Mcsticken
For the life of me I can't figure this out, and nothing I've found online has worked. I had this working for a week or so after getting a Raspberry Pi and hosting the server and Pihole on it, then it broke because I installed a couple things. I formatted the SD card and tried to just start fresh, but now I can't connect to anything on my LAN or on the internet. If I'm on the VPN, I can SSH to my pi, ping things on LAN and the internet through SSH, connect to the Pihole webserver, but nothing else. I don't think the problem's related to the Pihole, but it may be.
port 443
proto tcp
dev tun
sndbuf 0
rcvbuf 0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-auth ta.key 0
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 10.8.0.1"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log /var/log/openvpn.log
verb 4
crl-verify crl.pem
I also tried with and without these:
client-config-dir /etc/openvpn/ccd
client-config-dir ccd (saw conflicting information on what to put at the end, tried both)
push "dhcp-option DNS 192.168.2.25" (my pi's IP, I think I used it originally)
push "route 192.168.2.0 255.255.255.0 (from Pihole + OpenVPN installation instructions)
client
dev tun
proto tcp
sndbuf 0
rcvbuf 0
remote DOMAIN 443
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
setenv opt block-outside-dns
key-direction 1
verb 4
(certificates below)
# Generated by iptables-save v1.6.0 on Mon Dec 3 10:19:45 2018
*filter
:INPUT ACCEPT [363:38261]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [346:33277]
-A FORWARD -i wlan0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i tun0 -o wlan0 -j ACCEPT
COMMIT
# Completed on Mon Dec 3 10:19:45 2018
# Generated by iptables-save v1.6.0 on Mon Dec 3 10:19:45 2018
*nat
:PREROUTING ACCEPT [10:2623]
:INPUT ACCEPT [10:2623]
:OUTPUT ACCEPT [22:1320]
:POSTROUTING ACCEPT [22:1320]
-A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to-source 10.8.0.1
-A POSTROUTING -o wlan0 -j MASQUERADE
COMMIT
Originally I just used iptables -I INPUT -i tun0 -j ACCEPT which worked fine, but this time it didn't, nor did the other recommended settings I saw.
I can't think of other things I tried, but if I do all stick them in later. I also tried to go to openvpn.net/howto before making this post but it just tells me "page not found", so if I missed something just ask for it.
Ha, just while trying to post this I got "Forbidden. You submitted too quickly. You may try again in a few seconds. Contains contacts.", which definitely does not go away after "a few seconds", all because I hit preview too often. After trying for months to get OpenVPN to work on Windows consistently (I think my record was 2 weeks before breaking in a new and exciting way), switching to a Raspberry Pi and having it break on that too, it seems fitting that even the forum would break when I touched it.
