VPN Passthrough on primary gateway

chronolz

Hi,

Network Setup
Primary gateway: Internet Hotspot
Openvpn client: running on dd-wrt router connected to hotspot

I get my internet through a wifi hotspot. I share that internet with the rest of my house using a dd-wrt router (r7000 kong). On this dd-wrt router I am running an openvpn client connecting to pia vpn service.

When I use udp to connect to the vpn, the internet on my windows based devices works perfectly fine. However, it doesn't work on any of my Android devices. Only Chrome browser works on these Android devices, but Netflix, Google Play, Youtube etc doesn't.

When I use tcp to connect to the vpn, every device connects to the internet just fine.

I thought this might be a vpn passthrough issue on the hotspot firewall. So, I added the following rule to my iptables on the hotspot

iptables -t filter -F FORWARD
iptables -t nat -F POSTROUTING
iptables -t filter -I FORWARD -j ACCEPT
iptables -t nat -I POSTROUTING -j MASQUERADE
iptables -t filter -A INPUT -p esp -j ACCEPT
iptables -t nat -A POSTROUTING -p esp -j ACCEPT
iptables -t filter -A INPUT -p udp -m udp --sport 500 -j ACCEPT
iptables -t filter -A INPUT -p udp -m udp --dport 500 -j ACCEPT
iptables -t filter -A INPUT -p udp -m udp --sport 4500 -j ACCEPT
iptables -t filter -A INPUT -p udp -m udp --dport 4500 -j ACCEPT
iptables -t filter -A INPUT -p udp -m udp --sport 1194 -j ACCEPT
iptables -t filter -A INPUT -p udp -m udp --dport 1194 -j ACCEPT

And, it didn't change anything.

Any help would be greatly appreciated!

Thanks

Traffic

chronolz wroteWhen I use udp to connect to the vpn, the internet on my windows based devices works perfectly fine. However, it doesn't work on any of my Android devices. Only Chrome browser works on these Android devices, but Netflix, Google Play, Youtube etc doesn't.

When I use tcp to connect to the vpn, every device connects to the internet just fine.

Please post your UDP configs and logs .. perhaps there is a problem with OpenVPN connection.

chronolz

here is the log and config file.

thanks

Clientlog:
20151124 19:51:25 I OpenVPN 2.3.8 arm-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Sep 7 2015
20151124 19:51:25 I library versions: OpenSSL 1.0.2d 9 Jul 2015 LZO 2.09
20151124 19:51:25 W WARNING: file '/tmp/openvpncl/credentials' is group or others accessible
20151124 19:51:25 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:16
20151124 19:51:25 W NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
20151124 19:51:25 Socket Buffers: R=[180224->131072] S=[180224->131072]
20151124 19:51:25 I UDPv4 link local: [undef]
20151124 19:51:25 I UDPv4 link remote: [AF_INET]198.8.80.167:1194
20151124 19:51:25 TLS: Initial packet from [AF_INET]198.8.80.167:1194 sid=93d9390f 5068d7ef
20151124 19:51:25 W WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
20151124 19:51:25 VERIFY OK: depth=1 C=US ST=OH L=Columbus O=Private Internet Access CN=Private Internet Access CA emailAddress=secure@privateinternetaccess.com
20151124 19:51:25 Validating certificate key usage
20151124 19:51:25 ++ Certificate has key usage 00a0 expects 00a0
20151124 19:51:25 NOTE: --mute triggered...
20151124 19:51:26 10 variation(s) on previous 3 message(s) suppressed by --mute
20151124 19:51:26 I [Private Internet Access] Peer Connection Initiated with [AF_INET]198.8.80.167:1194
20151124 19:51:28 SENT CONTROL [Private Internet Access]: 'PUSH_REQUEST' (status=1)
20151124 19:51:29 PUSH: Received control message: 'PUSH_REPLY redirect-gateway def1 dhcp-option DNS 209.222.18.222 dhcp-option DNS 209.222.18.218 ping 10 comp-lzo no route 10.163.1.1 topology net30 ifconfig 10.163.1.6 10.163.1.5'
20151124 19:51:29 OPTIONS IMPORT: timers and/or timeouts modified
20151124 19:51:29 NOTE: --mute triggered...
20151124 19:51:29 4 variation(s) on previous 3 message(s) suppressed by --mute
20151124 19:51:29 I TUN/TAP device tun1 opened
20151124 19:51:29 TUN/TAP TX queue length set to 100
20151124 19:51:29 I do_ifconfig tt->ipv6=1 tt->did_ifconfig_ipv6_setup=0
20151124 19:51:29 I /sbin/ifconfig tun1 10.163.1.6 pointopoint 10.163.1.5 mtu 1500
20151124 19:51:29 /sbin/route add -net 198.8.80.167 netmask 255.255.255.255 gw 192.168.43.1
20151124 19:51:29 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 10.163.1.5
20151124 19:51:29 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 10.163.1.5
20151124 19:51:29 /sbin/route add -net 10.163.1.1 netmask 255.255.255.255 gw 10.163.1.5
20151124 19:51:29 I Initialization Sequence Completed
20151124 19:51:43 N write UDPv4: Message too large (code=90)
20151124 19:51:44 N write UDPv4: Message too large (code=90)
20151124 19:51:44 N write UDPv4: Message too large (code=90)
20151124 19:51:44 NOTE: --mute triggered...
20151124 19:59:41 297 variation(s) on previous 3 message(s) suppressed by --mute
20151124 19:59:41 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20151124 19:59:41 D MANAGEMENT: CMD 'state'
20151124 19:59:41 MANAGEMENT: Client disconnected
20151124 19:59:41 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20151124 19:59:41 D MANAGEMENT: CMD 'state'
20151124 19:59:41 MANAGEMENT: Client disconnected
20151124 19:59:41 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20151124 19:59:41 D MANAGEMENT: CMD 'state'
20151124 19:59:41 MANAGEMENT: Client disconnected
20151124 19:59:41 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20151124 19:59:41 D MANAGEMENT: CMD 'status 2'
20151124 19:59:41 MANAGEMENT: Client disconnected
20151124 19:59:41 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20151124 19:59:41 D MANAGEMENT: CMD 'log 500'

config file
ca /tmp/openvpncl/ca.crt
management 127.0.0.1 16
management-log-cache 100
verb 3
mute 3
syslog
writepid /var/run/openvpncl.pid
client
resolv-retry infinite
nobind
persist-key
persist-tun
script-security 2
dev tun1
proto udp
cipher bf-cbc
auth sha1
auth-user-pass /tmp/openvpncl/credentials
remote us-california.privateinternetaccess.com 1194
comp-lzo yes
tun-mtu 1500
mtu-disc yes
fast-io
tun-ipv6
persist-key
persist-tun
tls-client
remote-cert-tls server
resolv-retry infinite
#verb 5
#log /var/log/log.openvpn