No DNS on AT&T mobile network

rr326

I have OpenVPN almost working - I can connect to my remote server and access the network via IPs like 192.168.10.1. But when I'm connected via VPN, my local client loses all internet connectivity. I think the DNS is failing to resolve. (dig google.com ... connection timed out; no servers could be reached)

My remote setup is: Mofi router (192.168.10.1) to raspberry pi running openVPN (192.168.10.2). AT&T mobile network with a fixed IP. My client is a mac.

On the piVPN site there were some comments that suggested mobile networks might be handled differently? Maybe something with MTU? They really didn't know what to suggest and said I might check here.

I'm technical, but quite a novice at networking.

Thanks for any tips.

-Ross

dev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/pki/ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/server_XXXXX.crt
key /etc/openvpn/easy-rsa/pki/private/server_XXXXX.key
dh none
topology subnet
server 10.8.0.0 255.255.255.0
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
push "redirect-gateway def1"
client-to-client
keepalive 1800 3600
remote-cert-tls client
tls-version-min 1.2
tls-crypt /etc/openvpn/easy-rsa/pki/ta.key
cipher AES-256-CBC
auth SHA256
user nobody
group nogroup
persist-key
persist-tun
crl-verify /etc/openvpn/crl.pem
status /var/log/openvpn-status.log 20
status-version 3
syslog
verb 3

#DuplicateCNs allow access control on a less-granular, per user basis.
#Remove # if you will manage access by user instead of device.
#duplicate-cn
# Generated for use by PiVPN.io

client
dev tun
proto udp
remote 166.130.189.XXX 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
tls-version-min 1.2
verify-x509-name server_LYTQdJtffwXXXX name
cipher AES-256-CBC
auth SHA256
auth-nocache
verb 3

TinCanTech

Can you ping 8.8.8.8 over the VPN ?

rr326

PING 8.8.8.8 (8.8.8.8): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2

rr326

--> ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2

TinCanTech

Can you ping 8.8.8.8 from the server ?

rr326

Yes.

On the server: ping works.
When I connect on the client, ping doesn't work.
When I connect on the client, then ssh to the server, ping DOES work.

I guess that makes total sense and shows the DNS issues are relegated to the client.

TinCanTech

Did you enable NAT on your server ?

rr326

I'm not sure what you mean. There is NAT on the network the server is running on. And I port-forward to the Pi that hosts openVPN. And separately I have NAT on the network the client is running on.

Can you explain more?

(And, btw, I appreciate the thought process here - I had no idea where to even begin.)

TinCanTech

OK, please see:
https://community.openvpn.net/openvpn/wiki/HOWTO#Routingallclienttrafficincludingweb-trafficthroughtheVPN

See the NAT line there.

rr326 wrote I had no idea where to even begin

Likewise 😉

rr326

So it seems that this configuration (from http://www.pivpn.io/) defaults to sending everything through the VPN (redirect-gateway def1), which I don't really want.

My goal is to be able to ACCESS the network where my openVPN server is located.

So I commented out redirect-gateway, and push dhcp-option DNS...

Now my client's network works as expected. Yea.
But now I can't directly access my remote network.

ping rrosen@192.168.10.2
ping: cannot resolve rrosen@192.168.10.2: Unknown host

ping 10.8.0.1
PING 10.8.0.1 (10.8.0.1): 56 data bytes
64 bytes from 10.8.0.1: icmp_seq=0 ttl=64 time=168.549 ms

Ugg - I'm getting spun around in circles. I looked through the sample server.conf and all the routing rules spin me around in circles, which is why I turned to PiVPN in the first place.

So to you:
* I think I should NOT route all traffic through the VPN, since that's not my goal. (My goal is access.) Do you agree?
* If you do, any docs that help me set up my config so I can access the remote network? (192.168.10.x)

Thank you!

TinCanTech

rr326 wrote I think I should NOT route all traffic through the VPN, since that's not my goal. (My goal is access.) Do you agree?

Yes.

rr326 wrote If you do, any docs that help me set up my config so I can access the remote network? (192.168.10.x)

It is all in the Howto, specifically you need:
https://community.openvpn.net/openvpn/wiki/HOWTO#IncludingmultiplemachinesontheserversidewhenusingaroutedVPNdevtun

You can also use the NAT rule from before to simplify routing on the server end.

rr326

Thanks. I feel like I'm making progress, but what does this mean?

Next, you must set up a route on the server-side LAN gateway to route the VPN client subnet (10.8.0.0/24) to the OpenVPN server (this is only necessary if the OpenVPN server and the LAN gateway are different machines).

I assume this is router configuration, and I should be able to do it through the UI, but it's not port forwarding, is it?

rr326

Actually, I think I found it. (For completeness: I have an openWRT router. It's under advanced, Network, Static Routes.)

I think it's set up right, but it's still not working:
Static IPv4 Routes
Interface lan
Target: 10.8.0.0
IPv4 Netmask: 255.255.255.0
IPv4 Gateway: 192.168.10.2

I can ping 192.168.10.2 (my openVPN server), but not 192.168.10.1 (my lan gateway)

Any more ideas?

(PS It says "Make sure that you've enabled IP and TUN/TAP forwarding on the OpenVPN server machine. " - It sounds like this is a firewall concern, and I don't have a firewall on the raspberry Pi running my openvpn)