I imported the conf files from my Windows PC (where OpenVPN (GUI) works). The only chnage I had to make was uncommenting the "fragment"-line. On android (And 5.1.1, sMIUI) the VPN connection can be established (and I get an IP assigned) BUT neither from the borwser nor from the termux app I can ping/access any site neither by hostname nor ip. My conf is as follows: --------------- client dev tun resolv-retry infinite nobind hand-window 10 remote 443 tcp persist-key persist-tun ... ... ... tls-remote key-direction 1 ... cipher BF-CBC verb 3 tun-mtu 1400 ;fragment 1300 mssfix no-replay redirect-gateway def1 ------------- I also tried the settings from my Mac (OSX), which are as follows: ------------------ remote 1194 udp pull tls-client persist-key ;fragment 1300 redirect-gateway def1 nobind persist-tun comp-lzo dev tun tun-mtu 1400 hand-window 10 resolv-retry infinite mssfix no-replay cipher BF-CBC ... ... ... tls-remote key-direction 1 ... ----------------- Any help/advice appreciated -Clemens

[quote]It looks like you have not redirected your gateway.[/quote]sorry for asking, but what exactly does that mean? Where/how would I have to do that?

[url=http://openvpn.net/index.php/open-source/documentation/howto.html#redirect]HOWTO: Routing all client traffic (including web-traffic) through the VPN[/url]

Thanks for the link that I have read before ;) I do have [code]redirect-gateway def1[/code]

Connected, but can't access any server/site

fx3000se

I imported the conf files from my Windows PC (where OpenVPN (GUI) works). The only chnage I had to make was uncommenting the "fragment"-line.
On android (And 5.1.1, sMIUI) the VPN connection can be established (and I get an IP assigned) BUT neither from the borwser nor from the termux app I can ping/access any site neither by hostname nor ip.

My conf is as follows:
---------------
client
dev tun
resolv-retry infinite
nobind
hand-window 10

<connection>
remote <ip of openvpn server> 443 tcp
</connection>

persist-key
persist-tun

<ca>
...
</ca>

<cert>
...
</cert>

<key>
...
</key>

tls-remote <gw host name>

key-direction 1
<tls-auth>
...
</tls-auth>

cipher BF-CBC

verb 3

tun-mtu 1400
;fragment 1300
mssfix
no-replay

redirect-gateway def1
-------------
I also tried the settings from my Mac (OSX), which are as follows:
------------------
remote <ip of vpn server> 1194 udp
pull
tls-client

persist-key
;fragment 1300

redirect-gateway def1
nobind
persist-tun
comp-lzo
dev tun
tun-mtu 1400
hand-window 10
resolv-retry infinite
mssfix
no-replay
cipher BF-CBC

<ca>
...
</ca>

<cert>
...
</cert>

<key>
...
</key>

tls-remote <gw hostname>

key-direction 1
<tls-auth>
...
</tls-auth>
-----------------

Any help/advice appreciated
-Clemens

TinCanTech

What about your server config and log files ?

fx3000se

Thanks for the fast reply.
I can't access these easily...at least not on the weekend.
Again "OpenVPN Android" does connect. Also I have no problems with the OpenVPN connection from Windows (using OpenVPN GUI), nor from my Mac (using Viscoyity)

fx3000se

Kernel IP routing table

$ route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.198.6.92     *               255.255.255.252 U     0      0        0 rmnet_data0
192.168.15.152  *               255.255.255.252 U     0      0        0 tun0

192.168.15.152 being the IP I get assigend from the VPN server

TinCanTech

fx3000se wrotethe VPN connection can be established (and I get an IP assigned) BUT neither from the borwser nor from the termux app I can ping/access any site neither by hostname nor ip.

It looks like you have not redirected your gateway.

fx3000se

It looks like you have not redirected your gateway.

sorry for asking, but what exactly does that mean?
Where/how would I have to do that?

TinCanTech

HOWTO: Routing all client traffic (including web-traffic) through the VPN

fx3000se

Thanks for the link that I have read before 😉
I do have

redirect-gateway def1

TinCanTech

Yes but:

fx3000se wroteKernel IP routing table

$ route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.198.6.92     *               255.255.255.252 U     0      0        0 rmnet_data0
192.168.15.152  *               255.255.255.252 U     0      0        0 tun0

192.168.15.152 being the IP I get assigend from the VPN server

this suggests it is not working properly.

I suggest you post your client log.

fx3000se

where/how can I access the client log?

fx3000se

found the "Log" menu option. I am seeing

...
... -- TUN write error: write_some: Invalid argument
... -- Session invalidated: KEEPALIVE_TIMEOUT
... -- Client terminated, restaring in 2...
...

TinCanTech

You need to check your complete server log.

fx3000se

Unfortunately I had no chance to contact IT yet.

Nevertheless I'd like to ask whether certain UserAgents(e.g. mobiles) can be "filtered" serverside? But why then would it (let) connect at all?

Also (me not being netwrok-specialist):
what is "wrong" with my route output. How should it look?

Thanks