[Solved] VPN server on Raspberry Pi

chrishoughton0

Hi

I've recently bought a new Raspberry Pi 3 and tried to do a fresh build of an OpenVPN server (I'm still a total Pi and OpenVPN newbie). I'm trying to connect via iPhone - I can establish a connection with the server without a problem, but can't open any web pages.

I've used the BBC how-to guide http://www.bbc.co.uk/news/technology-33548728 which seemed to work first time around last year on a RPi2 but now seems to be a dirty word on this forum.... :?

I've searched the forums and found several instances of similar issues but I'm struggling to adapt those solutions to fix the problem.

I've looked at this page: https://openvpn.net/index.php/open-source/documentation/howto.html#redirect but I seem to have set the config file up correctly (or so I think)...

Configs and logs as follows:

server.conf local 192.168.1.247
dev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/BaronTowersVPN.crt
key /etc/openvpn/easy-rsa/keys/BaronTowersVPN.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem

server 10.8.0.0 255.255.255.0

# your local subnet
push "route 192.168.1.0 255.255.255.0"

push "dhcp-option DNS 192.168.1.0"

push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 1 /etc/firewall-openvpn-rules.sh #!/bin/sh
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE interfaces source-directory /etc/network/interfaces.d

auto lo
iface lo inet loopback

iface eth0 inet static
address 192.168.1.247
netmask 255.255.255.0
network 192.168.1.0
broadcast 192.168.1.255
gateway 192.168.1.254
pre-up /etc/firewall-openvpn-rules.sh

allow-hotplug wlan0
iface wlan0 inet manual
wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

allow-hotplug wlan1
iface wlan1 inet manual
wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf ifconfig on server

eth0 	  Link encap:Ethernet  HWaddr ****
          inet addr:192.168.1.247  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: ***** Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:7565 errors:0 dropped:1278 overruns:0 frame:0
          TX packets:3982 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:784097 (765.7 KiB)  TX bytes:597508 (583.5 KiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:144 errors:0 dropped:0 overruns:0 frame:0
          TX packets:144 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1
          RX bytes:12072 (11.7 KiB)  TX bytes:12072 (11.7 KiB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:16 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:948 (948.0 B)  TX bytes:0 (0.0 B)

Server openvpn.log

Sun Oct 16 13:52:05 2016 OpenVPN 2.3.4 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jan 23 2016
Sun Oct 16 13:52:05 2016 library versions: OpenSSL 1.0.1t  3 May 2016, LZO 2.08
Sun Oct 16 13:52:05 2016 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Sun Oct 16 13:52:05 2016 Control Channel Authentication: using '/etc/openvpn/easy-rsa/keys/ta.key' as a OpenVPN static key file
Sun Oct 16 13:52:05 2016 TUN/TAP device tun0 opened
Sun Oct 16 13:52:05 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Oct 16 13:52:05 2016 /sbin/ip link set dev tun0 up mtu 1500
Sun Oct 16 13:52:05 2016 /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
Sun Oct 16 13:52:05 2016 GID set to nogroup
Sun Oct 16 13:52:05 2016 UID set to nobody
Sun Oct 16 13:52:05 2016 UDPv4 link local (bound): [AF_INET]192.168.1.247:1194
Sun Oct 16 13:52:05 2016 UDPv4 link remote: [undef]
Sun Oct 16 13:52:05 2016 Initialization Sequence Completed
Sun Oct 16 13:53:07 2016 xxx.xx.xxx.xx:xxxxx [ChrisiPhone] Peer Connection Initiated with [AF_INET]xxx.xx.xxx.xx:xxxxx
Sun Oct 16 13:53:07 2016 ChrisiPhone/xxx.xx.xxx.xx:xxxxx MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Sun Oct 16 13:53:07 2016 ChrisiPhone/xxx.xx.xxx.xx:xxxxx send_push_reply(): safe_cap=940
Sun Oct 16 13:54:13 2016 xxx.xx.xxx.xx:xxxxx [ChrisiPhone] Peer Connection Initiated with [AF_INET]xxx.xx.xxx.xx:xxxxx
Sun Oct 16 13:54:13 2016 ChrisiPhone/xxx.xx.xxx.xx:xxxxx MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Sun Oct 16 13:54:13 2016 ChrisiPhone/xxx.xx.xxx.xx:xxxxx send_push_reply(): safe_cap=940

Client log

2016-10-16 14:54:13 VERIFY OK: depth=0
cert. version    : 3
serial number    : 01
issuer name      : C=UK, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA, ??=EasyRSA, emailAddress=me@myhost.mydomain
subject name      : C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=BaronTowersVPN, ??=EasyRSA, emailAddress=me@myhost.mydomain
issued  on        : 2016-10-10 20:37:04
expires on        : 2026-10-08 20:37:04
signed using      : RSA with SHA-256
RSA key size      : 1024 bits
basic constraints : CA=false
subject alt name  : BaronTowersVPN
cert. type        : SSL Server
key usage        : Digital Signature, Key Encipherment
ext key usage    : TLS Web Server Authentication

2016-10-16 14:54:13 SSL Handshake: TLSv1.0/TLS-DHE-RSA-WITH-3DES-EDE-CBC-SHA
2016-10-16 14:54:13 Session is ACTIVE
2016-10-16 14:54:13 EVENT: GET_CONFIG
2016-10-16 14:54:13 Sending PUSH_REQUEST to server...
2016-10-16 14:54:13 OPTIONS:
0 [route] [192.168.1.0] [255.255.255.0]
1 [dhcp-option] [DNS] [192.168.1.0]
2 [redirect-gateway] [def1]
3 [route] [10.8.0.0] [255.255.255.0]
4 [topology] [net30]
5 [ping] [10]
6 [ping-restart] [120]
7 [ifconfig] [10.8.0.6] [10.8.0.5]

2016-10-16 14:54:13 PROTOCOL OPTIONS:
  cipher: AES-128-CBC
  digest: SHA1
  compress: LZO
  peer ID: -1
2016-10-16 14:54:13 EVENT: ASSIGN_IP
2016-10-16 14:54:13 Connected via tun
2016-10-16 14:54:13 EVENT: CONNECTED @xxxxx.dns-dns.com:1194 (xx.xxx.xx.xxx) via /UDPv4 on tun/10.8.0.6/
2016-10-16 14:54:13 LZO-ASYM init swap=0 asym=0
2016-10-16 14:54:13 SetStatus Connected

I'd appreciate a more experienced pair of eyes to try and guide me on where this is going wrong....thanks in advance

Cheers

Chris

TinCanTech

Please see this and fill in the blanks.

chrishoughton0

Hi, apologies - revised logs as follows:

Server log

Sun Oct 16 14:13:43 2016 us=272063 Current Parameter Settings:
Sun Oct 16 14:13:43 2016 us=272447   config = '/etc/openvpn/server.conf'
Sun Oct 16 14:13:43 2016 us=272521   mode = 1
Sun Oct 16 14:13:43 2016 us=272579   persist_config = DISABLED
Sun Oct 16 14:13:43 2016 us=272638   persist_mode = 1
Sun Oct 16 14:13:43 2016 us=272694   show_ciphers = DISABLED
Sun Oct 16 14:13:43 2016 us=272749   show_digests = DISABLED
Sun Oct 16 14:13:43 2016 us=272803   show_engines = DISABLED
Sun Oct 16 14:13:43 2016 us=272857   genkey = DISABLED
Sun Oct 16 14:13:43 2016 us=272912   key_pass_file = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=272967   show_tls_ciphers = DISABLED
Sun Oct 16 14:13:43 2016 us=273022 Connection profiles [default]:
Sun Oct 16 14:13:43 2016 us=273080   proto = udp
Sun Oct 16 14:13:43 2016 us=273135   local = '192.168.1.247'
Sun Oct 16 14:13:43 2016 us=273201   local_port = 1194
Sun Oct 16 14:13:43 2016 us=273260   remote = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=273316   remote_port = 1194
Sun Oct 16 14:13:43 2016 us=273370   remote_float = DISABLED
Sun Oct 16 14:13:43 2016 us=273423   bind_defined = DISABLED
Sun Oct 16 14:13:43 2016 us=273477   bind_local = ENABLED
Sun Oct 16 14:13:43 2016 us=273532   connect_retry_seconds = 5
Sun Oct 16 14:13:43 2016 us=273586   connect_timeout = 10
Sun Oct 16 14:13:43 2016 us=273641   connect_retry_max = 0
Sun Oct 16 14:13:43 2016 us=273695   socks_proxy_server = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=273750   socks_proxy_port = 0
Sun Oct 16 14:13:43 2016 us=273804   socks_proxy_retry = DISABLED
Sun Oct 16 14:13:43 2016 us=273860   tun_mtu = 1500
Sun Oct 16 14:13:43 2016 us=273913   tun_mtu_defined = ENABLED
Sun Oct 16 14:13:43 2016 us=273968   link_mtu = 1500
Sun Oct 16 14:13:43 2016 us=274021   link_mtu_defined = DISABLED
Sun Oct 16 14:13:43 2016 us=274076   tun_mtu_extra = 0
Sun Oct 16 14:13:43 2016 us=274131   tun_mtu_extra_defined = DISABLED
Sun Oct 16 14:13:43 2016 us=274186   mtu_discover_type = -1
Sun Oct 16 14:13:43 2016 us=274240   fragment = 0
Sun Oct 16 14:13:43 2016 us=274294   mssfix = 1450
Sun Oct 16 14:13:43 2016 us=274349   explicit_exit_notification = 0
Sun Oct 16 14:13:43 2016 us=274403 Connection profiles END
Sun Oct 16 14:13:43 2016 us=274457   remote_random = DISABLED
Sun Oct 16 14:13:43 2016 us=274513   ipchange = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=274567   dev = 'tun'
Sun Oct 16 14:13:43 2016 us=274621   dev_type = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=274675   dev_node = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=274729   lladdr = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=274783   topology = 1
Sun Oct 16 14:13:43 2016 us=274837   tun_ipv6 = DISABLED
Sun Oct 16 14:13:43 2016 us=274892   ifconfig_local = '10.8.0.1'
Sun Oct 16 14:13:43 2016 us=274947   ifconfig_remote_netmask = '10.8.0.2'
Sun Oct 16 14:13:43 2016 us=275002   ifconfig_noexec = DISABLED
Sun Oct 16 14:13:43 2016 us=275056   ifconfig_nowarn = DISABLED
Sun Oct 16 14:13:43 2016 us=275111   ifconfig_ipv6_local = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=275166   ifconfig_ipv6_netbits = 0
Sun Oct 16 14:13:43 2016 us=275221   ifconfig_ipv6_remote = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=275276   shaper = 0
Sun Oct 16 14:13:43 2016 us=275330   mtu_test = 0
Sun Oct 16 14:13:43 2016 us=275384   mlock = DISABLED
Sun Oct 16 14:13:43 2016 us=275438   keepalive_ping = 10
Sun Oct 16 14:13:43 2016 us=275492   keepalive_timeout = 120
Sun Oct 16 14:13:43 2016 us=275546   inactivity_timeout = 0
Sun Oct 16 14:13:43 2016 us=275600   ping_send_timeout = 10
Sun Oct 16 14:13:43 2016 us=275654   ping_rec_timeout = 240
Sun Oct 16 14:13:43 2016 us=275708   ping_rec_timeout_action = 2
Sun Oct 16 14:13:43 2016 us=275763   ping_timer_remote = DISABLED
Sun Oct 16 14:13:43 2016 us=275818   remap_sigusr1 = 0
Sun Oct 16 14:13:43 2016 us=275872   persist_tun = ENABLED
Sun Oct 16 14:13:43 2016 us=275926   persist_local_ip = DISABLED
Sun Oct 16 14:13:43 2016 us=275981   persist_remote_ip = DISABLED
Sun Oct 16 14:13:43 2016 us=276035   persist_key = ENABLED
Sun Oct 16 14:13:43 2016 us=276089   passtos = DISABLED
Sun Oct 16 14:13:43 2016 us=276144   resolve_retry_seconds = 1000000000
Sun Oct 16 14:13:43 2016 us=276232   username = 'nobody'
Sun Oct 16 14:13:43 2016 us=276289   groupname = 'nogroup'
Sun Oct 16 14:13:43 2016 us=276345   chroot_dir = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=276399   cd_dir = '/etc/openvpn'
Sun Oct 16 14:13:43 2016 us=276453   writepid = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=276507   up_script = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=276561   down_script = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=276615   down_pre = DISABLED
Sun Oct 16 14:13:43 2016 us=276669   up_restart = DISABLED
Sun Oct 16 14:13:43 2016 us=276723   up_delay = DISABLED
Sun Oct 16 14:13:43 2016 us=276777   daemon = ENABLED
Sun Oct 16 14:13:43 2016 us=276831   inetd = 0
Sun Oct 16 14:13:43 2016 us=276885   log = ENABLED
Sun Oct 16 14:13:43 2016 us=276939   suppress_timestamps = DISABLED
Sun Oct 16 14:13:43 2016 us=276994   nice = 0
Sun Oct 16 14:13:43 2016 us=277048   verbosity = 4
Sun Oct 16 14:13:43 2016 us=277102   mute = 0
Sun Oct 16 14:13:43 2016 us=277156   gremlin = 0
Sun Oct 16 14:13:43 2016 us=277210   status_file = '/var/log/openvpn-status.log'
Sun Oct 16 14:13:43 2016 us=277266   status_file_version = 1
Sun Oct 16 14:13:43 2016 us=277320   status_file_update_freq = 20
Sun Oct 16 14:13:43 2016 us=277375   occ = ENABLED
Sun Oct 16 14:13:43 2016 us=277429   rcvbuf = 65536
Sun Oct 16 14:13:43 2016 us=277483   sndbuf = 65536
Sun Oct 16 14:13:43 2016 us=277537   mark = 0
Sun Oct 16 14:13:43 2016 us=277592   sockflags = 0
Sun Oct 16 14:13:43 2016 us=277645   fast_io = DISABLED
Sun Oct 16 14:13:43 2016 us=277699   lzo = 7
Sun Oct 16 14:13:43 2016 us=277752   route_script = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=277807   route_default_gateway = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=277862   route_default_metric = 0
Sun Oct 16 14:13:43 2016 us=277916   route_noexec = DISABLED
Sun Oct 16 14:13:43 2016 us=277972   route_delay = 0
Sun Oct 16 14:13:43 2016 us=278027   route_delay_window = 30
Sun Oct 16 14:13:43 2016 us=278082   route_delay_defined = DISABLED
Sun Oct 16 14:13:43 2016 us=278231   route_nopull = DISABLED
Sun Oct 16 14:13:43 2016 us=278302   route_gateway_via_dhcp = DISABLED
Sun Oct 16 14:13:43 2016 us=278369   max_routes = 100
Sun Oct 16 14:13:43 2016 us=278433   allow_pull_fqdn = DISABLED
Sun Oct 16 14:13:43 2016 us=278495   route 10.8.0.0/255.255.255.0/nil/nil
Sun Oct 16 14:13:43 2016 us=278556   management_addr = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=278617   management_port = 0
Sun Oct 16 14:13:43 2016 us=278679   management_user_pass = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=278744   management_log_history_cache = 250
Sun Oct 16 14:13:43 2016 us=278814   management_echo_buffer_size = 100
Sun Oct 16 14:13:43 2016 us=278875   management_write_peer_info_file = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=278934   management_client_user = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=278991   management_client_group = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=279051   management_flags = 0
Sun Oct 16 14:13:43 2016 us=279115   shared_secret_file = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=279178   key_direction = 1
Sun Oct 16 14:13:43 2016 us=279242   ciphername_defined = ENABLED
Sun Oct 16 14:13:43 2016 us=279311   ciphername = 'AES-128-CBC'
Sun Oct 16 14:13:43 2016 us=279377   authname_defined = ENABLED
Sun Oct 16 14:13:43 2016 us=279442   authname = 'SHA1'
Sun Oct 16 14:13:43 2016 us=279505   prng_hash = 'SHA1'
Sun Oct 16 14:13:43 2016 us=279569   prng_nonce_secret_len = 16
Sun Oct 16 14:13:43 2016 us=279633   keysize = 0
Sun Oct 16 14:13:43 2016 us=279694   engine = DISABLED
Sun Oct 16 14:13:43 2016 us=279759   replay = ENABLED
Sun Oct 16 14:13:43 2016 us=279820   mute_replay_warnings = DISABLED
Sun Oct 16 14:13:43 2016 us=279943   replay_window = 64
Sun Oct 16 14:13:43 2016 us=280043   replay_time = 15
Sun Oct 16 14:13:43 2016 us=280107   packet_id_file = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=280173   use_iv = ENABLED
Sun Oct 16 14:13:43 2016 us=280238   test_crypto = DISABLED
Sun Oct 16 14:13:43 2016 us=280306   tls_server = ENABLED
Sun Oct 16 14:13:43 2016 us=280372   tls_client = DISABLED
Sun Oct 16 14:13:43 2016 us=280500   key_method = 2
Sun Oct 16 14:13:43 2016 us=280576   ca_file = '/etc/openvpn/easy-rsa/keys/ca.crt'
Sun Oct 16 14:13:43 2016 us=280646   ca_path = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=280713   dh_file = '/etc/openvpn/easy-rsa/keys/dh1024.pem'
Sun Oct 16 14:13:43 2016 us=280777   cert_file = '/etc/openvpn/easy-rsa/keys/BaronTowersVPN.crt'
Sun Oct 16 14:13:43 2016 us=280843   priv_key_file = '/etc/openvpn/easy-rsa/keys/BaronTowersVPN.key'
Sun Oct 16 14:13:43 2016 us=280902   pkcs12_file = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=280958   cipher_list = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=281013   tls_verify = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=281069   tls_export_cert = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=281126   verify_x509_type = 0
Sun Oct 16 14:13:43 2016 us=281183   verify_x509_name = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=281239   crl_file = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=281295   ns_cert_type = 0
Sun Oct 16 14:13:43 2016 us=281351   remote_cert_ku[i] = 0
Sun Oct 16 14:13:43 2016 us=281407   remote_cert_ku[i] = 0
Sun Oct 16 14:13:43 2016 us=281463   remote_cert_ku[i] = 0
Sun Oct 16 14:13:43 2016 us=281519   remote_cert_ku[i] = 0
Sun Oct 16 14:13:43 2016 us=281574   remote_cert_ku[i] = 0
Sun Oct 16 14:13:43 2016 us=281629   remote_cert_ku[i] = 0
Sun Oct 16 14:13:43 2016 us=281684   remote_cert_ku[i] = 0
Sun Oct 16 14:13:43 2016 us=281739   remote_cert_ku[i] = 0
Sun Oct 16 14:13:43 2016 us=281793   remote_cert_ku[i] = 0
Sun Oct 16 14:13:43 2016 us=281849   remote_cert_ku[i] = 0
Sun Oct 16 14:13:43 2016 us=281905   remote_cert_ku[i] = 0
Sun Oct 16 14:13:43 2016 us=281960   remote_cert_ku[i] = 0
Sun Oct 16 14:13:43 2016 us=282015   remote_cert_ku[i] = 0
Sun Oct 16 14:13:43 2016 us=282071   remote_cert_ku[i] = 0
Sun Oct 16 14:13:43 2016 us=282126   remote_cert_ku[i] = 0
Sun Oct 16 14:13:43 2016 us=282182   remote_cert_ku[i] = 0
Sun Oct 16 14:13:43 2016 us=282237   remote_cert_eku = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=282293   ssl_flags = 0
Sun Oct 16 14:13:43 2016 us=282348   tls_timeout = 2
Sun Oct 16 14:13:43 2016 us=282404   renegotiate_bytes = 0
Sun Oct 16 14:13:43 2016 us=282459   renegotiate_packets = 0
Sun Oct 16 14:13:43 2016 us=282514   renegotiate_seconds = 3600
Sun Oct 16 14:13:43 2016 us=282570   handshake_window = 60
Sun Oct 16 14:13:43 2016 us=282625   transition_window = 3600
Sun Oct 16 14:13:43 2016 us=282679   single_session = DISABLED
Sun Oct 16 14:13:43 2016 us=282732   push_peer_info = DISABLED
Sun Oct 16 14:13:43 2016 us=282787   tls_exit = DISABLED
Sun Oct 16 14:13:43 2016 us=282842   tls_auth_file = '/etc/openvpn/easy-rsa/keys/ta.key'
Sun Oct 16 14:13:43 2016 us=282900   pkcs11_protected_authentication = DISABLED
Sun Oct 16 14:13:43 2016 us=282956   pkcs11_protected_authentication = DISABLED
Sun Oct 16 14:13:43 2016 us=283011   pkcs11_protected_authentication = DISABLED
Sun Oct 16 14:13:43 2016 us=283067   pkcs11_protected_authentication = DISABLED
Sun Oct 16 14:13:43 2016 us=283123   pkcs11_protected_authentication = DISABLED
Sun Oct 16 14:13:43 2016 us=283179   pkcs11_protected_authentication = DISABLED
Sun Oct 16 14:13:43 2016 us=283234   pkcs11_protected_authentication = DISABLED
Sun Oct 16 14:13:43 2016 us=283290   pkcs11_protected_authentication = DISABLED
Sun Oct 16 14:13:43 2016 us=283346   pkcs11_protected_authentication = DISABLED
Sun Oct 16 14:13:43 2016 us=283401   pkcs11_protected_authentication = DISABLED
Sun Oct 16 14:13:43 2016 us=283457   pkcs11_protected_authentication = DISABLED
Sun Oct 16 14:13:43 2016 us=283514   pkcs11_protected_authentication = DISABLED
Sun Oct 16 14:13:43 2016 us=283570   pkcs11_protected_authentication = DISABLED
Sun Oct 16 14:13:43 2016 us=283626   pkcs11_protected_authentication = DISABLED
Sun Oct 16 14:13:43 2016 us=283682   pkcs11_protected_authentication = DISABLED
Sun Oct 16 14:13:43 2016 us=283737   pkcs11_protected_authentication = DISABLED
Sun Oct 16 14:13:43 2016 us=283795   pkcs11_private_mode = 00000000
Sun Oct 16 14:13:43 2016 us=283851   pkcs11_private_mode = 00000000
Sun Oct 16 14:13:43 2016 us=283908   pkcs11_private_mode = 00000000
Sun Oct 16 14:13:43 2016 us=283998   pkcs11_private_mode = 00000000
Sun Oct 16 14:13:43 2016 us=284060   pkcs11_private_mode = 00000000
Sun Oct 16 14:13:43 2016 us=284117   pkcs11_private_mode = 00000000
Sun Oct 16 14:13:43 2016 us=284176   pkcs11_private_mode = 00000000
Sun Oct 16 14:13:43 2016 us=284233   pkcs11_private_mode = 00000000
Sun Oct 16 14:13:43 2016 us=284290   pkcs11_private_mode = 00000000
Sun Oct 16 14:13:43 2016 us=284347   pkcs11_private_mode = 00000000
Sun Oct 16 14:13:43 2016 us=284404   pkcs11_private_mode = 00000000
Sun Oct 16 14:13:43 2016 us=284460   pkcs11_private_mode = 00000000
Sun Oct 16 14:13:43 2016 us=284516   pkcs11_private_mode = 00000000
Sun Oct 16 14:13:43 2016 us=284573   pkcs11_private_mode = 00000000
Sun Oct 16 14:13:43 2016 us=284629   pkcs11_private_mode = 00000000
Sun Oct 16 14:13:43 2016 us=284685   pkcs11_private_mode = 00000000
Sun Oct 16 14:13:43 2016 us=284740   pkcs11_cert_private = DISABLED
Sun Oct 16 14:13:43 2016 us=284796   pkcs11_cert_private = DISABLED
Sun Oct 16 14:13:43 2016 us=284851   pkcs11_cert_private = DISABLED
Sun Oct 16 14:13:43 2016 us=284906   pkcs11_cert_private = DISABLED
Sun Oct 16 14:13:43 2016 us=284961   pkcs11_cert_private = DISABLED
Sun Oct 16 14:13:43 2016 us=285017   pkcs11_cert_private = DISABLED
Sun Oct 16 14:13:43 2016 us=285072   pkcs11_cert_private = DISABLED
Sun Oct 16 14:13:43 2016 us=285127   pkcs11_cert_private = DISABLED
Sun Oct 16 14:13:43 2016 us=285182   pkcs11_cert_private = DISABLED
Sun Oct 16 14:13:43 2016 us=285237   pkcs11_cert_private = DISABLED
Sun Oct 16 14:13:43 2016 us=285292   pkcs11_cert_private = DISABLED
Sun Oct 16 14:13:43 2016 us=285347   pkcs11_cert_private = DISABLED
Sun Oct 16 14:13:43 2016 us=285402   pkcs11_cert_private = DISABLED
Sun Oct 16 14:13:43 2016 us=285457   pkcs11_cert_private = DISABLED
Sun Oct 16 14:13:43 2016 us=285512   pkcs11_cert_private = DISABLED
Sun Oct 16 14:13:43 2016 us=285567   pkcs11_cert_private = DISABLED
Sun Oct 16 14:13:43 2016 us=285623   pkcs11_pin_cache_period = -1
Sun Oct 16 14:13:43 2016 us=285679   pkcs11_id = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=285733   pkcs11_id_management = DISABLED
Sun Oct 16 14:13:43 2016 us=285821   server_network = 10.8.0.0
Sun Oct 16 14:13:43 2016 us=285889   server_netmask = 255.255.255.0
Sun Oct 16 14:13:43 2016 us=285954   server_network_ipv6 = ::
Sun Oct 16 14:13:43 2016 us=286011   server_netbits_ipv6 = 0
Sun Oct 16 14:13:43 2016 us=286072   server_bridge_ip = 0.0.0.0
Sun Oct 16 14:13:43 2016 us=286134   server_bridge_netmask = 0.0.0.0
Sun Oct 16 14:13:43 2016 us=286197   server_bridge_pool_start = 0.0.0.0
Sun Oct 16 14:13:43 2016 us=286269   server_bridge_pool_end = 0.0.0.0
Sun Oct 16 14:13:43 2016 us=286330   push_entry = 'route 192.168.1.0 255.255.255.0'
Sun Oct 16 14:13:43 2016 us=286388   push_entry = 'dhcp-option DNS 192.168.1.0'
Sun Oct 16 14:13:43 2016 us=286445   push_entry = 'redirect-gateway def1'
Sun Oct 16 14:13:43 2016 us=286501   push_entry = 'route 10.8.0.0 255.255.255.0'
Sun Oct 16 14:13:43 2016 us=286557   push_entry = 'topology net30'
Sun Oct 16 14:13:43 2016 us=286612   push_entry = 'ping 10'
Sun Oct 16 14:13:43 2016 us=286666   push_entry = 'ping-restart 120'
Sun Oct 16 14:13:43 2016 us=286722   ifconfig_pool_defined = ENABLED
Sun Oct 16 14:13:43 2016 us=286784   ifconfig_pool_start = 10.8.0.4
Sun Oct 16 14:13:43 2016 us=286846   ifconfig_pool_end = 10.8.0.251
Sun Oct 16 14:13:43 2016 us=286908   ifconfig_pool_netmask = 0.0.0.0
Sun Oct 16 14:13:43 2016 us=286964   ifconfig_pool_persist_filename = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=287022   ifconfig_pool_persist_refresh_freq = 600
Sun Oct 16 14:13:43 2016 us=287077   ifconfig_ipv6_pool_defined = DISABLED
Sun Oct 16 14:13:43 2016 us=287137   ifconfig_ipv6_pool_base = ::
Sun Oct 16 14:13:43 2016 us=287194   ifconfig_ipv6_pool_netbits = 0
Sun Oct 16 14:13:43 2016 us=287250   n_bcast_buf = 256
Sun Oct 16 14:13:43 2016 us=287305   tcp_queue_limit = 64
Sun Oct 16 14:13:43 2016 us=287360   real_hash_size = 256
Sun Oct 16 14:13:43 2016 us=287415   virtual_hash_size = 256
Sun Oct 16 14:13:43 2016 us=287500   client_connect_script = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=287558   learn_address_script = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=287615   client_disconnect_script = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=287671   client_config_dir = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=287726   ccd_exclusive = DISABLED
Sun Oct 16 14:13:43 2016 us=287781   tmp_dir = '/tmp'
Sun Oct 16 14:13:43 2016 us=287869   push_ifconfig_defined = DISABLED
Sun Oct 16 14:13:43 2016 us=287936   push_ifconfig_local = 0.0.0.0
Sun Oct 16 14:13:43 2016 us=288021   push_ifconfig_remote_netmask = 0.0.0.0
Sun Oct 16 14:13:43 2016 us=288080   push_ifconfig_ipv6_defined = DISABLED
Sun Oct 16 14:13:43 2016 us=288228   push_ifconfig_ipv6_local = ::/0
Sun Oct 16 14:13:43 2016 us=288295   push_ifconfig_ipv6_remote = ::
Sun Oct 16 14:13:43 2016 us=288352   enable_c2c = ENABLED
Sun Oct 16 14:13:43 2016 us=288408   duplicate_cn = ENABLED
Sun Oct 16 14:13:43 2016 us=288463   cf_max = 0
Sun Oct 16 14:13:43 2016 us=288517   cf_per = 0
Sun Oct 16 14:13:43 2016 us=288571   max_clients = 1024
Sun Oct 16 14:13:43 2016 us=288625   max_routes_per_client = 256
Sun Oct 16 14:13:43 2016 us=288680   auth_user_pass_verify_script = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=288737   auth_user_pass_verify_script_via_file = DISABLED
Sun Oct 16 14:13:43 2016 us=288794   port_share_host = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=288850   port_share_port = 0
Sun Oct 16 14:13:43 2016 us=288905   client = DISABLED
Sun Oct 16 14:13:43 2016 us=288959   pull = DISABLED
Sun Oct 16 14:13:43 2016 us=289015   auth_user_pass_file = '[UNDEF]'
Sun Oct 16 14:13:43 2016 us=289077 OpenVPN 2.3.4 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jan 23 2016
Sun Oct 16 14:13:43 2016 us=289175 library versions: OpenSSL 1.0.1t  3 May 2016, LZO 2.08
Sun Oct 16 14:13:43 2016 us=290240 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Sun Oct 16 14:13:43 2016 us=292283 Diffie-Hellman initialized with 1024 bit key
Sun Oct 16 14:13:43 2016 us=295529 Control Channel Authentication: using '/etc/openvpn/easy-rsa/keys/ta.key' as a OpenVPN static key file
Sun Oct 16 14:13:43 2016 us=295652 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Oct 16 14:13:43 2016 us=295729 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Oct 16 14:13:43 2016 us=295812 TLS-Auth MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]
Sun Oct 16 14:13:43 2016 us=295986 Socket Buffers: R=[163840->131072] S=[163840->131072]
Sun Oct 16 14:13:43 2016 us=296539 ROUTE_GATEWAY 192.168.1.254/255.255.255.0 IFACE=eth0 HWADDR=b8:27:eb:8d:cf:99
Sun Oct 16 14:13:43 2016 us=298430 TUN/TAP device tun0 opened
Sun Oct 16 14:13:43 2016 us=298633 TUN/TAP TX queue length set to 100
Sun Oct 16 14:13:43 2016 us=298762 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Oct 16 14:13:43 2016 us=298904 /sbin/ip link set dev tun0 up mtu 1500
Sun Oct 16 14:13:43 2016 us=305578 /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
Sun Oct 16 14:13:43 2016 us=313404 /sbin/ip route add 10.8.0.0/24 via 10.8.0.2
Sun Oct 16 14:13:43 2016 us=322084 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Oct 16 14:13:43 2016 us=325961 GID set to nogroup
Sun Oct 16 14:13:43 2016 us=326334 UID set to nobody
Sun Oct 16 14:13:43 2016 us=326452 UDPv4 link local (bound): [AF_INET]192.168.1.247:1194
Sun Oct 16 14:13:43 2016 us=326539 UDPv4 link remote: [undef]
Sun Oct 16 14:13:43 2016 us=326619 MULTI: multi_init called, r=256 v=256
Sun Oct 16 14:13:43 2016 us=327067 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Sun Oct 16 14:13:43 2016 us=327285 Initialization Sequence Completed
Sun Oct 16 14:25:09 2016 us=632336 MULTI: multi_create_instance called
Sun Oct 16 14:25:09 2016 us=632852 xx.xxx.xx.xxx:1024 Re-using SSL/TLS context
Sun Oct 16 14:25:09 2016 us=633164 xx.xxx.xx.xxx:1024 LZO compression initialized
Sun Oct 16 14:25:09 2016 us=634498 xx.xxx.xx.xxx:1024 Control Channel MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]
Sun Oct 16 14:25:09 2016 us=634654 xx.xxx.xx.xxx:1024 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Oct 16 14:25:09 2016 us=635151 xx.xxx.xx.xxx:1024 Local Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher AES-128-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Sun Oct 16 14:25:09 2016 us=635248 xx.xxx.xx.xxx:1024 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-128-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Sun Oct 16 14:25:09 2016 us=635446 xx.xxx.xx.xxx:1024 Local Options hash (VER=V4): 'a2e63101'
Sun Oct 16 14:25:09 2016 us=635593 xx.xxx.xx.xxx:1024 Expected Remote Options hash (VER=V4): '272f1b58'
Sun Oct 16 14:25:09 2016 us=635816 xx.xxx.xx.xxx:1024 TLS: Initial packet from [AF_INET]xx.xxx.xx.xxx:1024, sid=d5cf8614 7a049c19
Sun Oct 16 14:25:09 2016 us=904156 xx.xxx.xx.xxx:1024 VERIFY OK: depth=1, C=UK, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA, name=EasyRSA, emailAddress=me@myhost.mydomain
Sun Oct 16 14:25:09 2016 us=905544 xx.xxx.xx.xxx:1024 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=ChrisiPhone, name=EasyRSA, emailAddress=me@myhost.mydomain
Sun Oct 16 14:25:09 2016 us=952665 xx.xxx.xx.xxx:1024 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Oct 16 14:25:09 2016 us=952834 xx.xxx.xx.xxx:1024 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Oct 16 14:25:09 2016 us=952920 xx.xxx.xx.xxx:1024 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Oct 16 14:25:09 2016 us=952993 xx.xxx.xx.xxx:1024 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Oct 16 14:25:09 2016 us=971912 xx.xxx.xx.xxx:1024 Control Channel: TLSv1, cipher TLSv1/SSLv3 EDH-RSA-DES-CBC3-SHA, 1024 bit RSA
Sun Oct 16 14:25:09 2016 us=972083 xx.xxx.xx.xxx:1024 [ChrisiPhone] Peer Connection Initiated with [AF_INET]xx.xxx.xx.xxx:1024
Sun Oct 16 14:25:09 2016 us=972221 ChrisiPhone/xx.xxx.xx.xxx:1024 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Sun Oct 16 14:25:09 2016 us=972448 ChrisiPhone/xx.xxx.xx.xxx:1024 MULTI: Learn: 10.8.0.6 -> ChrisiPhone/xx.xxx.xx.xxx:1024
Sun Oct 16 14:25:09 2016 us=972527 ChrisiPhone/xx.xxx.xx.xxx:1024 MULTI: primary virtual IP for ChrisiPhone/xx.xxx.xx.xxx:1024: 10.8.0.6
Sun Oct 16 14:25:09 2016 us=972799 ChrisiPhone/xx.xxx.xx.xxx:1024 PUSH: Received control message: 'PUSH_REQUEST'
Sun Oct 16 14:25:09 2016 us=972876 ChrisiPhone/xx.xxx.xx.xxx:1024 send_push_reply(): safe_cap=940
Sun Oct 16 14:25:09 2016 us=973111 ChrisiPhone/xx.xxx.xx.xxx:1024 SENT CONTROL [ChrisiPhone]: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,dhcp-option DNS 192.168.1.0,redirect-gateway def1,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Sun Oct 16 14:25:44 2016 us=799873 ChrisiPhone/xx.xxx.xx.xxx:1024 SIGTERM[soft,remote-exit] received, client-instance exiting

Client log

2016-10-16 15:25:08 ----- OpenVPN Start -----
OpenVPN core 3.0.11 ios arm64 64-bit built on Apr 15 2016 14:13:50
2016-10-16 15:25:08 Frame=3D512/2048/512 mssfix-ctrl=3D1250
2016-10-16 15:25:08 UNUSED OPTIONS
4 [resolv-retry] [infinite]=20
5 [nobind]=20
6 [persist-key]=20
7 [persist-tun]=20
8 [mute-replay-warnings]=20
13 [verb] [4]=20
14 [mute] [20]=20

2016-10-16 15:25:08 EVENT: RESOLVE
2016-10-16 15:25:09 NET Internet:ReachableViaWiFi/-R t------
2016-10-16 15:25:09 NET WiFi:ReachableViaWiFi/-R t-----d
2016-10-16 15:25:09 Contacting xx.xxx.xx.xxx:1194 via UDP
2016-10-16 15:25:09 EVENT: WAIT
2016-10-16 15:25:09 SetTunnelSocket returned 1
2016-10-16 15:25:09 Connecting to [abc123.dns-dns.com]:1194 (xx.xxx.=
xx.xxx) via UDPv4
2016-10-16 15:25:09 EVENT: CONNECTING
2016-10-16 15:25:09 Tunnel Options:V4,dev-type tun,link-mtu 1558,tun-mtu 15=
00,proto UDPv4,comp-lzo,keydir 1,cipher AES-128-CBC,auth SHA1,keysize 128,t=
ls-auth,key-method 2,tls-client
2016-10-16 15:25:09 Peer Info:
IV_GUI_VER=3Dnet.openvpn.connect.ios 1.0.7-199
IV_VER=3D3.0.11
IV_PLAT=3Dios
IV_NCP=3D2
IV_TCPNL=3D1
IV_PROTO=3D2
IV_LZO=3D1

2016-10-16 15:25:09 VERIFY OK: depth=3D1
cert. version    : 3
serial number    : ED:40:6A:5A:EA:CF:36:55
issuer name      : C=3DUK, ST=3DCA, L=3DSanFrancisco, O=3DFort-Funston, OU=
=3DMyOrganizationalUnit, CN=3DFort-Funston CA, ??=3DEasyRSA, emailAddress=
=3Dme@myhost.mydomain
subject name      : C=3DUK, ST=3DCA, L=3DSanFrancisco, O=3DFort-Funston, OU=
=3DMyOrganizationalUnit, CN=3DFort-Funston CA, ??=3DEasyRSA, emailAddress=
=3Dme@myhost.mydomain
issued  on        : 2016-10-10 20:35:36
expires on        : 2026-10-08 20:35:36
signed using      : RSA with SHA-256
RSA key size      : 1024 bits
basic constraints : CA=3Dtrue

2016-10-16 15:25:09 VERIFY OK: depth=3D0
cert. version    : 3
serial number    : 01
issuer name      : C=3DUK, ST=3DCA, L=3DSanFrancisco, O=3DFort-Funston, OU=
=3DMyOrganizationalUnit, CN=3DFort-Funston CA, ??=3DEasyRSA, emailAddress=
=3Dme@myhost.mydomain
subject name      : C=3DUS, ST=3DCA, L=3DSanFrancisco, O=3DFort-Funston, OU=
=3DMyOrganizationalUnit, CN=3DBaronTowersVPN, ??=3DEasyRSA, emailAddress=3D=
me@myhost.mydomain
issued  on        : 2016-10-10 20:37:04
expires on        : 2026-10-08 20:37:04
signed using      : RSA with SHA-256
RSA key size      : 1024 bits
basic constraints : CA=3Dfalse
subject alt name  : BaronTowersVPN
cert. type        : SSL Server
key usage        : Digital Signature, Key Encipherment
ext key usage    : TLS Web Server Authentication

2016-10-16 15:25:10 SSL Handshake: TLSv1.0/TLS-DHE-RSA-WITH-3DES-EDE-CBC-SH=
A
2016-10-16 15:25:10 Session is ACTIVE
2016-10-16 15:25:10 EVENT: GET_CONFIG
2016-10-16 15:25:10 Sending PUSH_REQUEST to server...
2016-10-16 15:25:10 OPTIONS:
0 [route] [192.168.1.0] [255.255.255.0]=20
1 [dhcp-option] [DNS] [192.168.1.0]=20
2 [redirect-gateway] [def1]=20
3 [route] [10.8.0.0] [255.255.255.0]=20
4 [topology] [net30]=20
5 [ping] [10]=20
6 [ping-restart] [120]=20
7 [ifconfig] [10.8.0.6] [10.8.0.5]=20

2016-10-16 15:25:10 PROTOCOL OPTIONS:
  cipher: AES-128-CBC
  digest: SHA1
  compress: LZO
  peer ID: -1
2016-10-16 15:25:10 EVENT: ASSIGN_IP
2016-10-16 15:25:10 Connected via tun
2016-10-16 15:25:10 EVENT: CONNECTED @abc123.dns-dns.com:1194 (xx.xx=
x.xx.xxx) via /UDPv4 on tun/10.8.0.6/
2016-10-16 15:25:10 LZO-ASYM init swap=3D0 asym=3D0
2016-10-16 15:25:10 SetStatus Connected

TinCanTech

Two things

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

:arrow: Never use 192.168.0.0/24 or 192.168.1.0/24 for your OpenVPN Server LAN :!:
(or other common subnets)
- You are advised to change your server LAN to a more unique RFC1918 compliant subnet.
  f.e 192.168.143.0/24
Also, ensure IP forwarding is enabled on your server.

chrishoughton0

Thanks for the quick reply.

Can I change the server LAN without changing my router settings?

chrishoughton0

Also given I'm connecting over mobile broadband (via my phone's 4G signal) this shouldn't affect the ability to view web pages should it?

TinCanTech

Can you ping 8.8.8.8 (google DNS) over the VPN ?

chrishoughton0

Yes, when I'm connected to the VPN (using Network Ping Lite app on the iPhone).

Trying to load a webpage in Chrome just times out

TinCanTech

You must --push a valid DNS server.

chrishoughton0

Sorry to be dumb, but is this in the server config? So this should be:
--push "route 192.168.1.0 255.255.255.0"
--push "dhcp-option DNS 192.168.1.0"
--push "redirect-gateway def1"

TinCanTech

I refer you to my last comment ..

chrishoughton0

Hi

What constitutes a valid DNS server? Is this my VPN server?

I've tried changing:

push "dhcp-option DNS 192.168.1.0"

--push "dhcp-option DNS 192.168.1.247"

but I'm still not able to browse web pages.

Sorry if this is something obvious but I don't have any experience with the technical aspects of this...

Cheers

Chris

TinCanTech

Try using google public DNS ..

chrishoughton0

Perfect, all working fine now - thanks for your help (and patience)!

For my own curiosity, what does the dhcp-option code actually force the VPN to do?

TinCanTech

See --dhcp-option in The Manual