Failed to connect via WIFI

steve-23

Hi everybody,

hope somebody can help me out with my OpenVPN connection problem.

I've got a VU+ Zero Set Top Box as VPN Server. I managed it to install VPN and everything around it (Certificate etc.). My problem is, that I cannot get a connection via WIFI. It works well if I connect via LTE on my iPhone, but as long as I try to reach my VPN via WIFI, it fails. Here are my configs:

Server Conf:

port xxxx
proto udp
dev tun
#mode server
tls-server
#tls-version-min 1.2
client-to-client
daemon

#ifconfig 10.5.0.250 255.255.255.0
#ifconfig-pool 10.5.0.1 10.5.0.9
#ifconfig-pool-persist /etc/openvpn/ipp.txt
#client-config-dir ccd
server 10.5.0.0 255.255.255.0

push "route 192.168.2.0 255.255.255.0"
push "dhcp-option DNS 192.168.2.1"
push "redirect-gateway"

tun-mtu 1500
mssfix
topology subnet

cipher aes-256-cbc
auth SHA512
tls-cipher "xxx-xxx-xxx-xxx"
;ns-cert-type client
;crl-verify /etc/openvpn/certs/Home-ca.crt
tls-auth /etc/openvpn/certs/Home-ta.key 0
script-security 2
persist-tun 
persist-key

dh /etc/openvpn/certs/Home-dh.pem
ca /etc/openvpn/certs/Home-ca.crt
cert /etc/openvpn/certs/Home-server.crt
key /etc/openvpn/certs/Home-server.key

comp-lzo

status /etc/openvpn/openvpn-Home-status.log
log /etc/openvpn/openvpn-Home.log
keepalive 10 60
verb 3
mute 20

up /etc/openvpn/up.sh
down /etc/openvpn/down.sh

My iPhone client conf/Windows Client conf as well:

remote "dynamic-dns-address"
port xxxx
tls-client
#tls-version-min 1.2
dev tun
proto udp
resolv-retry infinite
;ns-cert-type server
nobind
persist-key
persist-tun
tls-auth Home-ta.key 1
cipher AES-256-CBC
auth SHA512
#verify-x509-name 'C=XX, ST=secret, L=secret, O=Home, OU=Server Certificate, CN=vpn.Home.de, emailAddress=email@email.de' subject
tls-cipher "xxx-xxx-xxx"
#auth SHA1
ca "C:\\Program Files\\OpenVPN\\config\\Home-ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\Home001.crt"
key "C:\\Program Files\\OpenVPN\\config\\Home001.key"
keepalive 10 120
comp-lzo
pull
verb 3
log "C:\\Program Files\\OpenVPN\\Client.log"
script-security 2

Here's the log from Windows, when I try to connect:

Wed Feb 10 08:41:01 2016 Warning: cannot open --log file: C:\Program Files\OpenVPN\Client.log: Zugriff verweigert   (errno=5)
Wed Feb 10 08:41:01 2016 Warning: cannot open --log file: C:\Program Files\OpenVPN\log\openvpn-Home.log: Zugriff verweigert   (errno=5)
Wed Feb 10 08:41:01 2016 OpenVPN 2.3.9 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec 16 2015
Wed Feb 10 08:41:01 2016 library versions: OpenSSL 1.0.1q 3 Dec 2015, LZO 2.09
Wed Feb 10 08:41:01 2016 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Wed Feb 10 08:41:01 2016 Need hold release from management interface, waiting...
Wed Feb 10 08:41:01 2016 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Wed Feb 10 08:41:01 2016 MANAGEMENT: CMD 'state on'
Wed Feb 10 08:41:01 2016 MANAGEMENT: CMD 'log all on'
Wed Feb 10 08:41:01 2016 MANAGEMENT: CMD 'hold off'
Wed Feb 10 08:41:01 2016 MANAGEMENT: CMD 'hold release'
Wed Feb 10 08:41:01 2016 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Wed Feb 10 08:41:01 2016 Deprecated TLS cipher name 'DHE-RSA-AES256-GCM-SHA384', please use IANA name 'TLS-DHE-RSA-WITH-AES-256-GCM-SHA384'
Wed Feb 10 08:41:01 2016 Deprecated TLS cipher name 'DHE-RSA-AES256-SHA256', please use IANA name 'TLS-DHE-RSA-WITH-AES-256-CBC-SHA256'
Wed Feb 10 08:41:01 2016 Deprecated TLS cipher name 'DHE-RSA-AES128-GCM-SHA256', please use IANA name 'TLS-DHE-RSA-WITH-AES-128-GCM-SHA256'
Wed Feb 10 08:41:01 2016 Deprecated TLS cipher name 'DHE-RSA-AES128-SHA256', please use IANA name 'TLS-DHE-RSA-WITH-AES-128-CBC-SHA256'
Wed Feb 10 08:41:01 2016 Deprecated TLS cipher name 'DHE-RSA-CAMELLIA256-SHA', please use IANA name 'TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA'
Wed Feb 10 08:41:01 2016 Deprecated TLS cipher name 'DHE-RSA-AES256-SHA', please use IANA name 'TLS-DHE-RSA-WITH-AES-256-CBC-SHA'
Wed Feb 10 08:41:01 2016 Deprecated TLS cipher name 'DHE-RSA-CAMELLIA128-SHA', please use IANA name 'TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA'
Wed Feb 10 08:41:01 2016 Deprecated TLS cipher name 'DHE-RSA-AES128-SHA', please use IANA name 'TLS-DHE-RSA-WITH-AES-128-CBC-SHA'
Wed Feb 10 08:41:01 2016 Deprecated TLS cipher name 'CAMELLIA256-SHA', please use IANA name 'TLS-RSA-WITH-CAMELLIA-256-CBC-SHA'
Wed Feb 10 08:41:01 2016 Deprecated TLS cipher name 'AES256-SHA', please use IANA name 'TLS-RSA-WITH-AES-256-CBC-SHA'
Wed Feb 10 08:41:01 2016 Deprecated TLS cipher name 'CAMELLIA128-SHA', please use IANA name 'TLS-RSA-WITH-CAMELLIA-128-CBC-SHA'
Wed Feb 10 08:41:01 2016 Deprecated TLS cipher name 'AES128-SHA', please use IANA name 'TLS-RSA-WITH-AES-128-CBC-SHA'
Wed Feb 10 08:41:01 2016 Control Channel Authentication: using 'Home-ta.key' as a OpenVPN static key file
Wed Feb 10 08:41:01 2016 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Wed Feb 10 08:41:01 2016 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Wed Feb 10 08:41:01 2016 Socket Buffers: R=[65536->65536] S=[65536->65536]
Wed Feb 10 08:41:01 2016 MANAGEMENT: >STATE:1455090061,RESOLVE,,,
Wed Feb 10 08:41:01 2016 UDPv4 link local: [undef]
Wed Feb 10 08:41:01 2016 UDPv4 link remote: [AF_INET]xx.xxx.xx.xxx:xxxx
Wed Feb 10 08:41:01 2016 MANAGEMENT: >STATE:1455090061,WAIT,,,

Thanks.

Traffic

When on your WiFi try using the LAN IP of the server as --remote in your client config:

remote 192.168.2.xxx

where 'xxx' is your VPN server LAN IP ..

steve-23

Hi Traffic,

I didn't try this yet, but this solution will only help me, if I'm at home in my own network. I used to have the problem, when I have access from another WIFI towards my VPN.
I just checked this once again. So there's a connection right now, but when I try to access my router i.e., it doesn't work. But when I'm trying via LTE, I do have access to all devices behind the VPN server.

Here's the log when I'm trying to access via WIFI:

2016-02-10 12:14:20 ----- OpenVPN Start -----
OpenVPN core 3.0 ios arm64 64-bit
2016-02-10 12:14:20 UNUSED OPTIONS
2 [tls-client] 
5 [resolv-retry] [infinite] 
6 [nobind] 
7 [persist-key] 
8 [persist-tun] 
13 [tls-cipher] [DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-G...] 
17 [keepalive] [10] [120] 
19 [pull] 
20 [verb] [3] 
21 [log] [openvpn-Home002.log] 
22 [script-security] [3] 

2016-02-10 12:14:20 LZO-ASYM init swap=0 asym=0
2016-02-10 12:14:20 EVENT: RESOLVE
2016-02-10 12:14:20 Contacting 87.144.83.164:1194 via UDP
2016-02-10 12:14:20 EVENT: WAIT
2016-02-10 12:14:20 SetTunnelSocket returned 1
2016-02-10 12:14:20 Connecting to "dynamic dns address:xxxx" (xx.xxx.xx.xxx) via UDPv4
2016-02-10 12:14:20 EVENT: CONNECTING
2016-02-10 12:14:20 Tunnel Options:V4,dev-type tun,link-mtu 1602,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-256-CBC,auth SHA512,keysize 256,tls-auth,key-method 2,tls-client
2016-02-10 12:14:20 Peer Info:
IV_GUI_VER=net.openvpn.connect.ios 1.0.5-177
IV_VER=3.0
IV_PLAT=ios
IV_NCP=1
IV_LZO=1

2016-02-10 12:14:21 VERIFY OK: depth=1
cert. version    : 3
serial number    : CE:22:8F:DF:10:30:87:3B
issuer name      : C=DE, ST=Bayern, L=Muenchen, O=Home, OU=Certificate Authority, CN=ca.Home.de, emailAddress=admin@Home.de
subject name      : C=DE, ST=Bayern, L=Muenchen, O=Home, OU=Certificate Authority, CN=ca.Home.de, emailAddress=admin@Home.de
issued  on        : 2016-01-30 15:03:23
expires on        : 2026-01-27 15:03:23
signed using      : RSA with SHA-512
RSA key size      : 1024 bits
basic constraints : CA=true, max_pathlen=0
cert. type        : SSL CA, Email CA, Object Signing CA

2016-02-10 12:14:21 VERIFY OK: depth=0
cert. version    : 3
serial number    : 02
issuer name      : C=DE, ST=Bayern, L=Muenchen, O=Home, OU=Certificate Authority, CN=ca.Home.de, emailAddress=admin@Home.de
subject name      : C=DE, ST=Bayern, L=Muenchen, O=Home, OU=Server Certificate, CN=vpn.Home.de, emailAddress=admin@Home.de
issued  on        : 2016-01-30 15:03:25
expires on        : 2026-01-27 15:03:25
signed using      : RSA with SHA-512
RSA key size      : 1024 bits
cert. type        : SSL Server
key usage        : Digital Signature, Non Repudiation, Key Encipherment
ext key usage    : ???, ???, TLS Web Server Authentication

2016-02-10 12:14:21 SSL Handshake: TLSv1.0/TLS-DHE-RSA-WITH-AES-256-CBC-SHA
2016-02-10 12:14:21 Session is ACTIVE
2016-02-10 12:14:21 EVENT: GET_CONFIG
2016-02-10 12:14:21 Sending PUSH_REQUEST to server...
2016-02-10 12:14:21 OPTIONS:
0 [route] [192.168.2.0] [255.255.255.0] 
1 [dhcp-option] [DNS] [192.168.2.1] 
2 [redirect-gateway] 
3 [route-gateway] [10.5.0.1] 
4 [topology] [subnet] 
5 [ping] [10] 
6 [ping-restart] [60] 
7 [ifconfig] [10.5.0.2] [255.255.255.0] 

2016-02-10 12:14:21 LZO-ASYM init swap=0 asym=0
2016-02-10 12:14:21 EVENT: ASSIGN_IP
2016-02-10 12:14:21 Connected via tun
2016-02-10 12:14:21 EVENT: CONNECTED @"dynamic dns address:xxxx" (xx.xxx.xx.xxx) via /UDPv4 on tun/10.5.0.2/
2016-02-10 12:14:21 SetStatus Connected

steve-23

Hi Traffic,

thanks for this. This works well, if I'm in my own network. But when I'm logged into another WIFI network, it doesn't.

At first, it didn't work with remote "dynamic dns:port" but now it works. So when I'm in my friends WIFI network the connection builds up but when I try to reach my devices, it doesn't work. I only can reach my server with 10.5.0.1
So I guess there's something wrong about the routing...But the crazy thing is, that it works, when I'm logged into VPN via LTE.

My Router has the IP 192.168.2.1
My VPN Server 192.168.2.200

Traffic

I expect your router does not allow you to connect to a DNS name from within its own subnet ..

Write two config files one for local access and one for remote.

Pippin

Write two config files one for local access and one for remote.

Yes, i thought that too.

But also, I would think that your friends network is assigning 192.168.2.x

If so, change your network to something uncommon like, 192.168.15.x