Hi all, this is my first post on this forum. It also my first attempt to setup a VPN server, so bare with me. I am travelling abroad next Monday to i am hoping to get this working before Sunday :shock: i followed a tutorial for the Raspberry pi, posted by someone at the BBC site, http://www.bbc.com/news/technology-33548728 that tutorial has different methods combined, as can be found in several other tutorials around the net. it is however a little outdated as the first part about the Easy_RSA isn't correct, and the "cp r /usr/share/doc/openvpn/examples/easyrsa/2.0 /etc/openvpn/easyrsa" command needs to be done differently. i eventually got it right from instructions elsewhere, and all files were there where they are supposed to be, prior to creating the keys and so on. now the problems: 1/ can connect to the VPN server from an android device, encryption key works fine, but.. no internet. 2/ on the raspberry pi the OPENVPN server crashes immediately after boot, cause of a problem with the ip address being "used". i have come to understand that this is because the VPN server starts before the network is active on the Raspberry pi, and this causes a problem. i also understand that i can delete the first line from server.conf, but doing so i see that it connects differently in the openvpn.log as when that line is not deleted. so i don't want to go into that problem now, as i want problem number 1 first to be fixed :) for now i manually restart the server after boot through Putty. 3/ when i check the log in the android device, i see a specific error at the end of the log: error parsing IPv4 route:[route] [192.168.2.1][255.255.255.0] : tun_prop_error: route is not canonical i have come to understand that when i change the mask in the server.conf # local subnet push "route 192.168.2.1 255.255.255.0" to 255.255.255.255, this specific problem is "resolved". but for now i leave things as were described in the tutorial. so i would like to tackle problem number 1 , first. things to note: raspberry is fresh installed with raspbian, updated and upgraded. it is assigned a static ip adress 192.168.2.1 both in the router and in the raspberry itself. NAT port forwarding is setup correctly in the router (port 1194 tcp&udp) I have tried several combinations of troubleshooting as found around the net in comments and help instructions in comment sections, but still have no working solution. Therefor i come to seek help here from an OPENVPN expert. i will post now my settings, which will make this post even longer, sorry for that! ifconfig: [code] eth0 Link encap:Ethernet HWaddr b8:27:eb:8c:d9:09 inet addr:192.168.2.1 Bcast:192.168.2.255 Mask:255.255.255.0 inet6 addr: fe80::3a37:1309:25a1:30a0/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:5300 errors:0 dropped:0 overruns:0 frame:0 TX packets:3662 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:580911 (567.2 KiB) TX bytes:493230 (481.6 KiB) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets:200 errors:0 dropped:0 overruns:0 frame:0 TX packets:200 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:16656 (16.2 KiB) TX bytes:16656 (16.2 KiB) [/code] route -n: [code] Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 192.168.2.254 0.0.0.0 UG 202 0 0 eth0 192.168.2.0 0.0.0.0 255.255.255.0 U 202 0 0 eth0 [/code] interfaces setup: [code] # Include files from /etc/network/interfaces.d: source-directory /etc/network/interfaces.d auto lo iface lo inet loopback iface eth0 inet static adress 192.168.2.1 netmask 255.255.255.0 network 192.168.2.0 broadcast 192.168.2.255 gateway 192.168.2.254 pre-up /etc/firewall-openvpn-rules.sh allow-hotplug wlan0 iface wlan0 inet manual wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf allow-hotplug wlan1 iface wlan1 inet manual wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf [/code] server.conf: [code] local 192.168.2.1 dev tun proto udp port 1194 ca /etc/openvpn/easy-rsa/keys/ca.crt cert /etc/openvpn/easy-rsa/keys/vpnpi.crt key /etc/openvpn/easy-rsa/keys/vpnpi.key dh /etc/openvpn/easy-rsa/keys/dh2048.pem server 10.8.0.0 255.255.255.0 # server and remote endpoints ifconfig 10.8.0.1 10.8.0.2 # add route to client routing table for the openvpn server push "route 10.8.0.0 255.255.255.0" # add route to client routing table for the openvpn server push "route 10.8.0.1 255.255.255.255" # local subnet push "route 192.168.2.1 255.255.255.0" # primary dns adress to SOHO router push "dhcp-option DNS 192.168.2.254" # gateway override push "redirect-gateway def1" client-to-client duplicate-cn keepalive 10 120 tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0 cipher AES-128-CBC comp-lzo user nobody group nogroup persist-key persist-tun status /var/log/openvpn-status.log 20 log /var/log/openvpn.log verb 1 [/code] sysctl.conf (snippet): [code] # Uncomment the next line to enable packet forwarding for IPv4 net.ipv4.ip_forward=1 [/code] performed sysctl -p firewall rules: [code] #!/bin/sh iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.2.1 [/code] chmod 700 & chown root performed extra info, default.txt: [code] client dev tun proto udp remote 1194 resolv-retry infinite nobind persist-key persist-tun mute-replay-warnings ns-cert-type server key-direction 1 cipher AES-128-CBC comp-lzo verb 1 mute 20 [/code] i have removed my public ip address for this post.. ;) then i used script from: Eric Jodoin to export the profiles that i need, all went well, no errors. openvpn.log [code] Fri Jan 15 14:29:04 2016 OpenVPN 2.3.4 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Dec 5 2014 Fri Jan 15 14:29:04 2016 library versions: OpenSSL 1.0.1k 8 Jan 2015, LZO 2.08 Fri Jan 15 14:29:04 2016 Control Channel Authentication: using '/etc/openvpn/easy-rsa/keys/ta.key' as a OpenVPN static key file Fri Jan 15 14:29:04 2016 TUN/TAP device tun0 opened Fri Jan 15 14:29:04 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0 Fri Jan 15 14:29:04 2016 /sbin/ip link set dev tun0 up mtu 1500 Fri Jan 15 14:29:04 2016 /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2 Fri Jan 15 14:29:04 2016 GID set to nogroup Fri Jan 15 14:29:04 2016 UID set to nobody Fri Jan 15 14:29:04 2016 UDPv4 link local (bound): [AF_INET]192.168.2.1:1194 Fri Jan 15 14:29:04 2016 UDPv4 link remote: [undef] Fri Jan 15 14:29:04 2016 Initialization Sequence Completed [/code] ok, i hope i posted enough information :?: sorry for the long post, let me know if any other info is needed :roll:

[quote="nrg70"]i followed a tutorial for the Raspberry pi, posted by someone at the BBC site[/quote]They all copy the original and [u]incorrect[/u] raspberry pi tutorial. For example: [quote="nrg70"]3/ when i check the log in the android device, i see a specific error at the end of the log: error parsing IPv4 route:[route] [192.168.2.1][255.255.255.0] : tun_prop_error: route is not canonical[/quote]the error is telling you what is wrong .. send this back to the author of the Pi tutorial .. the IP address does not match the netmask .. it should be:[code]192.168.2.0 255.255.255.0[/code]There are many posts from Pi users here on the forum and they [b]all[/b] have the same incorrect setup. More examples: [quote="nrg70"]server.conf: Code: [code]server 10.8.0.0 255.255.255.0 # server and remote endpoints ifconfig 10.8.0.1 10.8.0.2

[quote="Traffic"]Is your android device on the same LAN as your Pi ? Can you ping 192.168.2.254 from your android device ?[/quote] i am testing from my mobile data connection no i can not ping my internal LAN address i am not testing on the LAN i can ping google.com from the raspberry terminal

Your iptables rule is not a typical setup so please see the official HOWTO: [url=http://openvpn.net/index.php/open-source/documentation/howto.html#redirect]HOWTO: Routing all client traffic (including web-traffic) through the VPN[/url] You should be able to ping 192.168.2.254 .. Let us know how you get on.

Please post your complete server & client logs at --[b]verb 4[/b] .. remove any personal data.

3 problems

nrg70

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

Traffic

nrg70 wrotei followed a tutorial for the Raspberry pi, posted by someone at the BBC site

They all copy the original and incorrect raspberry pi tutorial.

For example:

nrg70 wrote3/ when i check the log in the android device, i see a specific error at the end of the log:
error parsing IPv4 route:[route]
[192.168.2.1][255.255.255.0] : tun_prop_error: route is not canonical

the error is telling you what is wrong .. send this back to the author of the Pi tutorial .. the IP address does not match the netmask .. it should be:

192.168.2.0 255.255.255.0

There are many posts from Pi users here on the forum and they all have the same incorrect setup.

More examples:

nrg70 wroteserver.conf:
Code:

server 10.8.0.0 255.255.255.0

# server and remote endpoints
ifconfig 10.8.0.1 10.8.0.2              <<-- Delete this

# add route to client routing table for the openvpn server
push "route 10.8.0.0 255.255.255.0"     <<-- Delete this

# add route to client routing table for the openvpn server
push "route 10.8.0.1 255.255.255.255"   <<--Delete this

# local subnet
push "route 192.168.2.1 255.255.255     <<-- Correct this as above

send this back to the author of the Pi tutorial

nrg70 wroteFri Jan 15 14:29:04 2016 OpenVPN 2.3.4 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Dec 5 2014

This is over one year old ...

nrg70

Thanks for your reply!

i did the edits as you suggested, but still no acces to internet from the android device.
the log file in the openvpn client shows no errors.

the log file for the server:

Sat Jan 16 16:25:43 2016 OpenVPN 2.3.4 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Dec  5 2014
Sat Jan 16 16:25:43 2016 library versions: OpenSSL 1.0.1k 8 Jan 2015, LZO 2.08
Sat Jan 16 16:25:43 2016 Control Channel Authentication: using '/etc/openvpn/easy-rsa/keys/ta.key' as a OpenVPN static key file
Sat Jan 16 16:25:43 2016 TUN/TAP device tun0 opened
Sat Jan 16 16:25:43 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sat Jan 16 16:25:43 2016 /sbin/ip link set dev tun0 up mtu 1500
Sat Jan 16 16:25:43 2016 /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
Sat Jan 16 16:25:43 2016 GID set to nogroup
Sat Jan 16 16:25:43 2016 UID set to nobody
Sat Jan 16 16:25:43 2016 UDPv4 link local (bound): [AF_INET]192.168.2.1:1194
Sat Jan 16 16:25:43 2016 UDPv4 link remote: [undef]
Sat Jan 16 16:25:43 2016 Initialization Sequence Completed
Sat Jan 16 16:26:15 2016 92.69.201.218:41760 [mobidroid] Peer Connection Initiated with [AF_INET]92.69.201.218:41760
Sat Jan 16 16:26:15 2016 mobidroid/92.69.201.218:41760 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Sat Jan 16 16:26:15 2016 mobidroid/92.69.201.218:41760 send_push_reply(): safe_cap=940

as for the OPENVPN arm version, it is the one that is being downloaded and installed when i perform apt-get install openvpn
so i don't know how to get any newer version?
i did perform update and upgrade.

Traffic wrote
nrg70 wroteFri Jan 15 14:29:04 2016 OpenVPN 2.3.4 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Dec 5 2014
This is over one year old ...

Traffic

Is your android device on the same LAN as your Pi ?

Can you ping 192.168.2.254 from your android device ?

nrg70

Traffic wroteIs your android device on the same LAN as your Pi ?

Can you ping 192.168.2.254 from your android device ?

i am testing from my mobile data connection

no i can not ping my internal LAN address i am not testing on the LAN

i can ping google.com from the raspberry terminal

Traffic

Your iptables rule is not a typical setup so please see the official HOWTO:
HOWTO: Routing all client traffic (including web-traffic) through the VPN

You should be able to ping 192.168.2.254 .. Let us know how you get on.

nrg70

ok i see, so when i am connected through VPN i should be able to ping the home LAN network.

i have looked at the "redirects" part in the howto and read it over a couple of time, but it goes a little above my head.
anyway i tried changing the iptables firewall rules, to the default:
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
that didn't help , then i changed it to:
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j 192.168.2.1

that didn't help

i am kinda out of ideas now, don't know what else i can do from here

Traffic wroteYour iptables rule is not a typical setup so please see the official HOWTO:
HOWTO: Routing all client traffic (including web-traffic) through the VPN

You should be able to ping 192.168.2.254 .. Let us know how you get on.

Traffic

Please post your complete server & client logs at --verb 4 .. remove any personal data.

nrg70

what means "at verb4"

does that mean to change the "default.txt" from where it says verb 1 to verb 4 ?

and with server log do you mean the content of openvpn.log file?

thanks for your help so far!

Traffic wrotePlease post your complete server & client logs at --verb 4 .. remove any personal data.

nrg70

ok unfortunately i have to pack up now, i will be leaving tomorrow abroad.
so there is no more time for me to follow the thread and test.

i wished to have this working, but i guess this will have to wait till next time.
it is weird that some people have this setup working and some don't with the same tutorials and nearly identical network settings, and raspberry pi.

anyway i will re-purpose the box for something else while i am gone, and try this VPN thing again next time.
thanks for the help!

gbdesai

It's not just you. I am at the exact same spot as you. I took all the great recommendations in this thread with the same results as you. The only difference between our configs is my internal network addresses. I'm going to keep at it and will post if I discover anything. Frustrating that I can connect but can't route any traffic.