Open VPN on Raspberry Pi - no internet or ping

batrelay

Hi.
I have installed Open VPN server on raspbian with this guide http://readwrite.com/2014/04/10/raspberry-pi-vpn-tutorial-server-secure-web-browsing/
I can connect to VPN and have access to local machines or ping them, but can't actually ping or access internet.
I have read other posts but none helped me 🙁

/etc/openvpn/server.conf

ocal 192.168.2.10 # SWAP THIS NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
dev tun
proto udp #Some people prefer to use tcp. Don't change it if you don't know.
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/Pi.crt # SWAP WITH YOUR CRT NAME
key /etc/openvpn/easy-rsa/keys/Pi.key # SWAP WITH YOUR KEY NAME
dh /etc/openvpn/easy-rsa/keys/dh2048.pem # If you changed to 2048, change that here!
server 10.8.0.0 255.255.255.0
# server and remote endpoints
ifconfig 10.8.0.1 10.8.0.2
# Add route to Client routing table for the OpenVPN Server
push "route 10.8.0.1 255.255.255.255"
# Add route to Client routing table for the OpenVPN Subnet
push "route 10.8.0.0 255.255.255.0"
# your local subnet
push "route 192.168.2.10 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
# Set primary domain name server address to the SOHO Router
# If your router does not do DNS, you can use Google DNS 8.8.8.8
push "dhcp-option DNS 192.168.2.1" # This should already match your router address and not need to be changed.
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 1
push "redirect-gateway def1"

logs from client on windows

Fri Mar 25 10:25:29 2016 OpenVPN 2.3.10 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Jan  4 2016
Fri Mar 25 10:25:29 2016 Windows version 6.2 (Windows 8 or greater)
Fri Mar 25 10:25:29 2016 library versions: OpenSSL 1.0.1q 3 Dec 2015, LZO 2.09
Enter Management Password:
Fri Mar 25 10:25:32 2016 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Fri Mar 25 10:25:32 2016 Control Channel Authentication: tls-auth using INLINE static key file
Fri Mar 25 10:25:32 2016 UDPv4 link local: [undef]
Fri Mar 25 10:25:32 2016 UDPv4 link remote: [AF_INET][HERE WAS PUBLIC IP]:1194
Fri Mar 25 10:25:33 2016 [Pi] Peer Connection Initiated with [AF_INET][HERE WAS PUBLIC IP]:1194
Fri Mar 25 10:25:35 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Mar 25 10:25:35 2016 open_tun, tt->ipv6=0
Fri Mar 25 10:25:35 2016 TAP-WIN32 device [Ethernet 3] opened: \\.\Global\{D24E407C-8421-4366-A786-F560AFD699A4}.tap
Fri Mar 25 10:25:35 2016 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.10/255.255.255.252 on interface {D24E407C-8421-4366-A786-F560AFD699A4} [DHCP-serv: 10.8.0.9, lease-time: 31536000]
Fri Mar 25 10:25:35 2016 Successful ARP Flush on interface [16] {D24E407C-8421-4366-A786-F560AFD699A4}
Fri Mar 25 10:25:40 2016 Warning: address 192.168.2.10 is not a network address in relation to netmask 255.255.255.0
Fri Mar 25 10:25:40 2016 ROUTE: route addition failed using CreateIpForwardEntry: The parameter is incorrect.   [status=87 if_index=16]
Fri Mar 25 10:25:40 2016 env_block: add PATH=C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem
Fri Mar 25 10:25:40 2016 ROUTE: route addition failed using CreateIpForwardEntry: The object already exists.   [status=5010 if_index=16]
Fri Mar 25 10:25:40 2016 env_block: add PATH=C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem
Fri Mar 25 10:25:40 2016 Initialization Sequence Completed

file called /etc/firewall-openvpn-rules.sh

#!/bin/sh

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.2.10

# Allow traffic initiated from VPN to access LAN
iptables -I FORWARD -i tun0 -o eth0 \
         -s 10.8.0.0/24 -d 192.168.0.0/24 \
         -m conntrack --ctstate NEW -j ACCEPT

# Allow traffic initiated from VPN to access "the world"
iptables -I FORWARD -i tun0 -o eth1 \
         -s 10.8.0.0/24 -m conntrack --ctstate NEW -j ACCEPT

# Allow traffic initiated from LAN to access "the world"
iptables -I FORWARD -i eth0 -o eth1 \
         -s 192.168.0.0/24 -m conntrack --ctstate NEW -j ACCEPT

 # Allow established traffic to pass back and forth
iptables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED \
         -j ACCEPT

# Notice that -I is used, so when listing it (iptables -vxnL) it
# will be reversed.  This is intentional in this demonstration.

# Masquerade traffic from VPN to "the world" -- done in the nat table
iptables -t nat -I POSTROUTING -o eth1 \
          -s 10.8.0.0/24 -j MASQUERADE

# Masquerade traffic from LAN to "the world"
iptables -t nat -I POSTROUTING -o eth1 \
          -s 192.168.0.0/24 -j MASQUERADE

# OpenVPN
iptables -A INPUT -i eth0 -m state --state NEW -p udp --dport 1194 -j ACCEPT

# Allow TUN interface connections to OpenVPN server
iptables -A INPUT -i tun+ -j ACCEPT

# Allow TUN interface connections to be forwarded through other interfaces
iptables -A FORWARD -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT

# NAT the VPN client traffic to the internet
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE


iptables -A OUTPUT -o tun+ -j ACCEPT

/etc/openvpn/easy-rsa/keys/Default.txt

client
dev tun
proto udp
remote [PUBLIC IP WAS HERE] 1194
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ns-cert-type server
key-direction 1
cipher AES-128-CBC
comp-lzo
verb 1
mute 20

/etc/network/interfaces

/etc/sysctl.conf

Traffic

batrelay wrotepush "route 192.168.2.10 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERRY PI IP ADDRESS

change to:

push "route 192.168.2.0 255.255.255.0"

batrelay wrotefile called /etc/firewall-openvpn-rules.sh

This file is all over the place, do not use it !

Iptables required rule:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

Set --verb 4 in your configs for better information.

batrelay

Ok, so it seems

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.2.10

If I enter this code in terminal it work, but for some reason line "pre up" doesnt work in interfaces. Is there are any other way to inject iptables lines at boot? And why it does this code does not reveal itself on "iptables -L". I checked every time with this and dont know why it does not show up 🙁, even If know i can ping outside of nat.
Thanks anyway 🙂.

MCoolU

did you ever figure this out?

I am able to connect to the VPN and use the internet with almost the same setup as you.

Try using the google DNS instead:
change this:
push "dhcp-option DNS 192.168.2.1"

to this:
push "dhcp-option DNS 8.8.8.8"

I also have only this in my firewall rules:
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o wlan0 -j SNAT --to-source 192.168.0.6

I have it setup as wlan0 since my RPI is on wifi. I do have a question though. When you connect to your VPN remotely, are you able to see the other machines on your internal network? I can connect remotely, but can't see my machines at home that are connected at the same time.

MCoolU

batrelay wroteOk, so it seems
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.2.10
If I enter this code in terminal it work, but for some reason line "pre up" doesnt work in interfaces. Is there are any other way to inject iptables lines at boot? And why it does this code does not reveal itself on "iptables -L". I checked every time with this and dont know why it does not show up 🙁, even If know i can ping outside of nat.
Thanks anyway 🙂.

When I run "iptables -L" as well, i don't see the firewall rules. I think this may be my issue. Were you able to figure this part out?

this is what I have in my /etc/network/interfaces folder:

auto wlan0

iface lo inet loopback
iface eth0 inet dhcp

allow-hotplug wlan0
iface wlan0 inet static
pre-up /etc/firewall-openvpn-rules.sh
address 192.168.0.6
netmask 255.255.255.0
network 192.168.0.0
broadcast 192.168.0.255
gateway 192.168.0.1
wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf
iface default inet dhcp

Pippin

Try this:

iptables -t nat -Lnv

Food for the brain :geek:
https://www.frozentux.net/iptables-tutorial/iptables-tutorial.html

BarrettOne

Hello! Why doesn't your vpn open real pokie games? Everything was fine until September, but now it doesn't work for some reason. Can someone please help?

Clintan

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.