I've setup my Raspberry Pi as an OpenVPN server. I'm able to connect to the server from my Android phone using the OpenVPN app, however I'm not able to access any sites on the internet. The OpenVPN server has been setup for the purpose of browsing the web securly on public wifi.
I'm able to ping the server at both 192.168.86.3 and 10.8.0.1 I cannot ping either the router (192.168.86.3) or 8.8.8.8 from the VPN.
ipv4 forwarding is enabled.
Server Config:
port 443
proto tcp
dev tun0
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/key.crt
key /etc/openvpn/keys/key.key
dh /etc/openvpn/keys/dh4096.pem
tls-auth /etc/openvpn/keys/ta.key 0
user nobody
group nobody
server 10.8.0.0 255.255.255.0
persist-key
persist-tun
ifconfig-pool-persist ipp.txt
topology subnet
push "redirect-gateway def1"
push "route 192.168.86.0 255.255.255.0"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 192.168.86.1"
keepalive 10 120
comp-lzo
status openvpn-status.log
log-append /var/log/openvpn.log
verb 4
Client Config:
client
dev tun
proto tcp
remote SERVER_IP 443
resolv-retry infinite
nobind
user nobody
group nobody
persist-key
persist-tun
<ca>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----
</key>
key-direction 1
<tls-auth>
-----BEGIN OpenVPN Static key V1-----
...
-----END OpenVPN Static key V1-----
</tls-auth>
comp-lzo
verb 3
Output of `route` on client.
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.8.0.0 * 255.255.255.0 U 0 0 0 tun0
iptables rules on server.
# Generated by iptables-save v1.4.21 on Mon Nov 9 20:43:23 2015
*mangle
:PREROUTING ACCEPT [5137:447124]
:INPUT ACCEPT [3884:334912]
:FORWARD ACCEPT [624:36889]
:OUTPUT ACCEPT [2554:269872]
:POSTROUTING ACCEPT [3178:306761]
COMMIT
# Completed on Mon Nov 9 20:43:23 2015
# Generated by iptables-save v1.4.21 on Mon Nov 9 20:43:23 2015
*nat
:PREROUTING ACCEPT [737:37974]
:INPUT ACCEPT [413:18792]
:OUTPUT ACCEPT [7:508]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Mon Nov 9 20:43:23 2015
# Generated by iptables-save v1.4.21 on Mon Nov 9 20:43:23 2015
*filter
:INPUT ACCEPT [3878:334408]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [2564:271200]
-A INPUT -i tun+ -j ACCEPT
-A FORWARD -i tun+ -j ACCEPT
COMMIT
# Completed on Mon Nov 9 20:43:23 2015
