OpenVPN connects to RPi server - but browsing not possible

chrishoughton0

Hi

I have set up OpenVPN using a very helpful BBC tutorial.

I can connect to my VPN if I use mobile data on my iPhone, however if I connect to public Wi-Fi and attempt a connection on my PC, I successfully connect and am assigned an IP address, but cannot browse via Chrome or connect to the NAS on my home network.

Log file as an example when I connect via airport Wifi (with various parts redacted):

Fri Feb 19 18:41:58 2016 OpenVPN 2.3.7 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Jul  9 2015
Fri Feb 19 18:41:58 2016 library versions: OpenSSL 1.0.1p 9 Jul 2015, LZO 2.08
Enter Management Password:
Fri Feb 19 18:42:01 2016 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Fri Feb 19 18:42:01 2016 Control Channel Authentication: tls-auth using INLINE static key file
Fri Feb 19 18:42:02 2016 UDPv4 link local: [undef]
Fri Feb 19 18:42:02 2016 UDPv4 link remote: [AF_INET]XX.XXX.XX.XXX:1194
Fri Feb 19 18:42:04 2016 [XXXXVPN] Peer Connection Initiated with [AF_INET]XX.XX.XX.XX:1194
Fri Feb 19 18:42:06 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Feb 19 18:42:06 2016 open_tun, tt->ipv6=0
Fri Feb 19 18:42:06 2016 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{XXXX}.tap
Fri Feb 19 18:42:06 2016 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.14/255.255.255.252 on interface {XXXX} [DHCP-serv: 10.8.0.13, lease-time: 31536000]
Fri Feb 19 18:42:06 2016 Successful ARP Flush on interface [15] {XXXX}
Fri Feb 19 18:42:11 2016 Warning: address 192.168.1.XX is not a network address in relation to netmask 255.255.255.0
Fri Feb 19 18:42:11 2016 ROUTE: route addition failed using CreateIpForwardEntry: The parameter is incorrect.   [status=87 if_index=15]
Fri Feb 19 18:42:11 2016 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Fri Feb 19 18:42:11 2016 ROUTE: route addition failed using CreateIpForwardEntry: The object already exists.   [status=5010 if_index=15]
Fri Feb 19 18:42:11 2016 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Fri Feb 19 18:42:11 2016 Initialization Sequence Completed

I'm a complete newbie on this so please go easy....

Cheers

Chris

Traffic

chrishoughton0 wrotea very helpful BBC tut

obviously not that helpful ..

chrishoughton0 wroteFri Feb 19 18:42:11 2016 ROUTE: route addition failed using CreateIpForwardEntry: The parameter is incorrect. [status=87 if_index=15]

or accurate ..

Please see the Forum rules (top of page)

chrishoughton0

Hi

Sorry - which forum roles have I contravened?

As I say, I'm completely new to OpenVPN so if I'm missing something obvious please let me know

Cheers

Chris

Traffic

See the top of this page:

If you would like help, here is a few things you will want to do in order to help us help you

and follow the instructions ..

chrishoughton0

Thanks Traffic, sorry for the misunderstanding

Server config:

local 192.168.1.87
dev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/BaronVPN.crt
key /etc/openvpn/easy-rsa/keys/BaronVPN.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig 10.8.0.1 10.8.0.2
push "route 10.8.0.1 255.255.255.255"
push "route 10.8.0.0 255.255.255.0"
push "route 192.168.1.87 255.255.255.0"
push "dhcp-option DNS 192.168.1.254"
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 1

Client config:

client
dev tun
proto udp
remote myvpnddns.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ns-cert-type server
key-direction 1
cipher AES-128-CBC
comp-lzo
verb 1
mute 20

The server log from the time of failed connection is:

Fri Feb 19 18:29:01 2016 88.128.80.157:8877 Re-using SSL/TLS context
Fri Feb 19 18:29:01 2016 88.128.80.157:8877 LZO compression initialized
Fri Feb 19 18:29:02 2016 88.128.80.157:8877 [ChrisPC] Peer Connection Initiated with [AF_INET]88.128.80.157:8877
Fri Feb 19 18:29:02 2016 ChrisPC/88.128.80.157:8877 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=*******
Fri Feb 19 18:29:04 2016 ChrisPC/88.128.80.157:8877 send_push_reply(): safe_cap=960
Fri Feb 19 18:30:00 2016 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Fri Feb 19 18:30:16 2016 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Fri Feb 19 18:30:18 2016 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Fri Feb 19 18:30:26 2016 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Fri Feb 19 18:30:28 2016 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Fri Feb 19 18:30:38 2016 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Fri Feb 19 18:30:47 2016 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)

Thanks again for your help with this

Cheers

Chris

Traffic

chrishoughton0 wrotepush "route 192.168.1.87 255.255.255.0"

Change this to:

push "route 192.168.1.0 255.255.255.0"

Then tell the people who wrote the tutorial that it is wrong.

Also,

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

:arrow: Never use 192.168.0.0/24 or 192.168.1.0/24 (or other common subnets) for your OpenVPN Server LAN :!:

You are advised to change your server LAN to a more unique RFC1918 compliant subnet. f.e 192.168.143.0/24

chrishoughton0

Thanks for the advice

So if I understand you correctly, I should then change to ...

push "route 192.168.143.0 255.255.255.0"

...On the basis I change my subnet configuration to the example you suggest?