25zerotwo
Greetings all, I arrive here having looked at numerous guides and tried a few things already without success. 🙁
I run Pi-Hole on a Rasp PI and I also have a separate Rasp PI which has OpenVPN running on it, both locked down via firewalls to ensure only the OpenVPN port is exposed to outside world. VPN connection was working and giving access to internal LAN just fine until I enabled DHCP on the Pi-Hole (something I had to do due to NetGear router not supporting DNS on internal IP)
I am certain I need to bridge or forward the traffic between the eth0 and tun0 connections somehow, but as said every guide that I thought solved the issue, has failed to do so, given that I cannot reach any internal IP even when specifying them I believe this is more an OpenVPN issue than Pi-hole, hoping a bright mind has had this same issue here. Thanks in advance.
Expected Behaviour:
Connect to VPN from outside world, and remotely access CCTV on 192.168.0.141:9000
Actual Behaviour:
VPN connects and I aquire the public IP of my home route, and can browse the web via it, but.. I am unable to access any internal IP (including Pi-hole) from the VPN tunnel. I cannot ping any LAN side host from the Tun0 connection.
I can however ping from eth0 (on the Lan side) fine.
LAN settings
Pi-hole IP 192.168.0.53
OpenVPN 192.168.0.54
LAN IP range 192.168.0.0/24
Gateway 192.168.0.53
VPN Tun range 10.8.0.0/24
port 1194
proto udp
dev tun
#dev tap0
sndbuf 0
rcvbuf 0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-auth ta.key 0
topology subnet
server 10.8.0.0 255.255.255.0
#server-bridge 192.168.0.54 255.255.255.0 192.168.0.55 192.168.0.60
ifconfig-pool-persist ipp.txt
dev tun
proto udp
sndbuf 0
rcvbuf 0
remote 86.x.x.x 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
comp-lzo
setenv opt block-outside-dns
key-direction 1
verb 3
<ca>
-----BEGIN CERTIFICATE-----
xxxxx
-----END CERTIFICATE-----
</ca>
<cert>
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
5b:94:d9:bf:d2:02:d1:1d:05:39:ac:95:d4:7c:95:42
Signature Algorithm: sha256WithRSAEncryption
Issuer: CN=ChangeMe
Validity
Not Before: May 31 17:36:12 2019 GMT
Not After : May 28 17:36:12 2029 GMT
Subject: CN=mac_pi
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:ab:c0:f5:f7:33:59:4e:59:e7:94:1b:a0:9f:34:
12:37:7b:00:26:83:3c:e6:1b:b0:5d:f4:20:25:57:
f9:a1:0f:6e:27:1a:d5:2f:ee:5c:04:13:98:b4:ce:
2f:e8:cb:37:3b:3b:ba:81:3b:b1:4e:30:c4:e4:40:
98:5e:5a:67:19:c2:d9:90:58:03:fc:42:49:c8:79:
e8:54:a1:19:82:82:ff:3f:22:5a:42:cf:a9:74:3f:
8c:33:1e:49:10:f9:26:f6:7c:94:44:5d:2f:97:cb:
5f:b2:88:ca:1b:98:74:61:30:07:be:08:a9:44:a5:
da:08:aa:01:f8:26:91:94:9d:64:2b:87:41:2e:b3:
77:28:b0:3d:0e:be:b5:f9:48:69:00:18:8f:8e:f8:
93:b1:21:08:19:71:c2:a5:18:b5:6d:35:f2:d6:e6:
6f:32:de:09:d8:8a:bb:7e:84:14:9d:41:27:c5:c7:
60:3b:a2:d2:68:0e:ba:61:03:5f:95:9d:cc:83:bc:
f1:e0:3a:ee:fb:c8:21:5e:6a:48:5c:85:78:d1:8c:
56:19:c9:36:58:d3:02:2f:ae:35:67:25:1f:80:84:
03:4f:84:db:50:3d:1d:7c:f1:77:ec:e4:da:98:65:
8e:43:cb:17:a7:d3:71:c9:88:74:de:03:7d:1e:1e:
e3:31
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
X509v3 Subject Key Identifier:
86:72:6D:EE:DD:4B:A4:A8:61:6B:9D:31:E8:BD:D2:AC:56:E8:65:22
X509v3 Authority Key Identifier:
keyid:7C:28:6B:66:DA:62:7A:B5:7D:B9:E2:4E:8A:35:4A:6C:D5:4A:60:D9
DirName:/CN=ChangeMe
serial:F5:4B:16:92:8A:91:76:AB
X509v3 Extended Key Usage:
TLS Web Client Authentication
X509v3 Key Usage:
Digital Signature
Signature Algorithm: sha256WithRSAEncryption
91:e7:75:af:6f:fe:58:36:a1:06:aa:9a:14:9e:cc:30:4b:53:
ad:b2:cd:a6:79:99:d0:bd:85:fd:c6:d6:2f:52:5e:c4:ec:2c:
31:87:c3:c3:30:d1:0b:ec:55:4d:e1:cb:30:4a:65:29:5f:93:
3a:a6:d3:6e:12:e7:17:7f:5d:6b:4e:ce:9b:d9:82:e6:39:35:
fc:58:fe:d0:25:ef:3b:7a:46:06:82:14:4d:d0:80:1c:87:34:
87:e7:71:33:f9:88:3a:fd:6a:c8:fb:e8:0d:3b:c6:16:a3:ef:
d7:34:38:33:c7:74:ab:c7:39:a9:d2:ee:14:8d:1e:62:30:a2:
5e:cf:ce:4c:d3:36:2b:16:d6:ca:fb:cb:14:b8:ab:ec:84:67:
68:04:ef:53:4b:e2:86:8a:5c:32:50:cf:58:bc:ab:9d:08:43:
7f:56:a2:4a:6e:e3:76:5c:a9:a1:5b:34:ed:13:04:3e:a2:fd:
68:49:a2:98:bb:1e:78:7c:e9:cd:58:87:92:f9:b5:74:e9:40:
95:6c:e3:e5:57:1d:2b:95:c1:b2:8b:0b:fc:c0:ee:de:91:fe:
76:65:26:c4:67:9c:08:11:bd:6c:7a:33:81:a4:c8:bb:b9:7b:
5e:de:10:b2:47:13:34:8e:9f:b1:51:f7:b7:6c:3f:f4:74:d1:
74:41:c4:6c
-----BEGIN CERTIFICATE-----
xxxxx
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
xxxxx
-----END PRIVATE KEY-----
</key>
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
xxxxxx
</tls-auth>
