Hi,
I have a raspberry Pi at home behind the router (provided by ISP). I have a free dynamic DNS (Duck DNS) service to access the server with dynamic IP address. Internal IP address of the server is fixed (although I cannot set this in the crappy router, it has never changed so far).
My goal is to use openvpn to access internet through my home internet access and access my router, which is only accessible from internal network.
I have a public IP address (lets say
212.X.X.X)
I have an internal network with the server and other computers connected.
Router:
192.168.0.1
Server:
192.168.0.9
ip_forward is set to 1
auto lo
iface lo inet loopback
iface eth0 inet dhcp # this is the interface where raspberry pi is connected
pre-up /etc/firewall-openvpn-rules.sh # script is sunnable
allow-hotplug wlan0 # not used anymore
iface wlan0 inet manual
pre-up /etc/firewall-openvpn-rules.sh
wpa-roam /etc/wpa_supplicant/wpa_supplicant.conf
iface home inet dhcp
iface default inet dhcp
#!/bin/sh
#iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.0.9 #tried both MASQ and SNAT
iptables -t nat -A POSTROUTING -o eth0 -s 10.8.0.0/24 -j MASQUERADE
#local 192.168.0.9 # SWAP THIS NUMBER WITH YOUR RASPBERRY PI IP ADDRESS disabled, because openvpn thinks port is busy on start up
# error: TCP/UDP: Socket bind failed on local address [AF_INET] 1194 Cannot assign requested address, which does not occur when disabled
dev tun
proto udp #Some people prefer to use tcp. Don't change it if you don't know.
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/tesla.crt # SWAP WITH YOUR CRT NAME
key /etc/openvpn/easy-rsa/keys/tesla.key # SWAP WITH YOUR KEY NAME
dh /etc/openvpn/easy-rsa/keys/dh2048.pem # If you changed to 2048, change that here!
server 10.8.0.0 255.255.255.0
# server and remote endpoints
ifconfig 10.8.0.1 10.8.0.2
# Add route to Client routing table for the OpenVPN Server
push "route 10.8.0.1 255.255.255.255"
# Add route to Client routing table for the OpenVPN Subnet
push "route 10.8.0.0 255.255.255.0"
# your local subnet
push "route 192.168.0.9 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
# Set primary domain name server address to the SOHO Router
# If your router does not do DNS, you can use Google DNS 8.8.8.8
push "dhcp-option DNS 192.168.0.1" # This should already match your router address and not need to be changed.
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
ifconfig-pool-persist ipp.txt
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 1
With this configuration, I can connect to the server but I cannot access router or the internet. I have found several solutions on the internet but they are usually about things, I already did correctly: e.g. ip_forward, making script runnable, etc....
Thanks a lot!
