Hi!
First of all I am new OpenVPN user, and new to this forum, so I do apologize if my question is at the wrong place or if it is a stupid one, but I have spent quite some time looking for an answer without finding it...
So here is my situation :
- I want to set my computer (Ubuntu 16.04) as a VPN server. It has a local IP address 192.168.43.190, and a public IP
- I have one raspberry pi as a VPN client, on a DIFFERENT network, local IP = 192.168.1.24, and public IP
(I'm using openVPN)
I have followed that guide :
https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-ubuntu-16-04 which is very clear, and it worked perfectly when I first tried to have server and client on the same network (so I only used local IPs).
Now I am trying to separate the client and server on 2 different networks (raspberry on my private network, and server on my phone's Wifi, I don't know if that can cause any problem).
From what I have read it seems I need to add a port-forwarding rule on UFW to redirect packets coming to the public IP of my server's network towards the local IP of my server.
Here is my /etc/ufw/before.rules (where server-public-IP is my public server IP, and wlo1 is the name of my wifi interface) :
# START OPENVPN RULES
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-F
-A PREROUTING -i wlo1 -p udp -d server-public-IP --dport 1194 -j DNAT -to-destination 192.168.43.190:1194
-A POSTROUTING -s 10.8.0.0/8 -o wlo1 -j MASQUERADE
COMMIT
# END OPENVPN RULES
# Don't delete these required lines, otherwise there will be errors
*filter
:ufw-before-input - [0:0]
:ufw-before-output - [0:0]
:ufw-before-forward - [0:0]
:ufw-not-local - [0:0]
# End required lines
# allow all on loopback
-A ufw-before-input -i lo -j ACCEPT
-A ufw-before-output -o lo -j ACCEPT
# quickly process packets for which we already have a connection
-A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
# drop INVALID packets (logs these in loglevel medium and higher)
-A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny
-A ufw-before-input -m conntrack --ctstate INVALID -j DROP
# ok icmp codes for INPUT
-A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT
-A ufw-before-input -p icmp --icmp-type source-quench -j ACCEPT
-A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT
-A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT
-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT
# ok icmp code for FORWARD
-A ufw-before-forward -p icmp --icmp-type destination-unreachable -j ACCEPT
-A ufw-before-forward -p icmp --icmp-type source-quench -j ACCEPT
-A ufw-before-forward -p icmp --icmp-type time-exceeded -j ACCEPT
-A ufw-before-forward -p icmp --icmp-type parameter-problem -j ACCEPT
-A ufw-before-forward -p icmp --icmp-type echo-request -j ACCEPT
# allow dhcp client to work
-A ufw-before-input -p udp --sport 67 --dport 68 -j ACCEPT
#
# ufw-not-local
#
-A ufw-before-input -j ufw-not-local
# if LOCAL, RETURN
-A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN
# if MULTICAST, RETURN
-A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN
# if BROADCAST, RETURN
-A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN
# all other non-local packets are dropped
-A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny
-A ufw-not-local -j DROP
# allow MULTICAST mDNS for service discovery (be sure the MULTICAST line above is uncommented)
-A ufw-before-input -p udp -d 224.0.0.251 --dport 5353 -j ACCEPT
# allow MULTICAST UPnP for service discovery (be sure the MULTICAST line above is uncommented)
-A ufw-before-input -p udp -d 239.255.255.250 --dport 1900 -j ACCEPT
# don't delete the 'COMMIT' line or these rules won't be processed
COMMIT
So the only lines I added after making it work on a local network are the two "PREROUTING" lines.
Here is my server.conf (without the comments) :
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
tls-auth ta.key 0
key-direction 0
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
And my client.ovpn (without the comments) :
client
dev tun
proto udp
remote server-public-IP 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
#ca ca.crt
#cert client.crt (these lines are commented because in the full file, the certificates are at the bottom)
#key client.key
remote-cert-tls server
comp-lzo
verb 3
key-direction 1
And I have in /etc/default/ufw :
DEFAULT_FORWARD_POLICY="ACCEPT"
and in /etc/sysctl.conf :
net.ipv4.ip_forward=1
Here is the result of "sudo ufw status" :
Vers Action De
---- ------ --
1194/udp ALLOW Anywhere
1194/udp (v6) ALLOW Anywhere (v6)
1194/udp ALLOW OUT Anywhere
1194/udp (v6) ALLOW OUT Anywhere (v6)
However, I still can't manage to connect to the server (I get the "TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)") when server is running and I type on the client :
sudo openvpn /etc/openvpn/client.ovpn
Would you see what is wrong with my setup ? I am not at all an experienced VPN user so that might be stupid, but I have already spent a lot of time looking for my mistakes and searching for similar cases on forums... I checked that too
https://community.openvpn.net/openvpn/wiki/253-tls-error-tls-key-negotiation-failed-to-occur-within-60-seconds-check-your-network-connectivity
Thanks!
