client tun connected, server not accessible from outside

bicklp

Hey

I have an ubuntu server running OpenVPN server so i can get on my LAN from outside.
I also have a PIA account which i connect to from the same machine using one of their conf files. The idea being i can connect to my LAN from anywhere, get access to my files etc, but im also using the PIA vpn at the same time when browsing...

I can connect to my server from inside and outside the network if the PIA tunnel(tun1) is not running.
But, If i start the PIA tunnel(tun1) i can connect to my openvpn server from inside my LAN but not from outside.

I have had this working before but cant get it going again, im missing something and im sure its a small thing.

I have my server set as tun0 and am connecting in on 1197/udp
my client file(start.conf) goes directly to PIA and is set as tun1

here is my server.conf
(always works from inside the LAN, works from outside if tun1 is not connected)
-------
local 192.168.1.133 # Local IP Address of VPN SERVER
dev tun0
proto udp
port 1197
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt # Change [server] to NAME OF VPN SERVER
key /etc/openvpn/easy-rsa/keys/server.key # Change [server] to NAME OF VPN SERVER
dh /etc/openvpn/easy-rsa/keys/dh2048.pem # If you changed to 2048, change that here!
server 10.8.0.0 255.255.255.0
ifconfig 10.8.0.1 10.8.0.2
push "route 10.8.0.1 255.255.255.255"
push "route 10.8.0.0 255.255.255.0"
push "route 192.168.1.0 255.255.255.0" # Change To IP range of your Local subnet ie x.x.x.0
push "dhcp-option DNS 8.8.8.8" # Set to Gateway Address of network
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
multihome
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 3

here is my start.conf which is for PIA
------
client
dev tun
proto udp
remote nl.privateinternetaccess.com 1194
resolv-retry infinite
persist-key
persist-tun
nobind
ca ca.crt
tls-client
multihome
remote-cert-tls server
auth-user-pass
comp-lzo
verb 1
reneg-sec 0
crl-verify crl.pem
auth-user-pass login.txt
keepalive 10 60 resolv-retry infinite

I am using a pre-up on the network interfaces file for some postrouting
---
# The primary network interface
auto eth0
allow-hotplug eth0
iface eth0 inet static
pre-up /etc/firewall-openvpn-rules.sh
address 192.168.1.133
netmask 255.255.255.0
gateway 192.168.1.1
dns-nameserver 208.67.222.222

pre-up file
---
#firewall-openvpn-rules.sh
#!/bin/sh
#
#wlan0 is interface name
#tun0 is OpenVPN Server
#tun1 is PIA
#
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.1.133
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
#
# For IP Forwarding through PIA
#
iptables -A FORWARD -i tun0 -o tun1 -j ACCEPT
iptables -A FORWARD -i tun1 -o tun0 -j ACCEPT
iptables -A FORWARD -i eth0 -o tun1 -j ACCEPT
iptables -A FORWARD -i tun1 -o eth0 -j ACCEPT

and these are my UFW rules
----
sudo ufw allow OpenSSH
sudo ufw default deny incoming
sudo ufw default deny outgoing
sudo ufw allow out on tun1
sudo ufw allow out to 192.168.1.0/24
sudo ufw allow in from 192.168.1.0/24
sudo ufw allow in from 10.8.0.0/24
sudo ufw allow out from 10.8.0.0/24
sudo ufw allow out 1194/udp
sudo ufw allow 1197/udp
sudo ufw allow out 53/udp
sudo ufw enable

Any help in sorting this out would be great, thanks, i am by no means an expert and have bolted this together from numerous posts around the web

Thanks

Traffic

bicklp wroteIf i start the PIA tunnel(tun1) i can connect to my openvpn server from inside my LAN but not from outside.

Because PIA will redirect your default gateway ..

bicklp

ye i though something like that....
but i have a raspberry pi2 setup and i thought it wasnt working but it is just as i want.
it has tun0 server tun1 pia and i can conntect from LAN and WAN when both are up.
if i connect in i can see my LAN and have an external IP from PIA

both are my home network
im just not sure what the difference is on the pi to this ubuntu server...any ideas what to check

im using exactly the same config files, just different ports and local IPS
same ufw rules
same pre-up rules

i set the pi up along time ago and cant remember if i may have entered commands manually that have stuck somewhere which is whats making the difference

the pi client config is exaclty the same on both
---
client
dev tun1
proto udp
remote nl.privateinternetaccess.com 1194
resolv-retry infinite
persist-key
persist-tun
nobind
ca ca.crt
tls-client
remote-cert-tls server
auth-user-pass
comp-lzo
verb 1
reneg-sec 0
crl-verify crl.pem
auth-user-pass login.txt
keepalive 10 60 resolv-retry infinite

only difference in server config is the lines
---
local 192.168.1.133
port 1197
cert
key

same ufw rules on both
---
sudo ufw allow OpenSSH
sudo ufw default deny incoming
sudo ufw default deny outgoing
sudo ufw allow out on tun1
sudo ufw allow out to 192.168.1.0/24
sudo ufw allow in from 192.168.1.0/24
sudo ufw allow in from 10.8.0.0/24
sudo ufw allow out from 10.8.0.0/24
sudo ufw allow out 1194/udp
sudo ufw allow 1195/udp
sudo ufw allow out 53/udp
sudo ufw enable

same pre-up on both just differnet source ip
---
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.1.133
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o tun1 -j MASQUERADE
iptables -A FORWARD -i tun0 -o tun1 -j ACCEPT
iptables -A FORWARD -i tun1 -o tun0 -j ACCEPT
iptables -A FORWARD -i eth0 -o tun1 -j ACCEPT
iptables -A FORWARD -i tun1 -o eth0 -j ACCEPT

i dont really know much about routing or nat so there could well be a rule somewhere that is making this work...where would i look ?

Traffic

Post route -n from the Pi and Ubuntu servers .. with PIA connected and openvpn server up.

bicklp

tun0 and tun1 up on both

Ubuntu Server
---
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 10.161.1.5 128.0.0.0 UG 0 0 0 tun1
0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
10.8.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
10.161.1.1 10.161.1.5 255.255.255.255 UGH 0 0 0 tun1
10.161.1.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun1
109.201.154.159 192.168.1.1 255.255.255.255 UGH 0 0 0 eth0
128.0.0.0 10.161.1.5 128.0.0.0 UG 0 0 0 tun1
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0

Raspberry Pi
---
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 10.185.1.5 128.0.0.0 UG 0 0 0 tun1
0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0
0.0.0.0 192.168.1.1 0.0.0.0 UG 202 0 0 eth0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
10.8.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
10.185.1.1 10.185.1.5 255.255.255.255 UGH 0 0 0 tun1
10.185.1.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun1
46.166.190.180 192.168.1.1 255.255.255.255 UGH 0 0 0 eth0
128.0.0.0 10.185.1.5 128.0.0.0 UG 0 0 0 tun1
192.168.1.0 0.0.0.0 255.255.255.0 U 202 0 0 eth0

bicklp

on raspberry pi i see 2 entries not in ubuntu that have the metric 202 is that anything
(thanks for help by the way!)

0.0.0.0 192.168.1.1 0.0.0.0 UG 202 0 0 eth0
192.168.1.0 0.0.0.0 255.255.255.0 U 202 0 0 eth0

bicklp

I have got it working but not sure if my traffic is secure now...if i connect in i get a PIA external IP and if i use lynx onthe server to connect to ipleak.net i see the same PIA address....if i stop OpenVPN i get no traffic as UFW routes all through tun1 ... but not sure if these rules mess with that

taken from here http://unix.stackexchange.com/questions/33048/remote-ssh-login-not-working

As penguin359 correctly said, the problem is that the return packets will be routed over the VPN instead of via your local router, which is where the incoming connection came from. SNAT on the router is one solution, but if that's not feasible, you can use advanced routing on your PC.

You'll need to add these advanced routing rules in addition to your existing iptables rules

ip rule add from 192.168.1.133 table 128
ip route add table 128 to 192.168.1.0/24 dev eth0
ip route add table 128 default via 192.168.1.1
Replace 192.168.1.1 with the LAN IP address of your PC. 192.168.1.1 is your LAN's router and 192.168.1.0/24 is your LAN's subnet.

The first command creates a rule which causes any packet with a source address of 192.168.1.X to use a special routing table which has number 128. The next two commands create routing table 128, in which the default gateway is your router (and not your VPN server like in the main routing table).

The only packets which will have a source address of 192.168.1.X will be packets responding to incoming connections from your router (i.e. port-forwarded SSH connections) and packets destined for your LAN. These are exactly the packets which you want to not use your VPN. All other outgoing packets will have a different source address and will use the main routing table which routes them over your VPN.

bicklp

I take it back ... that didnt work

i can get onto the VPN server from outside now, but i can no longer browse my LAN ...
mental, cant figure out whats happening on the pi thats different

Traffic

bicklp wroteThe idea being i can connect to my LAN from anywhere, get access to my files etc, but im also using the PIA vpn at the same time when browsing...

I am not saying this cannot be done .. but it can not be done using openvpn alone. You will have to write some fairly complex scripts to achieve your goal.

bicklp

I have I set up and working on my raspberry pi 2 and used no scripts. Just can't remember how I got it working. Was last year sometime. It's working great there. Cant see any difference in iptables, firewall, routes. Its just working. V weird.

Sent from my Nexus 5X using Tapatalk

bicklp

bicklp wroteI have I set up and working on my raspberry pi 2 and used no scripts. Just can't remember how I got it working. Was last year sometime. It's working great there. Cant see any difference in iptables, firewall, routes. Its just working. V weird.

Sent from my Nexus 5X using Tapatalk

I can reboot the pi, clear the iptables and it still works. So random.

Sent from my Nexus 5X using Tapatalk

Traffic

bicklp wroteI have I set up and working on my raspberry pi 2 and used no scripts

We will have to agree to disagree on that.

bicklp wroteJust can't remember how

Yup .. let us know if you figure out what you did 8-)

bicklp

I know this was last year but i got this working with just openvpn and a bit of messing
here is a link to the new post explaining how i got it working, but asking if its totally secure

https://forums.openvpn.net/viewtopic.php?f=6&t=23803