OpenVPN connection from Linux client not working

BobAGI

I have an OpenVPN server at my home LAN (Ubuntu Server 16.04-3 LTS).
I can connect fine from my Windows and Apple clients and also from my phone and tablet while away from home.
But for the life of me I cannot find out how I can get a working connection from a Raspbian box (RPi3B)...
This RPi3B box runs an openvpn server (2.3.4) itself, which I use to connect remotely to the summer home where it resides.
This Pi is also a development machine and has subversion client installed.

Now being at the summer home I need to connect to my home server from this RPi3 box so I can get some stuff from my svn server back home.
I have tried the following:

-Open a command prompt on the desktop
-Run "sudo openvpn --config /home/pi/myhomeprofile.ovpn"
-Prompted for the password of the key in the ovpn file
-After entering pwd the connection sequence completes
-The command window now is stuck within openvpn
-Open the Chromium browser to check that I am correctly connected

But no matter what address I use on Chromium it times out unable to make any connection whatsoever!
While it is trying I can return to the command window and exit openvpn using Ctrl-C and at this moment the Chromium browser gets a connection to the target address!
Same if I open a new command window and try to ping anywhere...

So it seems like the openvpn client connection somehow totally blocks any access to the Internet or remote LAN....

Is it not possible to connect OpenVPN as client from a Linux machine if that machine also is an OpenVPN server (but has no client connected)?
If it should be possible, how would it be done?

The only thing I can think of now is that IPTABLES is somehow involved, but I don't understand how...
Here is the output of iptables-save on this box.:

 sudo iptables-save
# Generated by iptables-save v1.4.21 on Thu Jul 26 08:15:51 2018
*filter
:INPUT ACCEPT [23573:3931183]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1240:100508]
COMMIT
# Completed on Thu Jul 26 08:15:51 2018
# Generated by iptables-save v1.4.21 on Thu Jul 26 08:15:51 2018
*nat
:PREROUTING ACCEPT [4090:1035689]
:INPUT ACCEPT [562:141385]
:OUTPUT ACCEPT [381:25894]
:POSTROUTING ACCEPT [381:25894]
-A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE
COMMIT
# Completed on Thu Jul 26 08:15:51 2018

Is something missing here?

TinCanTech

I am sure you will have seen this before ...

HOWTO: Request Help ! {2}

BobAGI

OK, I can provide most of this, but before I do:
Where on Linux is the openvpn client log stored? I do not even know what it is named let alone in which dir it is deposited if anywhere.
I have checked:
/var/log/ (only contains logs related to the server function and which are too old)
/etc/openvpn/ (no sign of any logs at all)
/home/pi/ (same here, no sign of any logs)
Since I run
sudo openvpn --config MyConnection.ovpn
the logs might wind up in a root related place, but where? No /home/root/ dir exists...

Additionally the server seems irrelevant here since it works just fine for connections from all other client operating systems I have tested using the same ovpn file.
And it should also not be an ovpn related problem for the same reason.

But I will provide all of the requested data as soon as I have found the client log...

TinCanTech

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

BobAGI

OK, here goes Client configuration and log etc.
If server is also needed I must do a more extensive operation to get at the server.:
client
dev tun
proto udp
remote yyyyy.xxxxxxxx.com 1191
resolv-retry infinite
nobind
persist-key
persist-tun
auth-nocache
mute-replay-warnings
remote-cert-tls server
key-direction 1
cipher AES-256-CBC
comp-lzo
log-append /etc/openvpn/log/client.log #Added to define a client log
verb 4
mute 20

Client log:

Fri Jul 27 18:12:38 2018 us=731667 Current Parameter Settings:
Fri Jul 27 18:12:38 2018 us=732212   config = 'MyClient.ovpn'
Fri Jul 27 18:12:38 2018 us=732278   mode = 0
Fri Jul 27 18:12:38 2018 us=732338   persist_config = DISABLED
Fri Jul 27 18:12:38 2018 us=732396   persist_mode = 1
Fri Jul 27 18:12:38 2018 us=732454   show_ciphers = DISABLED
Fri Jul 27 18:12:38 2018 us=732511   show_digests = DISABLED
Fri Jul 27 18:12:38 2018 us=732568   show_engines = DISABLED
Fri Jul 27 18:12:38 2018 us=732624   genkey = DISABLED
Fri Jul 27 18:12:38 2018 us=732681   key_pass_file = '[UNDEF]'
Fri Jul 27 18:12:38 2018 us=732738   show_tls_ciphers = DISABLED
Fri Jul 27 18:12:38 2018 us=732796 Connection profiles [default]:
Fri Jul 27 18:12:38 2018 us=732858   proto = udp
Fri Jul 27 18:12:38 2018 us=732916   local = '[UNDEF]'
Fri Jul 27 18:12:38 2018 us=732973   local_port = 0
Fri Jul 27 18:12:38 2018 us=733030   remote = 'home.boberglund.com'
Fri Jul 27 18:12:38 2018 us=733087   remote_port = 1191
Fri Jul 27 18:12:38 2018 us=733146   remote_float = DISABLED
Fri Jul 27 18:12:38 2018 us=733202   bind_defined = DISABLED
Fri Jul 27 18:12:38 2018 us=733259   bind_local = DISABLED
Fri Jul 27 18:12:38 2018 us=733315 NOTE: --mute triggered...
Fri Jul 27 18:12:38 2018 us=733415 255 variation(s) on previous 20 message(s) suppressed by --mute
Fri Jul 27 18:12:38 2018 us=733475 OpenVPN 2.3.4 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jun 27 2017
Fri Jul 27 18:12:38 2018 us=733562 library versions: OpenSSL 1.0.1t  3 May 2016, LZO 2.08
Fri Jul 27 18:12:44 2018 us=273115 Control Channel Authentication: tls-auth using INLINE static key file
Fri Jul 27 18:12:44 2018 us=273356 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jul 27 18:12:44 2018 us=273434 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jul 27 18:12:44 2018 us=273565 LZO compression initialized
Fri Jul 27 18:12:44 2018 us=273940 Control Channel MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]
Fri Jul 27 18:12:44 2018 us=274123 Socket Buffers: R=[163840->131072] S=[163840->131072]
Fri Jul 27 18:12:44 2018 us=347090 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Fri Jul 27 18:12:44 2018 us=347340 Local Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Fri Jul 27 18:12:44 2018 us=347403 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Fri Jul 27 18:12:44 2018 us=347529 Local Options hash (VER=V4): '9e7066d2'
Fri Jul 27 18:12:44 2018 us=347630 Expected Remote Options hash (VER=V4): '162b04de'
Fri Jul 27 18:12:44 2018 us=347703 UDPv4 link local: [undef]
Fri Jul 27 18:12:44 2018 us=347786 UDPv4 link remote: [AF_INET]81.xxx.xxx.209:1191
Fri Jul 27 18:12:44 2018 us=378287 TLS: Initial packet from [AF_INET]81.170.140.209:1191, sid=111cca92 154adb8d
Fri Jul 27 18:12:44 2018 us=433277 VERIFY OK: depth=1, C=SE, ST=Stockholm, L=Stockholm, O=Private, OU=Dev, CN=MyClient, name=server, emailAddress=xxxxxxxx.com
Fri Jul 27 18:12:44 2018 us=436286 Validating certificate key usage
Fri Jul 27 18:12:44 2018 us=436366 ++ Certificate has key usage  00a0, expects 00a0
Fri Jul 27 18:12:44 2018 us=436424 VERIFY KU OK
Fri Jul 27 18:12:44 2018 us=436504 Validating certificate extended key usage
Fri Jul 27 18:12:44 2018 us=436573 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Fri Jul 27 18:12:44 2018 us=436631 VERIFY EKU OK
Fri Jul 27 18:12:44 2018 us=436685 VERIFY OK: depth=0, C=SE, ST=--, L=Stockholm, O=Private, OU=Dev, CN=MyClient, name=server, emailAddress=xxxxxxxx.com
Fri Jul 27 18:12:44 2018 us=908695 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jul 27 18:12:44 2018 us=908826 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jul 27 18:12:44 2018 us=908906 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jul 27 18:12:44 2018 us=908944 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jul 27 18:12:44 2018 us=909047 Control Channel: TLSv1, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-SHA, 2048 bit RSA
Fri Jul 27 18:12:44 2018 us=909121 [MyClient] Peer Connection Initiated with [AF_INET]81.xxx.xxx.209:1191
Fri Jul 27 18:12:47 2018 us=353878 SENT CONTROL [MyClient]: 'PUSH_REQUEST' (status=1)
Fri Jul 27 18:12:47 2018 us=388790 PUSH: Received control message: 'PUSH_REPLY,route 192.168.119.0 255.255.255.0,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,explicit-exit-notify 1,sndbuf 262144,rcvbuf 262144,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0'
Fri Jul 27 18:12:47 2018 us=389250 OPTIONS IMPORT: timers and/or timeouts modified
Fri Jul 27 18:12:47 2018 us=389318 OPTIONS IMPORT: explicit notify parm(s) modified
Fri Jul 27 18:12:47 2018 us=389377 OPTIONS IMPORT: --sndbuf/--rcvbuf options modified
Fri Jul 27 18:12:47 2018 us=389454 Socket Buffers: R=[131072->327680] S=[131072->327680]
Fri Jul 27 18:12:47 2018 us=389509 OPTIONS IMPORT: --ifconfig/up options modified
Fri Jul 27 18:12:47 2018 us=389562 OPTIONS IMPORT: route options modified
Fri Jul 27 18:12:47 2018 us=389615 OPTIONS IMPORT: route-related options modified
Fri Jul 27 18:12:47 2018 us=389667 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Fri Jul 27 18:12:47 2018 us=390402 ROUTE_GATEWAY 192.168.117.1/255.255.255.0 IFACE=eth0 HWADDR=b8:27:eb:22:0c:43
Fri Jul 27 18:12:47 2018 us=391994 TUN/TAP device tun1 opened
Fri Jul 27 18:12:47 2018 us=392155 TUN/TAP TX queue length set to 100
Fri Jul 27 18:12:47 2018 us=392271 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Jul 27 18:12:47 2018 us=392432 /sbin/ip link set dev tun1 up mtu 1500
Fri Jul 27 18:12:47 2018 us=401723 /sbin/ip addr add dev tun1 10.8.0.2/24 broadcast 10.8.0.255
Fri Jul 27 18:12:47 2018 us=415071 /sbin/ip route add 81.xxx.xxx.209/32 via 192.168.117.1
Fri Jul 27 18:12:47 2018 us=421979 /sbin/ip route add 0.0.0.0/1 via 10.8.0.1
Fri Jul 27 18:12:47 2018 us=427805 /sbin/ip route add 128.0.0.0/1 via 10.8.0.1
Fri Jul 27 18:12:47 2018 us=433712 /sbin/ip route add 192.168.119.0/24 via 10.8.0.1
Fri Jul 27 18:12:47 2018 us=439246 Initialization Sequence Completed
---- Here is where I finally hit Ctrl-C in the client ------
Fri Jul 27 18:13:11 2018 us=197650 event_wait : Interrupted system call (code=4)
Fri Jul 27 18:13:11 2018 us=197837 SIGTERM received, sending exit notification to peer
Fri Jul 27 18:13:12 2018 us=336689 TCP/UDP: Closing socket
Fri Jul 27 18:13:12 2018 us=337096 /sbin/ip route del 192.168.119.0/24
Fri Jul 27 18:13:12 2018 us=342934 /sbin/ip route del 81.xxx.xxx.209/32
Fri Jul 27 18:13:12 2018 us=348427 /sbin/ip route del 0.0.0.0/1
Fri Jul 27 18:13:12 2018 us=354148 /sbin/ip route del 128.0.0.0/1
Fri Jul 27 18:13:12 2018 us=359814 Closing TUN/TAP interface
Fri Jul 27 18:13:12 2018 us=360079 /sbin/ip addr del dev tun1 10.8.0.2/24
Fri Jul 27 18:13:12 2018 us=432735 SIGTERM[soft,exit-with-notification] received, process exiting

Client system:

 uname -a
Linux rpi3-aspo 4.9.35-v7+ #1014 SMP Fri Jun 30 14:47:43 BST 2017 armv7l GNU/Linux

Client network:

 ifconfig
eth0      Link encap:Ethernet  HWaddr b8:27:eb:22:0c:43
          inet addr:192.168.117.173  Bcast:192.168.117.255  Mask:255.255.255.0
          inet6 addr: fe80::404c:fa69:b179:252d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:80229 errors:0 dropped:65 overruns:0 frame:0
          TX packets:28643 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:15040783 (14.3 MiB)  TX bytes:20420686 (19.4 MiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:302 errors:0 dropped:0 overruns:0 frame:0
          TX packets:302 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1
          RX bytes:24416 (23.8 KiB)  TX bytes:24416 (23.8 KiB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.8.0.1  P-t-P:10.8.0.1  Mask:255.255.255.0
          inet6 addr: fe80::e457:7f1d:3117:222a/64 Scope:Link
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:31 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:0 (0.0 B)  TX bytes:1600 (1.5 KiB)

wlan0     Link encap:Ethernet  HWaddr b8:27:eb:77:59:16
          inet addr:192.168.117.174  Bcast:192.168.117.255  Mask:255.255.255.0
          inet6 addr: fe80::d3d8:4916:54fe:afd9/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:34056 errors:0 dropped:43 overruns:0 frame:0
          TX packets:131 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:5233697 (4.9 MiB)  TX bytes:21172 (20.6 KiB)

Finally IPTABLES save:

 sudo iptables-save
# Generated by iptables-save v1.4.21 on Fri Jul 27 19:08:50 2018
*filter
:INPUT ACCEPT [81033:15649734]
:FORWARD ACCEPT [4:1334]
:OUTPUT ACCEPT [27706:19663926]
COMMIT
# Completed on Fri Jul 27 19:08:50 2018
# Generated by iptables-save v1.4.21 on Fri Jul 27 19:08:50 2018
*nat
:PREROUTING ACCEPT [16095:3657541]
:INPUT ACCEPT [2250:480591]
:OUTPUT ACCEPT [920:62479]
:POSTROUTING ACCEPT [914:62563]
-A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE
COMMIT
# Completed on Fri Jul 27 19:08:50 2018

To me this seems to indicate that I get a good connection to the server only it does not work for anything.
Is there some command I can enter (in another command window) while the connection is up in order to extract more useful info like routing setup etc? If so please give me the Linux commands to do so.

TinCanTech

BobAGI wrote for the life of me I cannot find out how I can get a working connection from a Raspbian box (RPi3B)...
This RPi3B box runs an openvpn server (2.3.4) itself, which I use to connect remotely

You can not --push "redirect-gateway .." in any form to this machine ..

PUSH: Received control message: 'PUSH_REPLY,route 192.168.119.0 255.255.255.0,redirect-gateway def1

Technically, you can but it is too complicated and beyond this Forum scope for me to explain.

If you wish to contact me privately: tincanteksup <at> gmail

BobAGI

OK, if it is impossible, then I will not pursue it anymore.
Is the problem the fact that this RPi Linux box also has an OpenVPN server daemon running?
Is it possible to use OpenVPN clients on regular client Linux boxes?