Thanks for the HowTo link. I compared against my config and I believe I've already incorporated the suggestions into my setup. Unfortunately I've been through countless HowTo's and forum posts with no success. I'm resorting to using the life line. Both server and client logs show connection. When I try to access a web page via Safari on my iPhone I receive "Safari could not open the page" msg. Please see config info below, I've masked public IP where applicable with xx.xxx.xx.x:
server.conf
local 192.168.1.9
dev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/pivpnserv.crt
key /etc/openvpn/easy-rsa/keys/pivpnserv.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig 10.8.0.1 10.8.0.2
push "route 10.8.0.1 255.255.255.255"
push "route 10.8.0.0 255.255.255.0"
push "route 192.168.1.9 255.255.255.0"
push "dhcp-option DNS 192.168.1.1"
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 1
/etc/firewall-openvpn-rules.sh
#!/bin/sh
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
interfaces
source-directory /etc/network/interfaces.d
auto lo
iface lo inet loopback
iface eth0 inet static
pre-up /etc/firewall-openvpn-rules.sh
allow-hotplug wlan0
iface wlan0 inet manual
wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf
allow-hotplug wlan1
iface wlan1 inet manual
wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf
ifconfig on server
eth0 Link encap:Ethernet HWaddr b8:27:eb:d2:6e:0e
inet addr:192.168.1.4 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::7883:575d:4867:ca71/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1396 errors:0 dropped:0 overruns:0 frame:0
TX packets:758 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:109496 (106.9 KiB) TX bytes:109118 (106.5 KiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:200 errors:0 dropped:0 overruns:0 frame:0
TX packets:200 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:16656 (16.2 KiB) TX bytes:16656 (16.2 KiB)
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:101 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:6568 (6.4 KiB) TX bytes:0 (0.0 B)
wlan0 Link encap:Ethernet HWaddr b8:27:eb:87:3b:5b
inet addr:192.168.1.9 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::ba27:ebff:fe87:3b5b/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:502 errors:0 dropped:42 overruns:0 frame:0
TX packets:54 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:41731 (40.7 KiB) TX bytes:9888 (9.6 KiB)
iptables -L -v -t nat
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Client config Default.txt used with MakeOVPN.sh
client
dev tun
proto udp
remote xx.xxx.xx.x 1194
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ns-cert-type server
key-direction 1
cipher AES-128-CBC
comp-lzo
verb 1
mute 20
openvpn.log (server)
Mon Apr 11 20:18:52 2016 OpenVPN 2.3.4 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jan 23 2016
Mon Apr 11 20:18:52 2016 library versions: OpenSSL 1.0.1k 8 Jan 2015, LZO 2.08
Mon Apr 11 20:18:52 2016 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts i$
Mon Apr 11 20:18:52 2016 Control Channel Authentication: using '/etc/openvpn/easy-rsa/keys/ta.key' as a OpenVPN static key file
Mon Apr 11 20:18:52 2016 TUN/TAP device tun0 opened
Mon Apr 11 20:18:52 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Apr 11 20:18:52 2016 /sbin/ip link set dev tun0 up mtu 1500
Mon Apr 11 20:18:52 2016 /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
Mon Apr 11 20:18:52 2016 GID set to nogroup
Mon Apr 11 20:18:52 2016 UID set to nobody
Mon Apr 11 20:18:52 2016 UDPv4 link local (bound): [AF_INET]192.168.1.9:1194
Mon Apr 11 20:18:52 2016 UDPv4 link remote: [undef]
Mon Apr 11 20:18:52 2016 Initialization Sequence Completed
Mon Apr 11 20:19:37 2016 xx.xxx.xx.x:1024 [ClientEdIos] Peer Connection Initiated with [AF_INET]24.187.21.4:1024
Mon Apr 11 20:19:37 2016 ClientEdIos/24.187.21.4:1024 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Mon Apr 11 20:19:37 2016 ClientEdIos/24.187.21.4:1024 send_push_reply(): safe_cap=940
Mon Apr 11 20:28:02 2016 xx.xxx.xx.x:1024 [ClientEdIos] Peer Connection Initiated with [AF_INET]xx.xxx.xx.x:1024
Mon Apr 11 20:28:02 2016 ClientEdIos/xx.xxx.xx.x:1024 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Mon Apr 11 20:28:02 2016 ClientEdIos/xx.xxx.xx.x:1024 send_push_reply(): safe_cap=940
OpenVPN log (Client)
2016-04-11 20:43:58 VERIFY OK: depth=0
cert. version : 3
serial number : 01
issuer name : C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA, ??=EasyRSA, emailAddress=me@myhost.mydomain
subject name : C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=pivpnserv, ??=EasyRSA, emailAddress=me@myhost.mydomain
issued on : 2016-04-09 02:12:02
expires on : 2026-04-07 02:12:02
signed using : RSA with SHA-256
RSA key size : 2048 bits
basic constraints : CA=false
cert. type : SSL Server
key usage : Digital Signature, Key Encipherment
ext key usage : TLS Web Server Authentication
2016-04-11 20:43:59 SSL Handshake: TLSv1.0/TLS-DHE-RSA-WITH-AES-256-CBC-SHA
2016-04-11 20:43:59 Session is ACTIVE
2016-04-11 20:43:59 EVENT: GET_CONFIG
2016-04-11 20:43:59 Sending PUSH_REQUEST to server...
2016-04-11 20:43:59 OPTIONS:
0 [route] [10.8.0.1] [255.255.255.255]
1 [route] [10.8.0.0] [255.255.255.0]
2 [route] [192.168.1.9] [255.255.255.0]
3 [dhcp-option] [DNS] [192.168.1.1]
4 [redirect-gateway] [def1]
5 [route] [10.8.0.0] [255.255.255.0]
6 [topology] [net30]
7 [ping] [10]
8 [ping-restart] [120]
9 [ifconfig] [10.8.0.6] [10.8.0.5]
2016-04-11 20:43:59 LZO-ASYM init swap=0 asym=0
2016-04-11 20:43:59 EVENT: ASSIGN_IP
2016-04-11 20:43:59 Error parsing IPv4 route: [route] [192.168.1.9] [255.255.255.0] : tun_prop_error: route is not canonical
2016-04-11 20:43:59 Connected via tun
2016-04-11 20:43:59 EVENT: CONNECTED @xx.xxx.xx.x:1194 (xx.xxx.xx.x) via /UDPv4 on tun/10.8.0.6/
2016-04-11 20:43:59 SetStatus Connected
2016-04-11 20:44:00 TUN reset routes
2016-04-11 20:44:00 EVENT: DISCONNECTED
2016-04-11 20:44:00 Raw stats on disconnect:
BYTES_IN : 22431
BYTES_OUT : 29533
PACKETS_IN : 188
PACKETS_OUT : 288
TUN_BYTES_IN : 7506
TUN_PACKETS_IN : 109
N_PAUSE : 2
N_RECONNECT : 2
2016-04-11 20:44:00 Performance stats on disconnect:
CPU usage (microseconds): 1141845
Tunnel compression ratio (downlink): inf
Network bytes per CPU second: 45508
Tunnel bytes per CPU second: 6573
2016-04-11 20:44:00 ----- OpenVPN Stop -----
