Openvpn is install on my Linux desktop. I can connect using openvpn-gui on my laptop (windows 10, in another network, away from home). It connects, and the ip shows my home server ip. Great, but my iphone still shows the orginal ip address. Here are my my config files: server.conf: [code] port 1194 proto udp dev tun ca ca.crt cert server.crt key server.key dh dh2048.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 208.67.222.222" push "dhcp-option DNS 208.67.220.220" keepalive 10 120 cipher AES-128-CBC # AES comp-lzo user nobody group nogroup persist-key persist-tun status openvpn-status.log verb 3 [/code] iphone client config [code] client dev tun proto udp remote mydns.server.net 1194 --float resolv-retry infinite nobind user nobody group nogroup persist-key persist-tun ;ca ca.crt ;cert client.crt ;key client.key remote-cert-tls server cipher AES-128-CBC comp-lzo verb 3 -----BEGIN CERTIFICATE----- -----END CERTIFICATE----- Certificate: -----END CERTIFICATE----- -----BEGIN PRIVATE KEY----- -----END PRIVATE KEY----- [/code] The config file for my laptop is the same except for different certs. I have searched this forum, and most replies says to use [code]push "redirect-gateway def1" [/code] but my config used [code]push "redirect-gateway def1 bypass-dhcp"[/code] Your help is much appreciated.

[quote="kitshum8"]my config used[code]push "redirect-gateway def1 bypass-dhcp[/code]"[/quote]For testing only use: [code]push "redirect-gateway def1[/code]and remove the [b]bypass-dhcp[/b] option. FYI: According to your logs, IPv4 has redirected your gateway, so your IPv4 address should be seen as your server IP.

Openvpn connects, but IOS client does not change ip address

kitshum8

Openvpn is install on my Linux desktop. I can connect using openvpn-gui on my laptop (windows 10, in another network, away from home). It connects, and the ip shows my home server ip. Great, but my iphone still shows the orginal ip address. Here are my my config files:
server.conf:

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key  
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
cipher AES-128-CBC   # AES
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3

iphone client config

client
dev tun
proto udp

remote mydns.server.net 1194
--float
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
;ca ca.crt
;cert client.crt
;key client.key
remote-cert-tls server
cipher AES-128-CBC
comp-lzo
verb 3
<ca>
-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----
</ca>
<cert>
Certificate:
 
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----

-----END PRIVATE KEY-----
</key>

The config file for my laptop is the same except for different certs.
I have searched this forum, and most replies says to use

push "redirect-gateway def1"

but my config used

push "redirect-gateway def1 bypass-dhcp"

Your help is much appreciated.

TinCanTech

Did you create different cert/keys for each of your clients ?

kitshum8

Yes, all cert/keys are different for the clients.

TinCanTech

Please post logs of your client connecting (server & client logs)

kitshum8

I was at a library and tried to connect to my debian server at home using my iphone client. Here are the logs:
Server log:

Sep 22 15:52:16 debian ovpn-server[2338]: 205.189.187.4:13405 TLS: Initial packet from [AF_INET]205.189.187.4:13405, sid=702b2e4d 044bdadc
Sep 22 15:52:16 debian ovpn-server[2338]: 205.189.187.4:13405 VERIFY OK: depth=1, C=CA, ST=ON, L=Toronto, O=Openvpn-debian, OU=debian, CN=debian, name=server, emailAddress=my_email@yahoo.ca
Sep 22 15:52:16 debian ovpn-server[2338]: 205.189.187.4:13405 VERIFY OK: depth=0, C=CA, ST=ON, L=Toronto, O=Openvpn-debian, OU=debian, CN=iphone, name=server, emailAddress=my_email@yahoo.ca
Sep 22 15:52:16 debian ovpn-server[2338]: 205.189.187.4:13405 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sep 22 15:52:16 debian ovpn-server[2338]: 205.189.187.4:13405 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sep 22 15:52:16 debian ovpn-server[2338]: 205.189.187.4:13405 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sep 22 15:52:16 debian ovpn-server[2338]: 205.189.187.4:13405 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sep 22 15:52:16 debian ovpn-server[2338]: 205.189.187.4:13405 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Sep 22 15:52:16 debian ovpn-server[2338]: 205.189.187.4:13405 [iphone] Peer Connection Initiated with [AF_INET]205.189.187.4:13405
Sep 22 15:52:16 debian ovpn-server[2338]: iphone/205.189.187.4:13405 MULTI_sva: pool returned IPv4=10.8.0.10, IPv6=(Not enabled)
Sep 22 15:52:16 debian ovpn-server[2338]: iphone/205.189.187.4:13405 MULTI: Learn: 10.8.0.10 -> iphone/205.189.187.4:13405
Sep 22 15:52:16 debian ovpn-server[2338]: iphone/205.189.187.4:13405 MULTI: primary virtual IP for iphone/205.189.187.4:13405: 10.8.0.10
Sep 22 15:52:16 debian ovpn-server[2338]: iphone/205.189.187.4:13405 PUSH: Received control message: 'PUSH_REQUEST'
Sep 22 15:52:16 debian ovpn-server[2338]: iphone/205.189.187.4:13405 send_push_reply(): safe_cap=940
Sep 22 15:52:16 debian ovpn-server[2338]: iphone/205.189.187.4:13405 SENT CONTROL [iphone]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.10 10.8.0.9' (status=1)

****************[here I walked out of the library]
Sep 22 15:52:35 debian ovpn-server[2338]: iphone/205.189.187.4:13405 SIGTERM[soft,remote-exit] received, client-instance exiting

iphone log:

2016-09-22 15:52:14 ----- OpenVPN Start -----
OpenVPN core 3.0.11 ios arm64 64-bit built on Apr 15 2016 14:13:50
2016-09-22 15:52:14 Frame=512/2048/512 mssfix-ctrl=1250
2016-09-22 15:52:14 UNUSED OPTIONS
4 [--float] 
5 [resolv-retry] [infinite] 
6 [nobind] 
7 [user] [nobody] 
8 [group] [nogroup] 
9 [persist-key] 
10 [persist-tun] 
14 [verb] [3] 

2016-09-22 15:52:14 EVENT: RESOLVE
2016-09-22 15:52:14 Contacting [my_ipv6_address]:1194 via UDP
2016-09-22 15:52:14 EVENT: WAIT
2016-09-22 15:52:14 SetTunnelSocket returned 1
2016-09-22 15:52:14 Transport Error: UDP connect error on 'my_dns_server:1194' ([my_ipv6_address]:1194): No route to host
2016-09-22 15:52:14 Client terminated, restarting in 2...
2016-09-22 15:52:16 EVENT: RECONNECTING
2016-09-22 15:52:16 Contacting my_ipv4_address:1194 via UDP
2016-09-22 15:52:16 EVENT: WAIT
2016-09-22 15:52:16 SetTunnelSocket returned 1
2016-09-22 15:52:16 Connecting to [my_dns_server]:1194 (my_ipv4_address) via UDPv4
2016-09-22 15:52:16 EVENT: CONNECTING
2016-09-22 15:52:16 Tunnel Options:V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-client
2016-09-22 15:52:16 Peer Info:
IV_GUI_VER=net.openvpn.connect.ios 1.0.7-199
IV_VER=3.0.11
IV_PLAT=ios
IV_NCP=2
IV_TCPNL=1
IV_PROTO=2
IV_LZO=1

2016-09-22 15:52:16 VERIFY OK: depth=0
cert. version    : 3
serial number    : 02
issuer name      : C=CA, ST=ON, L=Toronto, O=Openvpn-debian, OU=debian, CN=debian, ??=server, emailAddress=my_email@yahoo.com
subject name      : C=CA, ST=ON, L=Toronto, O=Openvpn-debian, OU=debian, CN=debian, ??=server, emailAddress=my_email@yahoo.com
issued  on        : 2016-08-31 19:51:32
expires on        : 2026-08-29 19:51:32
signed using      : RSA with SHA-256
RSA key size      : 2048 bits
basic constraints : CA=false
subject alt name  : server
cert. type        : SSL Server
key usage        : Digital Signature, Key Encipherment
ext key usage    : TLS Web Server Authentication

2016-09-22 15:52:16 SSL Handshake: TLSv1.2/TLS-DHE-RSA-WITH-AES-256-GCM-SHA384
2016-09-22 15:52:16 Session is ACTIVE
2016-09-22 15:52:16 EVENT: GET_CONFIG
2016-09-22 15:52:16 Sending PUSH_REQUEST to server...
2016-09-22 15:52:16 OPTIONS:
0 [redirect-gateway] [def1] [bypass-dhcp] 
1 [dhcp-option] [DNS] [208.67.222.222] 
2 [dhcp-option] [DNS] [208.67.220.220] 
3 [route] [10.8.0.1] 
4 [topology] [net30] 
5 [ping] [10] 
6 [ping-restart] [120] 
7 [ifconfig] [10.8.0.10] [10.8.0.9] 

2016-09-22 15:52:16 PROTOCOL OPTIONS:
  cipher: AES-128-CBC
  digest: SHA1
  compress: LZO
  peer ID: -1
2016-09-22 15:52:16 EVENT: ASSIGN_IP
2016-09-22 15:52:16 TunPersist: saving tun context:
Session Name: my_dns_server
Layer: OSI_LAYER_3
Remote Address: my_ipv4_address
Tunnel Addresses:
  10.8.0.10/30 -> 10.8.0.9 [net30]
Reroute Gateway: IPv4=1 IPv6=0 flags=[ ENABLE REROUTE_GW DEF1 BYPASS_DHCP IPv4 ]
Block IPv6: no
Add Routes:
Exclude Routes:
  my_ipv6_address [IPv6]
DNS Servers:
  208.67.222.222
  208.67.220.220
Search Domains:

2016-09-22 15:52:16 Connected via tun
2016-09-22 15:52:16 EVENT: CONNECTED @my_dns_server:1194 (My_ipv4_address) via /UDPv4 on tun/10.8.0.10/
2016-09-22 15:52:16 LZO-ASYM init swap=0 asym=0
2016-09-22 15:52:17 SetStatus Connected

*************[after the connection, I walked out of the library where I used the wifi}
2016-09-22 15:52:35 OS Event: SLEEP
2016-09-22 15:52:35 EVENT: PAUSE

TinCanTech

kitshum8 wrotemy config used

push "redirect-gateway def1 bypass-dhcp

For testing only use:

push "redirect-gateway def1

and remove the bypass-dhcp option.

FYI: According to your logs, IPv4 has redirected your gateway, so your IPv4 address should be seen as your server IP.

kitshum8

Thanks. I'll give it a spin.