Hello and thanks in advance.
Goal: 'Server' (Debian/raspbian, 192.168.1.110) running both a server (for remote access to server only - no lan or internet) and a client (for the 'server' to access the internet via 3rd party server).
The present situation is that either works fine without the other. Remote clients can connect to the server (ping 192.168.1.110 ok). But as soon as the server becomes a client itself to the 3rd party provider, the original client seems to no longer be able to access the server (i.e. ping 192.168.1.110 fails).
If I connect the server to the 3rd party using
route-nopull, clients can still connect and communicate
but of course the server is then not routing its internet traffic to the 3rd party server.
If you could offer any assistance it would be greatly appreciated. Thanks
Below are 3 config files:
- one for clients to my server (192.168.1.110)
- one for the server (192.168.1.110, tun1)
- one for the server to connect to the third party (tun0)
Also: results of route -nv on server (192.168.1.110) for four states.
client.conf for connecting to server 192.168.1.110:
client
dev tun
proto udp
remote <external IP> 1195
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ns-cert-type server
key-direction 1
cipher AES-128-CBC
comp-lzo
verb 1
mute 20
<certificates etc>
server.conf for 192.168.1.110, tun1:
local 192.168.1.110
dev tun1
proto udp
port 1195
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/rpi-adam.crt
key /etc/openvpn/easy-rsa/keys/rpi-adam.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig 10.8.0.1 10.8.0.2
push "route 10.8.0.0 255.255.255.0"
push "dhcp-option DNS 192.168.1.1"
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status-server.log 20
log /etc/openvpn/openvpn-server.log
verb 4
client.conf for server (192.168.1.110) to connect to 3rd party:
client
dev tun0
proto udp
remote <server-ip> 1194
resolv-retry infinite
remote-random
nobind
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
persist-key
persist-tun
ping 15
ping-restart 0
ping-timer-rem
reneg-sec 0
log /etc/openvpn/openvpn-client.log
remote-cert-tls server
route-nopull
auth-user-pass /etc/openvpn/auth.txt
comp-lzo
verb 4
pull
fast-io
cipher AES-256-CBC
Results of route -nv on server (192.168.1.110) for four states:
############ No VPNs running ############
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0
0.0.0.0 192.168.1.1 0.0.0.0 UG 202 0 0 eth0
192.168.1.0 0.0.0.0 255.255.255.0 U 202 0 0 eth0
############ Client VPN running ############
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 10.8.8.173 128.0.0.0 UG 0 0 0 tun0
0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0
0.0.0.0 192.168.1.1 0.0.0.0 UG 202 0 0 eth0
10.8.8.1 10.8.8.173 255.255.255.255 UGH 0 0 0 tun0
10.8.8.173 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
107.181.128.59 192.168.1.1 255.255.255.255 UGH 0 0 0 eth0
128.0.0.0 10.8.8.173 128.0.0.0 UG 0 0 0 tun0
192.168.1.0 0.0.0.0 255.255.255.0 U 202 0 0 eth0
############ Server VPN running ############
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0
0.0.0.0 192.168.1.1 0.0.0.0 UG 202 0 0 eth0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun1
10.8.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun1
192.168.1.0 0.0.0.0 255.255.255.0 U 202 0 0 eth0
############ Client and Server VPNs running ############
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 10.8.8.173 128.0.0.0 UG 0 0 0 tun0
0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0
0.0.0.0 192.168.1.1 0.0.0.0 UG 202 0 0 eth0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun1
10.8.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun1
10.8.8.1 10.8.8.173 255.255.255.255 UGH 0 0 0 tun0
10.8.8.173 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
107.181.128.59 192.168.1.1 255.255.255.255 UGH 0 0 0 eth0
128.0.0.0 10.8.8.173 128.0.0.0 UG 0 0 0 tun0
192.168.1.0 0.0.0.0 255.255.255.0 U 202 0 0 eth0
