Connected Android client cannot reach internal destinations

vdf

Hello everyone,

I'm facing a weird issue with my OpenVPN-setup.
I have a OpenVPN server running on a physical OPNsense appliance, configured so that I can reach internal destinations in my 172.16.16.0/24 subnet.
Thanks to my internet service provider, I'm sitting behind a DS-Lite-Tunnel, hence I configured the VPN-Server on a IPv6-basis - which is actually working fine. I tested it with various clients outside of my own network - a Linux-VPC @AWS, Windows client (Vodafone cable internet), iPhone (LTE-connection T-Mobile Germany) - and everything works fine as a charm - except for my own Android phone. When i'm on LTE (Vodafone Germany) I can actually connect through the OpenVPN Android client, I receive an IP in the defined range for VPN clients, but I cannot reach any destinations inside my home LAN, neither can I ping them. Oh well, thats not entirely true: For example, I can actually connect to my Unifi Wifi Controller (running as a Docker Container on my QNAP NAS), but after few seconds I get disconnected. I can also connect to the NAS itself for a few seconds, before I lose connection. But, I totally cannot connect to the OPNsense Dashboard itself via HTTPS (timeout in browser).

I ran a tcpdump on the OpenVPN interface filtering for the client ip of the phone (10.0.10.6), and I can see bunch of handshakes and stuff between the client and the destinations (OPNSense: 172.16.16.16, Unifi Conreoller: 172.16.16.17), but i'm not really deep into tcpdump'ing.
Maybe one of you guys can see the root of the issue from the dump: https://drive.google.com/file/d/1M485I71wL7LJVlW-p4GE3S9YrzJzcwWn/view?usp=sharing

dev tun
tun-ipv6
persist-tun
persist-key
cipher AES-128-CBC
auth SHA1
client
resolv-retry infinite
remote [censored] udp6
lport 0
verify-x509-name [censored] CN=VPN SSL Cert" subject
remote-cert-tls server
auth-user-pass
<ca>
-----BEGIN CERTIFICATE-----
[censored]
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
[censored]
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
[censored]
iGPJE9+ihSEibD9WOmMmdmdh
-----END PRIVATE KEY-----
</key>
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
[censored]
-----END OpenVPN Static key V1-----
</tls-auth>
key-direction 1

server-config

      <mode>server_tls_user</mode>
      <protocol>UDP6</protocol>
      <dev_mode>tun</dev_mode>
      <local_port>1194</local_port>
      <description>Tunnel to home LAN</description>
      <crypto>AES-128-CBC</crypto>
      <digest>SHA1</digest>
      <engine>none</engine>
      <tunnel_network>10.0.10.0/24</tunnel_network>
      <tunnel_networkv6>fe80::/64</tunnel_networkv6>
      <local_network>172.16.16.0/24</local_network>
      <dynamic_ip>yes</dynamic_ip>
      <pool_enable>yes</pool_enable>
      <netbios_ntype>0</netbios_ntype>
      <verbosity_level>3</verbosity_level>
      <vpnid>1</vpnid>
      <authmode>Local Database</authmode>
      <interface>lan</interface>
      <custom_options/>
      <tls>[censored]</tls>
      <caref>5e8606f582191</caref>
      <crlref/>
      <certref>5d6ba822e5a1f</certref>
      <dh_length>2048</dh_length>
      <cert_depth>1</cert_depth>

verbose-4 log

2020-07-09T14:21:01	openvpn[45455]: MANAGEMENT: Client disconnected
2020-07-09T14:21:01	openvpn[45455]: MANAGEMENT: CMD 'quit'
2020-07-09T14:21:01	openvpn[45455]: MANAGEMENT: CMD 'status 2'
2020-07-09T14:21:00	openvpn[45455]: MANAGEMENT: Client connected from /var/etc/openvpn/server2.sock
2020-07-09T14:21:00	openvpn[66710]: MANAGEMENT: Client disconnected
2020-07-09T14:21:00	openvpn[66710]: MANAGEMENT: CMD 'quit'
2020-07-09T14:21:00	openvpn[66710]: MANAGEMENT: CMD 'status 2'
2020-07-09T14:21:00	openvpn[66710]: MANAGEMENT: Client connected from /var/etc/openvpn/server1.sock
2020-07-09T14:19:58	openvpn[45455]: MANAGEMENT: Client disconnected
2020-07-09T14:19:58	openvpn[45455]: MANAGEMENT: CMD 'quit'
2020-07-09T14:19:58	openvpn[45455]: MANAGEMENT: CMD 'status 2'
2020-07-09T14:19:58	openvpn[45455]: MANAGEMENT: Client connected from /var/etc/openvpn/server2.sock
2020-07-09T14:19:58	openvpn[66710]: MANAGEMENT: Client disconnected
2020-07-09T14:19:58	openvpn[66710]: MANAGEMENT: CMD 'quit'
2020-07-09T14:19:58	openvpn[66710]: MANAGEMENT: CMD 'status 2'
2020-07-09T14:19:57	openvpn[66710]: MANAGEMENT: Client connected from /var/etc/openvpn/server1.sock
2020-07-09T14:19:22	openvpn[66710]: user/2a00:... Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2020-07-09T14:19:22	openvpn[66710]: user/2a00:... Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2020-07-09T14:19:22	openvpn[66710]: user/2a00:... Data Channel MTU parms [ L:1549 D:1450 EF:49 EB:406 ET:0 EL:3 ]
2020-07-09T14:19:22	openvpn[66710]: user/2a00:... Data Channel: using negotiated cipher 'AES-256-GCM'
2020-07-09T14:19:22	openvpn[66710]: user/2a00:... SENT CONTROL [user]: 'PUSH_REPLY,route 172.16.16.0 255.255.255.0,tun-ipv6,route 10.0.10.1,topology net30,ping 10,ping-restart 60,ifconfig-ipv6 fe80::1000/64 fe80::1,ifconfig 10.0.10.6 10.0.10.5,peer-id 0,cipher AES-256-GCM' (status=1)
2020-07-09T14:19:22	openvpn[66710]: user/2a00:... PUSH: Received control message: 'PUSH_REQUEST'
2020-07-09T14:19:22	openvpn[66710]: user/2a00:... MULTI: primary virtual IPv6 for user/2a00:...: fe80::1000
2020-07-09T14:19:22	openvpn[66710]: user/2a00:... MULTI: Learn: fe80::1000 -> user/2a00:...
2020-07-09T14:19:22	openvpn[66710]: user/2a00:... MULTI: primary virtual IP for user/2a00:...: 10.0.10.6
2020-07-09T14:19:22	openvpn[66710]: user/2a00:... MULTI: Learn: 10.0.10.6 -> user/2a00:...
2020-07-09T14:19:22	openvpn[66710]: user/2a00:... MULTI_sva: pool returned IPv4=10.0.10.6, IPv6=fe80::1000
2020-07-09T14:19:22	openvpn[66710]: 2a00:... [user] Peer Connection Initiated with [AF_INET6]2a00:...:57622
2020-07-09T14:19:22	openvpn[66710]: 2a00:... Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
2020-07-09T14:19:22	openvpn[66710]: 2a00:... TLS: Username/Password authentication succeeded for username 'user' [CN SET]
2020-07-09T14:19:22	openvpn: user 'user' authenticated using 'Local Database'
2020-07-09T14:19:22	openvpn[66710]: 2a00:... peer info: IV_SSO=openurl
2020-07-09T14:19:22	openvpn[66710]: 2a00:... peer info: IV_GUI_VER=net.openvpn.connect.android_3.2.2-5027
2020-07-09T14:19:22	openvpn[66710]: 2a00:... peer info: IV_PROTO=2
2020-07-09T14:19:22	openvpn[66710]: 2a00:... peer info: IV_TCPNL=1
2020-07-09T14:19:22	openvpn[66710]: 2a00:... peer info: IV_NCP=2
2020-07-09T14:19:22	openvpn[66710]: 2a00:... peer info: IV_PLAT=android
2020-07-09T14:19:22	openvpn[66710]: 2a00:... peer info: IV_VER=3.git:released:3e56f9a6:Release
2020-07-09T14:19:22	openvpn[66710]: 2a00:... VERIFY OK: depth=0, ..., CN=user
2020-07-09T14:19:22	openvpn[66710]: 2a00:... VERIFY SCRIPT OK: depth=0, ..., CN=user
2020-07-09T14:19:22	openvpn[66710]: 2a00:... VERIFY OK: depth=1, ..., CN=opnsense-ssl-ca
2020-07-09T14:19:22	openvpn[66710]: 2a00:... VERIFY SCRIPT OK: depth=1, ..., CN=opnsense-ssl-ca
2020-07-09T14:19:21	openvpn[66710]: 2a00:... TLS: Initial packet from [AF_INET6]2a00:...:57622, sid=be2985d0 101776f4
2020-07-09T14:19:21	openvpn[66710]: 2a00:... Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1557,tun-mtu 1500,proto UDPv4,keydir 1,cipher AES-128-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
2020-07-09T14:19:21	openvpn[66710]: 2a00:... Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1557,tun-mtu 1500,proto UDPv4,keydir 0,cipher AES-128-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
2020-07-09T14:19:21	openvpn[66710]: 2a00:... Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
2020-07-09T14:19:21	openvpn[66710]: 2a00:... Control Channel MTU parms [ L:1621 D:1184 EF:66 EB:0 ET:0 EL:3 ]
2020-07-09T14:19:21	openvpn[66710]: 2a00:... Re-using SSL/TLS context
2020-07-09T14:19:21	openvpn[66710]: MULTI: multi_create_instance called

TinCanTech

vdf wrote I cannot reach any destinations inside my home LAN

It is possible your server LAN conflicts with your client LAN:

vdf wrote SENT CONTROL [user]: 'PUSH_REPLY,route 172.16.16.0 255.255.255.0,tun-ipv6,route 10.0.10.1,topology net30,ping 10,ping-restart 60,ifconfig-ipv6 fe80::1000/64 fe80::1,ifconfig 10.0.10.6 10.0.10.5,peer-id 0,cipher AES-256-GCM' (status=1)

Check your client log.