Hello,
i've got a problem with the following setup:
Raspberry Pi with raspbian and CUPS + OpenVPN installed. The system should be a printer server.
VPN range 192.168.237.0/24 (CUPS web frontend running on 192.168.237.1:631)
A windows 10 client with openvpn installed can connect without problems and after starting the vpn connection access
http://192.168.237.1:631
Both mobile clients (iPad 2018 with iOS 12.2 and openvpn connect installed + Huawei P20 Pro with openvpn connect installed) can initiate the vpn connection successfully. The mobile clients receive an IP (e.g. 192.168.237.3). But afterwards there is no way to connect to the CUPS web frontend from the server.
A test ping from the server (192.168.237.1) to the vpn clients does work with the windows 10 client but not with the mobile clients also.
Here is the configuration:
----- OpenVPN server (RPi) ------
dev tun
proto udp
port 1199
status /var/log/openvpn-status.log
log /var/log/openvpn.log
verb 3
persist-tun
persist-key
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
tls-auth /etc/openvpn/easy-rsa/keys/tlsauth.key 0
cipher AES-256-CBC
auth SHA512
keepalive 10 60
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES-128-GCM-SHA25
server 192.168.237.0 255.255.255.0
tls-server
tls-version-min 1.2
auth-nocache
duplicate-cn
persist-remote-ip
float
topology subnet
----mobile config file -------
client
dev tun
proto udp
remote YourOpenVPNServerURL 1199
resolv-retry infinite
nobind
persist-key
persist-tun
float
key-direction 1
remote-cert-tls server
verb 3
comp-lzo
cipher AES-256-CBC
auth SHA512
<ca>
...
</ca>
<cert>
...
</cert>
<key>
...
</key>
<tls-auth>
...
</tls-auth>
---- win10 client config file -----
client
dev tun
proto udp
remote openvpn.example.com 1199
resolv-retry infinite
nobind
persist-key
persist-tun
float
remote-cert-tls server
verb 3
cipher AES-256-CBC
auth SHA512
key-direction 1
mute-replay-warnings
ca "/etc/openvpn/easy-rsa/keys/ca.crt"
cert "/etc/openvpn/easy-rsa/keys/client.crt"
key "/etc/openvpn/easy-rsa/keys/client.key"
tls-auth "/etc/openvpn/easy-rsa/keys/tlsauth.key"
Thank you for your help.
Martin
