GandhiLives
Hi,
I would like to VPN in to my raspberry pi and access my network, connect to my Raspberry Pi via SSH and generally fully browse around my local network (including an apache server hosted there), and also have my Raspberry pi connected to the internet via a VPN, so that anything it does online cannot be seen.
I have so far manged to set up a server.conf file (I used PiVPN to do this) and a client.conf file (I am using PIA and this is supplied by them) and it is all working OK, but only one at a time (either the server OR the client can be connected succesfully at any one time). As soon as I successfully connect the openvpn program as client I am unable to connect to the server from outside my home. I am still able to browse the apache webserver internally to my network when either the client or the server are connected.
I understand there is a lot of configuration that I probably need to do, to make this work, but I'm at a bit of a loss as to what. I am about to go and look for a beginners guide to routing tables etc in the mean time, but so far it's all seemed pretty complicated to me!
If anyone is able to help me I would be most grateful. As a start, I have included my config files for both my client and my server.
dev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
server 10.8.0.0 255.255.255.0
# server and remote endpoints
ifconfig 10.8.0.1 10.8.0.2
# Add route to Client routing table for the OpenVPN Server
push "route 10.8.0.1 255.255.255.255"
# Add route to Client routing table for the OPenVPN Subnet
push "route 10.8.0.0 255.255.255.0"
# your local subnet
push "route 192.168.1.0 255.255.255.0"
# Set your primary domain name server address for clients
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-version-min 1.2
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-256-CBC
auth SHA256
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
crl-verify /etc/openvpn/crl.pem
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 1
client
dev tun
proto udp
remote uk-southampton.privateinternetaccess.com 1198
resolv-retry infinite
nobind
persist-key
persist-tun
cipher aes-128-cbc
auth sha1
auth-user-pass login.conf
tls-client
remote-cert-tls server
auth-user-pass
comp-lzo
verb 1
reneg-sec 0
crl-verify crl.rsa.2048.pem
ca ca.rsa.2048.crt
disable-occ
TinCanTech
The problem you have is that as you do to your own client --redirect-gateway def1, PIA do to your server.
The easiest way to achieve your goal is to use Linux Policy Based Routing on your Pi server.
Search for: openvpn policy based routing ..
