[Solved] Raspberry Pi BBC tutorial: Cannot access server LAN

robbo100

Hi there,

I have successfully (I thought), setup my Raspberry Pi with OpenVPN, but until now, had only tested it using my LTE 3G Cellular Network using my iPhone. I have also been able to connect to my iPhone's Hotspot using a laptop and then run TunnelBlick on the laptop and successfully connect to the LAN.

However, today I tried it using another LAN (someone else home network) to connect to the VPN for the first time, and it doesn't work. I can connect to the VPN, but do not get onto the network and can not connect to the internet through my VPN.

I notice that my home LAN is 192.168.1.1 -> and the other LAN I am using is also using the same subnet range. However, the iPhone Hotspot DHCP uses 172.20.10.x. Could it be that OpenVPN does not like connecting between the same IP address range???

local 192.168.1.81 # SWAP THIS NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
dev tun
#dev tap0
proto udp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/HomeVPN.crt # SWAP XX WITH YOUR SERVER NAME
key /etc/openvpn/easy-rsa/keys/HomeVPN.key # SWAP XX WITH YOUR SERVER NAME
dh /etc/openvpn/easy-rsa/keys/dh2048.pem # IF YOU CHANGED YOUR ENCRYPTION TO 20$
server 10.8.0.0 255.255.255.0
# server-bridge 192.168.1.81 255.255.255.0 192.168.1.1 192.168.1.254
# server and remote endpoints
ifconfig 10.8.0.1 10.8.0.2
# Add route to Client routing table for the OpenVPN Server
push "route 10.8.0.1 255.255.255.255"
# Add route to Client routing table for the OpenVPN Subnet
push "route 10.8.0.0 255.255.255.0"
# your local subnet
push "route 192.168.1.81 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERR$
# Set primary domain name server address to the SOHO Router
# If your router does not do DNS, you can use Google DNS 8.8.8.8
push "dhcp-option DNS 192.168.1.1" # THIS SHOULD ALREADY MATCH YOUR OWN ROUTER $
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 1

What other information do people need from me to help diagnose the problem?

Thanks in advance.

Robbo100

Traffic

robbo100 wroteWhat other information do people need from me to help diagnose the problem?

None

robbo100 wroteI notice that my home LAN is 192.168.1.1 -> and the other LAN I am using is also using the same subnet range. However, the iPhone Hotspot DHCP uses 172.20.10.x. Could it be that OpenVPN does not like connecting between the same IP address range???

Y or N .. ?

robbo100 wrote I have also been able to connect to my iPhone's Hotspot using a laptop and then run TunnelBlick on the laptop and successfully connect to the LAN.

8-)

If you set --verb 4 in your configs you will probably find a warning something like this:

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

So:
:arrow: Never use 192.168.0.0/24 or 192.168.1.0/24 (or other common subnets) for your OpenVPN Server LAN :!:

You are advised to change your server LAN to a more unique RFC1918 compliant subnet. f.e 192.168.143.0/24

FYI:

# your local subnet
push "route 192.168.1.81 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERR$

try the correct route:

# your local subnet
push "route 192.168.1.0 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERR$

Please let the guys at Pi know about their tutorial ..

robbo100

Traffic wroteYou are advised to change your server LAN to a more unique RFC1918 compliant subnet. f.e 192.168.143.0/24

Thank you so much for giving me such a quick and helpful reply to my question.

Now, the main question for myself... Do I feel brave enough to completely re-configure my home network using my laptop remotely connected via my iPhone Hotspot, or is that sure to result in utter IT devastation! :lol:

Thinking about it, once I change the subnet on the router and reboot it, it is unlikely to force a change to the Raspberry Pi (VPN Server) IP address without a reboot, so I will be potentially unable to then reconnect to the LAN through the VPN. I think this is probably a job to do when I am actually inside the house. 8-)

robbo100

Oh, and by the way, would this code:

# your local subnet
push "route 192.168.1.0 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERR$

then become:

# your local subnet
push "route 192.168.143.0 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERR$

???

Traffic

robbo100 wroteDo I feel brave enough to completely re-configure my home network using my laptop remotely connected

That would be brave indeed .. not that it cannot be done .. but I would not. :ugeek:

robbo100 wroteOh, and by the way, would this code

yes .. please link to this on Pi.

robbo100

I will do my best to feed this back to the author of the guide I used.

Thanks again for your help.

Traffic

If you care to post a link here .. that ought to be enough 8-)

robbo100

It was here: http://www.bbc.co.uk/news/technology-33548728

Traffic

I might have guessed ..

The BBC .. plagiarizing the original Pi tutorial and not even bothering to improve it !

The BBC License Fee:

Being Taxed for Sitting down in your own home to support the lives of over paid snobs.
Snobs that this post proves are plagiarists

Did you know:

The BBC want to make you pay a License Fee for using the Internet ?
And they are lobbying hard for it to be upheld by the British Courts !

Just Say NO To the BBC License Fee !

robbo100

Well, not wanting to argue about it, but I do think the BBC has done loads of great work over the years and have made a massive contribution to my quality of life and that of many others.

It is fair to say that the licence system probably needs modernisation, but I for one would be extremely sad to see the BBC disappear. I have never seen anything about needing to pay the BBC for the Internet.

In terms of them plagiarising the Raspberry Pi guide. If they did that with the Open Source project that I am involved in, I would be delighted! Having such a massively well known organisation, with enormous outreach publicise your software and the great work that the OpenVPN community has achieved, is a massive complement!

Traffic

robbo100 wroteIf they did that with the Open Source project that I am involved in, I would be delighted!

You could have mentioned the name 😉

robbo100 wroteIn terms of them plagiarising the Raspberry Pi guide

The URL you posted shows they literally copy/pasted it ..

The least they could do is link to the openvpn website/howto or something .. they do link to Pi.
I expect their greedy little fingers are all sticky with their investment in Raspberry Pi .. (Remember the BBC Micro ?)

http://www.bbc.co.uk/aboutthebbc/insidethebbc/whoweare/licencefee

About the licence fee

Everyone in the UK who watches or records TV programmes at the same as they are shown on TV needs to be covered by a TV licence. This includes TVs, computers, mobile phones, games consoles, digital boxes and DVD/VHS recorders.

The onus is on you to prove that you do not watch TV at the same as they are shown on TV.. and they want to make it Law for Everyone in the UK with an internet connection regardless of television set to Pay a TV License (better known as TAX)

And IMHO, their interest in VPNs is to find a way to ban non-UK license fee payers from their content on the internet.
(How are they to justify their Tax if ... Maybe I should start a thread in Off-Topic(Related) :mrgreen: )

You are, of course, welcome to your opinion .. no particular offence intended.

robbo100

Don't worry, no offence taken. Always good to have a healthy debate about these things. :-)

Thanks again for all the help, you have been excellent.

Robbo100

P.S. It is MediaPortal