Channel Authentication: using '/etc/openvpn/ea$
Sun Aug 23 20:12:49 2015 TUN/TAP device tun0 opened
Sun Aug 23 20:12:49 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Aug 23 20:12:49 2015 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu $
Sun Aug 23 20:12:49 2015 GID set to nogroup
Sun Aug 23 20:12:49 2015 UID set to nobody
Sun Aug 23 20:12:49 2015 UDPv4 link local (bound): [AF_INET]192.168.1.85:1194
Sun Aug 23 20:12:49 2015 UDPv4 link remote: [undef]
Sun Aug 23 20:12:49 2015 Initialization Sequence Completed

I'm very much a newbie so may be missing something fairly obvious, if so sorry!

I'd be grateful if somebody could help me out.

Thanks

ABauer

Hi,

welcome! 😉

First of all, let me point out, that this is the section for the Access Server, which is an all-in one application package, including a web front-end for configuration.

This said, is it an option for you to install the access Server?

https://openvpn.net/index.php/access-server/download-openvpn-as-sw.html

I think this will ease a lot of your issues, as it makes configuration a lot more easier 🙂

Concerning your concrete problem:

- What distribution are you running on the Pi?
- What is you local network (192.168.1.0 or 192.168.0.0) (you got both in your config)
- Did you forward UDP or TCP in your router?
- What does your client config look like?

Cheers!

Traffic

Clearly, all the HOWTOs you have read are wrong:

smith7955 wroteserver 10.8.0.0 255.255.255.0

# server and remote endpoints

ifconfig 10.8.0.1 10.8.0.2 # <-- Delete this - Auto-configured by server command above.

# Add route to Client routing table for the OpenVPN Server

push "route 10.8.0.1 255.255.255.255" # <-- Delete this - Auto-configured by server command above.

# Add route to Client routing table for the OpenVPN Subnet

push "route 10.8.0.0 255.255.255.0" # <-- Delete this - Auto-configured by server command above.

# your local subnet

push "route 192.168.1.85 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
# ^ This is wrong, should be: 192.168.1.0 255.255.255.0

Try the official HOWTO:
HOWTO: For OpenVPN Community Edition

ABauer wroteWhat is you local network (192.168.1.0 or 192.168.0.0) (you got both in your config)

Here:

smith7955 wrote# If your router does not do DNS, you can use Google DNS 8.8.8.8

push "dhcp-option DNS 192.168.0.1" # THIS SHOULD ALREADY MATCH YOUR OWN ROUTER ADDRESS AND SHOULD NOT NEED TO BE CHANGED

Your Pi is not on that address and does your Pi do DNS ?

Also,

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

Never use either of those subnets on your server LAN ...

ABauer wroteThis said, is it an option for you to install the access Server?

https://openvpn.net/index.php/access-server/download-openvpn-as-sw.html

I think this will ease a lot of your issues, as it makes configuration a lot more easier

Personally, I disagree.

smith7955

Thanks very much to both of you for the advice.

I'll take it on board and let you know how I get on.

Thanks again!