Connecting via external good, internal not good

casperpaul

Hi guys, have a weird problem here.

I managed to get the server running and it works just fine. When I connect from an external ip, it is able to authenticate just fine; however, when I try to connect while I'm inside the house it doesn't connect. It gives me the below error:

Sun Jan 31 15:28:52 2016 192.168.0.102:54549 TLS Error: reading acknowledgement record from packet
Sun Jan 31 15:28:54 2016 192.168.0.102:54549 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #2 / time = (1454272131) Sun Jan 31 15:28:51 2016 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Sun Jan 31 15:28:54 2016 192.168.0.102:54549 TLS Error: incoming packet authentication failed from [AF_INET]192.168.0.102:54549

I suspect it's a router issue and not a server set up issue as I'm able to authenticate, connect, and use as expected. However, the weird part is that when I'm internally connected to the wifi I am not. Is this an issue with the router's routing or my server? Any ideas?

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         192.168.0.1     0.0.0.0         UG        0 0          0 wlan0
10.9.0.0        10.9.0.2        255.255.255.0   UG        0 0          0 tun0
10.9.0.2        0.0.0.0         255.255.255.255 UH        0 0          0 tun0
192.168.0.0     0.0.0.0         255.255.255.0   U         0 0          0 wlan0

Traffic

How does your client identify your server ?

casperpaul

You ask a good question ... though I don't know how to fix it; something with iptables? It identifies it through the public ip not the private ip. In lines with excerpt above, the server is running on .105 while the client is accessing it from .102.

Traffic

Try using your private IP [.105] while inside your LAN.

casperpaul

You mean accessing it? If that's what you mean, yes I can access it.

Traffic

I mean, as the parameter to --remote ...

casperpaul

Ok just tested it and it looks like when I use the .105 address it still fails ... so maybe it's not a routing issue? Let me dig into my setup more. Feel free to offer suggestions etc

Traffic

I expect that your router does not support internal clients ..

Do you have your server config file ?

casperpaul

That's why I kind of thought but not sure why or how it would block internal udp traffic

Doing some google searches, it looks it may be due to some sort of replay error where they are saying that it is behaving like a replay attack.

Below is the server conf

dev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/keys/file here
cert /etc/openvpn/easy-rsa/keys/file here
key /etc/openvpn/easy-rsa/keys/file here
dh /etc/openvpn/easy-rsa/keys/file here
server 10.9.0.0 255.255.255.0
ifconfig 10.9.0.1 10.9.0.2
push "route 10.9.0.1 255.255.255.255"
push "route 10.9.0.0 255.255.255.0"
push "route 192.168.0.105 255.255.255.0"
push "dhcp-option DNS 8.8.8.8"
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-256-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 4

Traffic

casperpaul wrotenot sure why or how it would block internal udp traffic

It is called "looback" and my presumption is that your router does not support it .. which is very common for retail routers.

casperpaul

Any workaround for this?

Ok if it is not known then let me see if I can figure out a workaround. I'll post it to this thread when I find it.

Traffic

The only "work around" I am aware of is to not specify --local which causes OpenVPN to bind to all interfaces. But you don't appear to have that in your server config. Normally, this would allow local clients to connect ..

For clarity, what machine is your router and what machine is your VPN server ?

casperpaul

My router is 192.168.0.1 and my server is 192.168.0.105

I'm thinking if the 0 is throwing the subnet off between the server and client.

Traffic

So your OpenVPN server is not running on your router ? :roll:

casperpaul

Sorry for not clarifying. No it's not. It's running on a raspberry pi. And my client is an iPhone.

Traffic

And the iPhone is using your private WiFi while in your home ?

casperpaul

Yes. It sits behind the same router with the .102 ip

Traffic

casperpaul wroteMy router is 192.168.0.1 and my server is 192.168.0.105

Traffic wroteAnd the iPhone is using your private WiFi while in your home ?

casperpaul wroteYes. It sits behind the same router with the .102 ip

What .102 IP .. How many routers do you have ?

casperpaul

1 router

Router 192.168.0.1
Server 192.168.0.105
Client 192.168.0.102

Client can't connect when on wifi but it can when its outside the wifi (i.e. Phone network/internet)

Traffic

Your iPhone client should have no problem connecting to your Pi Server.

In the client config use:

remote 192.168.0.105

Remove your public IP address from the client config.

Change this as needed or create two client config files, one for internal and one for external.

Another issue you will face:

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

:arrow: Never use 192.168.0.0/24 or 192.168.1.0/24 (or other common subnets) for your OpenVPN Server LAN :!:

You are advised to change your server LAN to a more unique RFC1918 compliant subnet. f.e 192.168.143.0/24