Client connects but no internet access RaspberryPi

markontherocks

Hi everyone, I'm trying to build my private VPN and I'm able to connect to my server, but unfortunately I'm not able to access the internet.
In the following the server configuration:
port 7125
#proto tcp
proto udp
dev tun
#dev tap0
ca XXXX/ca.crt
cert XXXX/pii-server.crt
key XXXX/pi-server.key
dh XXXX/dh.pem
server 10.8.0.0 255.255.255.0
push "route 192.168.178.0 255.255.255.0"
push "route 10.8.0.1 255.255.255.255"
push "route 10.8.0.0 255.255.255.0"
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
duplicate-cn
cipher AES-256-CBC
tls-version-min 1.2
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-D$
auth SHA512
auth-nocache
keepalive 20 60
persist-key
persist-tun
compress lz4-v2
client-to-client
daemon
user nobody
group nogroup
log-append /var/log/openvpn.log
verb 3
management localhost 7505

In the following the clinet conf:
client
dev tun
proto udp

remote XXXX 7125

ca ca.crt
cert client_smartphone.crt
key client_smartphone.key

cipher AES-256-CBC
auth SHA512
auth-nocache
tls-version-min 1.2
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-D$

resolv-retry infinite
compress lz4
nobind
persist-key
persist-tun
mute-replay-warnings
verb 3

In the following the output from netstat -r

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
default         fritz.box       0.0.0.0         UG        0 0          0 eth0
10.8.0.0        10.8.0.2        255.255.255.0   UG        0 0          0 tun0
10.8.0.2        0.0.0.0         255.255.255.255 UH        0 0          0 tun0
192.168.178.0   0.0.0.0         255.255.255.0   U         0 0          0 eth0

This is the output from iptables -S

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -i tun+ -j ACCEPT
-A INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 7125 -j ACCEPT
-A INPUT -i tun+ -j ACCEPT
-A FORWARD -i tun+ -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o tun+ -j ACCEPT
-A OUTPUT -o tun+ -j ACCEPT

Could you please help me?
Thanks

TinCanTech

This is wrong:

Server:

compress lz4-v2

Client:

compress lz4

Please also add your client log.

markontherocks

Good catch, thanks, tried to follow example in rules.
I'm actually using my android smartphone with openvpn client installed and internet connection is awfully slow. What I've noticed is that if I try to see a video on youtube app, I can see reasonably well first 3 seconds, then stops and loops. If try to visit a website Chrome says it can't get the IP address of the server. If I change DNS configuration in server.conf file with the url of my router, youtube will let me see the video properly, but web navigation will be very slow and difficult for some urls. Is my ISP trying to avoid me to use other DNSs?

TinCanTech

Personally, I do not use google DNS .. there are many others to choose from.

As for the rest of your issues, who can say.

markontherocks

Nice quote, hopefully someone else can help me

300000

you need to lan routing from virtual IP to real IP so it can go to internet , let check to see first . open your terminal and type and press enter

sysctl net.ipv4.ip_forward

if you see 0 it mean your raspberry not IProuting enanble so just enabble it , type this one into terminal windows.

perl -pi -e 's/#{1,}?net.ipv4.ip_forward ?= ?(0|1)/net.ipv4.ip_forward = 1/g' /etc/sysctl.conf

you need to do one more thing on iptables so it can routing for you by enter this command into ternimal.

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

iptables -A FORWARD -o %i -j ACCEPT

after that reboot your raspberry so you can connect client from it and it should connect to 8.8.8.8 or whatever dns server you choose and you can go internet from client.

you dont need compress lz4-v2 anymore so you can remove it anyway ,

markontherocks

Thanks 300000, done that but still unable to access internet properly. Chrome from android keeps saying it took too much time for the server to respond

300000

can you remove this one
push "route 10.8.0.1 255.255.255.255"
push "route 10.8.0.0 255.255.255.0"

if you want push just 10.8.0.0 not 10.8.0.1 so that line is wrong and your server is 10,8,0,1 so you dont need that one 10,8,0,0 anymore
can you add this one

push "redirect-gateway autolocal def1 bypass-dhcp"

what about the client config and firewall from client , sometime . firewall from client stop the client getting dns from server , you didnt tell anything about client and its config

if you connec from the same lan maybe it not working as expect , you need to use your phone to create a hotspot and connect client to it to test your server.,

TinCanTech

Please see these examples:
https://forums.openvpn.net/viewtopic.php?f=30&t=22603#p68963

The more detail you provide the more likely we will be able to help.

300000

maybe it is working now so he is coming back to posting any more