Hi all - first post here so please forgive me if I am unintentionally breaking any rules. As the subject suggests, I have no Internet over VPN, but I can use SSH and SFTP. I'm on a Pi2 running Raspbian (DietPi respin) using the [i]openvpn[/i] package from the standard repo. I've gone through the OpenVPN HOW-TO file twice, but can't figure out where the setup breaks down. I suspect it is in the firewall setup as firewalls are not my forte. Any help and/or insight would be greatly appreciated! I've been struggling with this for about a week now and can't take it anymore! Many thanks in advance for anyone's thoughts. [b][u]CLIENT CONFIG:[/u][/b] [code]client dev tun proto udp remote oyster.no-ip.org resolv-retry infinite redirect-gateway def1 nobind persist-key persist-tun mute-replay-warnings ns-cert-type server key-direction 1 cipher AES-128-CBC comp-lzo verb 9 mute 20 [/code] [b][u]SERVER CONFIG:[/u][/b] [code]local 192.168.1.103 dev tun proto udp port 1194 ca /etc/openvpn/easy-rsa/keys/ca.crt cert /etc/openvpn/easy-rsa/keys/.crt key /etc/openvpn/easy-rsa/keys/.key dh /etc/openvpn/easy-rsa/keys/dh2048.pem server 10.8.0.0 255.255.255.0 push "route 192.168.1.0 255.255.255.0" push "dhcp-option DNS 192.168.1.103" push "redirect-gateway def1" client-to-client duplicate-cn keepalive 10 60 tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0 cipher AES-128-CBC comp-lzo user nobody group nogroup persist-key persist-tun status /var/log/openvpn-status.log 20 log /var/log/openvpn.log verb 6 [/code] [b][u]OpenVPN firewall rules injected into [i]/etc/network/interfaces[/i]:[/u][/b] [code]#!/bin/sh iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT iptables -I FORWARD 1 --source 10.8.0.0/24 -j ACCEPT iptables -I FORWARD -i eth0 -o tun0 -j ACCEPT iptables -I FORWARD -i tun0 -o eth0 -j ACCEPT iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE [/code] [u][b][i]/etc/network/interfaces[/i]:[/b][/u] [code]#/etc/network/interfaces # Local auto lo iface lo inet loopback # Ethernet auto eth0 iface eth0 inet static pre-up /etc/openvpn-firewall-rules.sh address 192.168.1.103 network 192.168.1.0 dns-nameservers 8.8.8.8 netmask 255.255.255.0 broadcast 192.168.1.255 gateway 192.168.1.1[/code]

[quote="brissont"]SERVER CONFIG: Code: local 192.168.1.103[/quote][list]NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or [u]192.168.1.x[/u]. Be aware that this might create [b]routing conflicts[/b] if you connect to the VPN server from public locations such as internet cafes that use the same subnet.[/list] Never use those networks on your server LAN .. [quote="brissont"]OpenVPN firewall rules injected into /etc/network/interfaces: Code: #!/bin/sh iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE[/quote]Try:[code]iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE[/code]and change the server subnet ^^

No Internet through VPN

brissont

Hi all - first post here so please forgive me if I am unintentionally breaking any rules.

As the subject suggests, I have no Internet over VPN, but I can use SSH and SFTP. I'm on a Pi2 running Raspbian (DietPi respin) using the openvpn package from the standard repo. I've gone through the OpenVPN HOW-TO file twice, but can't figure out where the setup breaks down. I suspect it is in the firewall setup as firewalls are not my forte. Any help and/or insight would be greatly appreciated! I've been struggling with this for about a week now and can't take it anymore! Many thanks in advance for anyone's thoughts.

CLIENT CONFIG:

client
dev tun
proto udp
remote oyster.no-ip.org
resolv-retry infinite
redirect-gateway def1
nobind
persist-key
persist-tun
mute-replay-warnings
ns-cert-type server
key-direction 1
cipher AES-128-CBC
comp-lzo
verb 9
mute 20

SERVER CONFIG:

local 192.168.1.103
dev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt 
cert /etc/openvpn/easy-rsa/keys/<SERVER>.crt
key /etc/openvpn/easy-rsa/keys/<SERVER>.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
server 10.8.0.0 255.255.255.0
push "route 192.168.1.0 255.255.255.0"
push "dhcp-option DNS 192.168.1.103"
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 60
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 6

OpenVPN firewall rules injected into /etc/network/interfaces:

#!/bin/sh

       iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT
       iptables -I FORWARD 1 --source 10.8.0.0/24 -j ACCEPT
       iptables -I FORWARD -i eth0 -o tun0 -j ACCEPT
       iptables -I FORWARD -i tun0 -o eth0 -j ACCEPT
       iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE

/etc/network/interfaces:

#/etc/network/interfaces

# Local
auto lo
iface lo inet loopback

# Ethernet
auto eth0
iface eth0 inet static
        pre-up /etc/openvpn-firewall-rules.sh
address 192.168.1.103
network 192.168.1.0
dns-nameservers 8.8.8.8
netmask 255.255.255.0
broadcast 192.168.1.255
gateway 192.168.1.1

Traffic

brissont wroteSERVER CONFIG:
Code:
local 192.168.1.103

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

Never use those networks on your server LAN ..

brissont wroteOpenVPN firewall rules injected into /etc/network/interfaces:
Code:
#!/bin/sh

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE

Try:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

and change the server subnet ^^

brissont

@Traffic - many thanks for your reply. I've since changed my LAN subnet so that it won't be an issue down the line.

For those who find this thread in the future, it turned out that all of my configurations were fine... The problem was that I was using the OpenVPN Connect app instead of the OpenVPN for Android app - fixed my issue immediately. I had to really dig to find this mundane solution, so hopefully this can be of help to someone later.