Scooby138
I am attempting to connect an iPhone (VPN subnet) to a Raspberry Pi 2 (LAN subnet), with the VPN server being provided by OpenVPN on Home Tomato. The basic VPN set up seems fine, as the iPhone picks up the Home WAN IP (e.g., Comcast, instead of cell carrier) and surfs fine. Because iPhone, this is on TUN with the iPhone being on one subnet of 10.8.0.0/24 (Tomato default BTW) and Home Tomato LAN on another subnet, such as typical 192.168.x.x subnet. Tomato has typical settings, including to Push LAN to (VPN) clients.
The iPhone can ping several hosts on the Home LAN subnet, typically IoT things and iOS (iPad) things (and also Obi100 ATA, which IS Linux based). The iPad, for its part, can ping back to the iPhone. However, the iPhone cannot ping an RPi device on Home LAN and that connectivity I need to fix. (There are also a couple of other non-reachable LAN Kodi RPi's but I don't care about them.)
In the RPi, I have set an upstream iptables LOG rule to monitor incoming packets from the iPhone. Kern.log shows the iPhone packets are definitely getting to the RPi. And I've made sure the VPN subnet ip is ACCEPTed in the RPi, and I have a subsequent LOG entry to log any denied (i.e., non-ACCEPTed packets from the VPN subnet), and it appears everything from the iPhone is accepted.
So I have some sort of routing issue, trying to get back from RPi to iPhone. The VPN subnet is unreachable, notwithstanding the Router bridging and the fact that I explicitly set the RPi's forward flag: net.ipv4.ip_forward=1 in /etc/sysctl.conf (and then rebooted).
Since none of that worked, I added an explicit FORWARD rule (in iptables script pre-existing in RPi) -I FORWARD -j ACCEPT
Still, no joy.
In passing, I note that the Tomato router's routing table does appear to correctly bridge the VPN subnet to Home LAN subnet. And I would expect as much, given the Push LAN to VPN clients setting, as well as the fact that the iPhone can connect to several (dumber) LAN hosts.
Ok I give up. How does one connect an iPhone to an RPi using OpenVPN (TUN) server running on Tomato router?
Scooby138
Supplementing above, i see on all my Pi's that in the Routing table, Destination of "default" is set to Gateway of "unknown". In contrast, my non-Pi Linux Desktop has proper default pointing to my Gateway (Router IP), and that machine CAN ping across subnets to the iPhone. So at this point, this seems to be Pi specific routing problem with setting the Gateway on the default destination, and not so much OpenVPN. Nevertheless, anyone VPNing into Pi via TUN (i.e., involving another subnet), be advised that Pi's routing table is such that packets cannot find their back to the other (VPN) subnet -- the Pi's routing table has the default Destination set to unknown Gateway.
I will scurry over to RPi Forum to sort out.
