[Solved] OpenVPN connects with local access but no internet.

rez

OpenVPN in Raspberry Pi 3 (Raspbian OS). With PiVPN Script in Ethernet.

I had VPN access to the internet for a long time, but since recently i can only connect to the server & get local access but no longer connect to the internet.

I installed and configured the server using PiVPN script using all the default options. (http://www.pivpn.io)

I tried complete uninstall, then reboot, then reinstall. But the problem remains.

My VPN worked flawlessly. Until recently.

Can anyone please explain whats going on? And how to fix it?

Thank You..

rez

This is my server config:

dev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/pki/ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/server.crt
key /etc/openvpn/easy-rsa/pki/private/server.key
dh /etc/openvpn/easy-rsa/pki/dh2048.pem
topology subnet
server 10.8.0.0 255.255.255.0
# server and remote endpoints
ifconfig 10.8.0.1 10.8.0.2
# Add route to Client routing table for the OpenVPN Server
push "route 10.8.0.1 255.255.255.255"
# Add route to Client routing table for the OPenVPN Subnet
push "route 10.8.0.0 255.255.255.0"
# your local subnet
push "route 192.168.1.0 255.255.255.0"
# Set your primary domain name server address for clients
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-version-min 1.2
tls-auth /etc/openvpn/easy-rsa/pki/ta.key 0
cipher AES-256-CBC
auth SHA256
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
#crl-verify /etc/openvpn/crl.pem
status /var/log/openvpn-status.log 20
status-version 3
log /var/log/openvpn.log
verb 1
# Generated for use by PiVPN.io

rez

Ok i found the solution.

it has to do with iptables. I dont know why it didn't face any problems before, maybe an auto update caused the iptables to be more strict or something..

anyways i hate to run this command

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

in root...

but the problem with this is, its not permanent. meaning a reboot will revert back to the problem..

so right now im looking for a way to set that command permanently in every reboot..let me know if you guys know how to do this...

thanks again...

wildcat2083

try installing iptables-persistent

then add the lines to /etc/iptables/rules.v4 without the starting iptables command
check out linode/docs/vpn (google search linode vpn) their are some references to that config file im refering to and how to set it up, it will save your iptables across reboots

wildcat2083

rules.v4
*filter

-t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
COMMIT

then you enter
iptables-apply < /etc/iptables/rules.v4

it basically saves the tables in the file snd re-applies them on every reboot