Reaching internal network from clients

lean79

Dear all, I've been lurking on forum and followed almost all the advices but I cannot figure out what the problem is.

Long story short: my client (iPhone) connects correctly to VPN (Raspberry, 192.168.0.46). It has IP 10.5.0.6 and I can ping it from any device of the network 192.168.0.x.
On the contrary iPhone cannot ping any device on the network 192.168.0.x. No access to Internet too.

Configuration on server.conf:
port 1194
proto udp
dev tun
askpass /etc/openvpn/auth.pass
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/server.crt
key /etc/openvpn/server/server.key

dh /etc/openvpn/server/dh.pem
crl-verify /etc/openvpn/server/crl.pem

server 10.5.0.0 255.255.255.0
push "redirect-gateway def1"
push "route 10.5.0.0 255.255.255.0"
push "route 192.168.0.0 255.255.255.0"

push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

duplicate-cn

# TLS Security
cipher AES-256-CBC
tls-version-min 1.2
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES$
auth SHA512
auth-nocache

# Other Configuration
keepalive 20 60
persist-key
persist-tun
compress lz4
daemon
user nobody
group nogroup
client-to-client

# OpenVPN Log
log-append /var/log/openvpn.log
verb 3

while client1.conf is
client
dev tun
proto udp
remote my.external.address 1194

cipher AES-256-CBC
auth SHA512
auth-nocache
tls-version-min 1.2
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-128-CBC-SHA256

resolv-retry infinite
compress lz4
nobind
persist-key
persist-tun
mute-replay-warnings
verb 3

<ca>
-----BEGIN CERTIFICATE-----
bla bla bla
-----END CERTIFICATE-----
</ca>

<cert>
-----BEGIN CERTIFICATE-----
bla bla bla
-----END CERTIFICATE-----
</cert>

<key>
-----BEGIN ENCRYPTED PRIVATE KEY-----
bla bla bla
-----END ENCRYPTED PRIVATE KEY-----
</key>

on crontab I have:

@reboot sudo iptables -t nat -A POSTROUTING -s 10.5.0.0/24 ! -d 10.5.0.0/24 -o eth0 -j MASQUERADE

I'm definitely going mad with that....
any advice?

thanks!

TinCanTech

lean79 wrote push "route 192.168.0.0 255.255.255.0"

This is the single most likely subnet to cause routing conflicts .. you ought to change it.
https://community.openvpn.net/openvpn/wiki/AvoidRoutingConflicts

lean79 wrote on crontab I have:

There are much better ways to make iptables rules persistent .. search for it.

lean79

There are much better ways to make iptables rules persistent .. search for it.

I know, before to fix that I want to be sure everythig works fine. Thanks for your advice!

TinCanTech wrote This is the single most likely subnet to cause routing conflicts .. you ought to change it.
https://community.openvpn.net/openvpn/wiki/AvoidRoutingConflicts

ok fine, but my iPhone is not connected to any 192.168.x.x wifi, it is connected through its own sim card over 4G connection.
It has been assigned a 10.5.0.x according to the server.conf
the routing table should be fine, it must ping 192.168.0.x while connected through VPN
I do not understand what I'm doing wrong :oops:

TinCanTech

lean79 wrote
There are much better ways to make iptables rules persistent .. search for it.
I know, before to fix that I want to be sure everythig works fine. Thanks for your advice!
<snip>
I do not understand what I'm doing wrong :oops:

Fix your iptables now. See the Howto.

300000

there are two iphone one can connect and do everything on it my client (iPhone) connects correctly

and then difference On the contrary iPhone cannot ping any device on the network 192.168.0.x. cant do anything when connect to openvpn server . is that correct?

so which phone is working for you and which one not working? if the first work ok so your server is working nothing need to be done at all only the iphone not working need to check that all you can do .

lean79

300000 wrote there are two iphone one can connect and do everything on it my client (iPhone) connects correctly

and then difference On the contrary iPhone cannot ping any device on the network 192.168.0.x. cant do anything when connect to openvpn server . is that correct?

so which phone is working for you and which one not working? if the first work ok so your server is working nothing need to be done at all only the iphone not working need to check that all you can do .

hi
no, we have just 1 iPhone
it can be reached from the subnet 192.168.0.x but it cannot reach 192.168.0.x

300000

subnet 192.168.0.x but it cannot reach 192.168.0.x that is the same subnet so whst do you want?

300000

What you mean is device inside your lan 192.168.0.* can ping your iphone ip 10.5.0.6 but your iphone cant ping any device on subnet 192.168.0.* .
You can try this on your raspberry

iptables -t nat -A POSTROUTING -s 10.5.0.0/24 -j MASQUERADE

lean79

300000 wrote What you mean is device inside your lan 192.168.0.* can ping your iphone ip 10.5.0.6 but your iphone cant ping any device on subnet 192.168.0.* .
You can try this on your raspberry

iptables -t nat -A POSTROUTING -s 10.5.0.0/24 -j MASQUERADE

Exactly, no ping from iPhone

Already done
sudo iptables -t nat -A POSTROUTING -s 10.5.0.0/24 -j MASQUERADE
But nothing to do

300000

what the log iphone verb 4 so it will show how routing add to your phone? sometime iptable not working as you think and we can reset it so just try this one
reset iptables

iptables-save | awk '/^[*]/ { print $1 }/^:[A-Z]+ [^-]/ { print $1 " ACCEPT" ; } /COMMIT/ { print $0; }' | iptables-restore

iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

iptables -t nat -A POSTROUTING -s 10.5.0.0/24 -j MASQUERADE

just add line by line to see if the iphone can ping anything to subnet inside lan . the NAT is working but somehow it not return back and have been block by iptables.

TinCanTech

Output from

ip a

lean79

what the log iphone verb 4 so it will show how routing add to your phone?

this is the log from iPhone

2020-07-11 19:05:22 ----- OpenVPN Start -----
OpenVPN core 3.git::3e56f9a6 ios arm64 64-bit

2020-07-11 19:05:22 OpenVPN core 3.git::3e56f9a6 ios arm64 64-bit

2020-07-11 19:05:22 Frame=512/2048/512 mssfix-ctrl=1250

2020-07-11 19:05:22 UNUSED OPTIONS
6 [auth-nocache] 
8 [tls-cipher] [TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC...] 
9 [resolv-retry] [infinite] 
11 [nobind] 
12 [persist-key] 
13 [persist-tun] 
14 [mute-replay-warnings] 
15 [verb] [3] 

2020-07-11 19:05:22 EVENT: RESOLVE

2020-07-11 19:05:22 Contacting [XXX.XXX.XXX.XXX]:1194/UDP via UDP

2020-07-11 19:05:22 EVENT: WAIT

2020-07-11 19:05:22 Connecting to [my_address.com]:1194 (XXX.XXX.XXX.XXX) via UDPv4

2020-07-11 19:05:22 EVENT: CONNECTING

2020-07-11 19:05:22 Tunnel Options:V4,dev-type tun,link-mtu 1602,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-client

2020-07-11 19:05:22 Creds: UsernameEmpty/PasswordEmpty

2020-07-11 19:05:22 Peer Info:
IV_VER=3.git::3e56f9a6
IV_PLAT=ios
IV_NCP=2
IV_TCPNL=1
IV_PROTO=2
IV_LZO_STUB=1
IV_COMP_STUB=1
IV_COMP_STUBv2=1
IV_AUTO_SESS=1
IV_GUI_VER=net.openvpn.connect.ios_3.2.0-3253
IV_SSO=openurl


2020-07-11 19:05:22 VERIFY OK: depth=1, /CN=Easy-RSA CA

2020-07-11 19:05:22 VERIFY OK: depth=0, /CN=server

2020-07-11 19:05:23 SSL Handshake: CN=server, TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA

2020-07-11 19:05:23 Session is ACTIVE

2020-07-11 19:05:23 EVENT: GET_CONFIG

2020-07-11 19:05:23 Sending PUSH_REQUEST to server...

2020-07-11 19:05:23 OPTIONS:
0 [redirect-gateway] [def1] 
1 [dhcp-option] [DNS] [8.8.8.8] 
2 [dhcp-option] [DNS] [8.8.4.4] 
3 [route] [10.5.0.0] [255.255.255.0] 
4 [topology] [net30] 
5 [ping] [20] 
6 [ping-restart] [60] 
7 [ifconfig] [10.5.0.6] [10.5.0.5] 
8 [peer-id] [0] 
9 [cipher] [AES-256-GCM] 


2020-07-11 19:05:23 PROTOCOL OPTIONS:
  cipher: AES-256-GCM
  digest: NONE
  compress: COMP_STUB
  peer ID: 0

2020-07-11 19:05:23 EVENT: ASSIGN_IP

2020-07-11 19:05:23 NIP: preparing TUN network settings

2020-07-11 19:05:23 NIP: init TUN network settings with endpoint: XXX.XXX.XXX.XXX

2020-07-11 19:05:23 NIP: adding IPv4 address to network settings 10.5.0.6/255.255.255.252

2020-07-11 19:05:23 NIP: adding (included) IPv4 route 10.5.0.4/30

2020-07-11 19:05:23 NIP: adding (included) IPv4 route 10.5.0.0/24

2020-07-11 19:05:23 NIP: redirecting all IPv4 traffic to TUN interface

2020-07-11 19:05:23 NIP: adding DNS 8.8.8.8

2020-07-11 19:05:23 NIP: adding DNS 8.8.4.4

2020-07-11 19:05:23 Connected via NetworkExtensionTUN

2020-07-11 19:05:23 LZO-ASYM init swap=0 asym=1

2020-07-11 19:05:23 Comp-stub init swap=1

2020-07-11 19:05:23 EVENT: CONNECTED my_address.com:1194 (XXX.XXX.XXX.XXX) via /UDPv4 on NetworkExtensionTUN/10.5.0.6/ gw=[/]

sometime iptable not working as you think and we can reset it so just try this one
reset iptables
iptables-save | awk '/^[*]/ { print $1 }/^:[A-Z]+ [^-]/ { print $1 " ACCEPT" ; } /COMMIT/ { print $0; }' | iptables-restore

iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

iptables -t nat -A POSTROUTING -s 10.5.0.0/24 -j MASQUERADE

just add line by line to see if the iphone can ping anything to subnet inside lan . the NAT is working but somehow it not return back and have been block by iptables.

done! nothing changed.
holy crap, it seems everything's correct.

Output from
ip a
?

here it is

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether b8:27:eb:c1:33:b9 brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.46/24 brd 192.168.0.255 scope global noprefixroute eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::a4d1:8421:23eb:dc17/64 scope link 
       valid_lft forever preferred_lft forever
12: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
    link/none 
    inet 10.5.0.1 peer 10.5.0.2/32 scope global tun0
       valid_lft forever preferred_lft forever
    inet6 fe80::29e8:b59f:2568:361f/64 scope link stable-privacy 
       valid_lft forever preferred_lft forever

TinCanTech

lean79 wrote done! nothing changed.
holy crap, it seems everything's correct.

Does that mean it is working or not ?

lean79

No it doesn’t work.
I mean that I think I did everything correctly.

TinCanTech

output from

iptables-save

lean79

# Generated by xtables-save v1.8.2 on Sat Jul 11 23:11:52 2020
*nat
:PREROUTING ACCEPT [1465:433689]
:INPUT ACCEPT [1433:431586]
:POSTROUTING ACCEPT [398:43143]
:OUTPUT ACCEPT [6777:496477]
-A POSTROUTING -o eth0 -j MASQUERADE
-A POSTROUTING -s 10.5.0.0/24 -j MASQUERADE
COMMIT
# Completed on Sat Jul 11 23:11:52 2020
# Generated by xtables-save v1.8.2 on Sat Jul 11 23:11:52 2020
*filter
:INPUT ACCEPT [36842:14876633]
:FORWARD ACCEPT [234:49030]
:OUTPUT ACCEPT [38303:3889527]
-A FORWARD -i %i -j ACCEPT
-A FORWARD -o %i -j ACCEPT
COMMIT
# Completed on Sat Jul 11 23:11:52 2020

300000

there is no push route 192.168.0.0 to iPhone so how can iPhone can ping lan subnet , how do your iPhone connect to internet? inside your Wi-Fi and the same subnet or outside ? only 10.5.0.0 add to iPhone routing table.

2020-07-11 19:05:23 OPTIONS:
0 [redirect-gateway] [def1]
1 [dhcp-option] [DNS] [8.8.8.8]
2 [dhcp-option] [DNS] [8.8.4.4]
3 [route] [10.5.0.0] [255.255.255.0]
4 [topology] [net30]
5 [ping] [20]
6 [ping-restart] [60]
7 [ifconfig] [10.5.0.6] [10.5.0.5]
8 [peer-id] [0]
9 [cipher] [AES-256-GCM]

what is address 10.5.0.4 come from?

2020-07-11 19:05:23 NIP: adding (included) IPv4 route 10.5.0.4/30

2020-07-11 19:05:23 NIP: adding (included) IPv4 route 10.5.0.0/24

2020-07-11 19:05:23 NIP: redirecting all IPv4 traffic to TUN interface

TinCanTech

300000 wrote there is no push route 192.168.0.0 to iPhone so how can iPhone can ping lan subnet , how do your iPhone connect to internet? inside your Wi-Fi and the same subnet or outside ? only 10.5.0.0 add to iPhone routing table.

2020-07-11 19:05:23 OPTIONS:
0 [redirect-gateway] [def1]

No need to push a route ..

lean79

Let's say I don't care to reach clients on my internal network from iPhone.

But at least the raspberry MUST be reached. 192.168.0.46 from iPhone when connected to VPN MUST be reached!

TinCanTech

lean79 wrote Long story short: my client (iPhone) connects correctly to VPN (Raspberry, 192.168.0.46). It has IP 10.5.0.6 and I can ping it from any device of the network 192.168.0.x.
On the contrary iPhone cannot ping any device on the network 192.168.0.x

All I can tell you is that it looks like you have things setup correctly. That it does not work is a mystery ..

Also, while your iptables rules look ok this is the normal rule:

-t nat -A POSTROUTING -s 10.5.0.0/24 -o eth0 -j MASQUERADE