Dear all, I've been lurking on forum and followed almost all the advices but I cannot figure out what the problem is. Long story short: my client (iPhone) connects correctly to VPN (Raspberry, 192.168.0.46). It has IP 10.5.0.6 and I can ping it from any device of the network 192.168.0.x. On the contrary iPhone cannot ping any device on the network 192.168.0.x. No access to Internet too. Configuration on server.conf: [oconf=Server config]port 1194 proto udp dev tun askpass /etc/openvpn/auth.pass ca /etc/openvpn/server/ca.crt cert /etc/openvpn/server/server.crt key /etc/openvpn/server/server.key dh /etc/openvpn/server/dh.pem crl-verify /etc/openvpn/server/crl.pem server 10.5.0.0 255.255.255.0 push "redirect-gateway def1" push "route 10.5.0.0 255.255.255.0" push "route 192.168.0.0 255.255.255.0" push "dhcp-option DNS 8.8.8.8" push "dhcp-option DNS 8.8.4.4" duplicate-cn # TLS Security cipher AES-256-CBC tls-version-min 1.2 tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES$ auth SHA512 auth-nocache # Other Configuration keepalive 20 60 persist-key persist-tun compress lz4 daemon user nobody group nogroup client-to-client # OpenVPN Log log-append /var/log/openvpn.log verb 3 [/oconf] while client1.conf is [oconf=Client config]client dev tun proto udp remote my.external.address 1194 cipher AES-256-CBC auth SHA512 auth-nocache tls-version-min 1.2 tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-128-CBC-SHA256 resolv-retry infinite compress lz4 nobind persist-key persist-tun mute-replay-warnings verb 3 -----BEGIN CERTIFICATE----- bla bla bla -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- bla bla bla -----END CERTIFICATE----- -----BEGIN ENCRYPTED PRIVATE KEY----- bla bla bla -----END ENCRYPTED PRIVATE KEY----- [/oconf] on crontab I have: [code]@reboot sudo iptables -t nat -A POSTROUTING -s 10.5.0.0/24 ! -d 10.5.0.0/24 -o eth0 -j MASQUERADE [/code] I'm definitely going mad with that.... any advice? thanks!

[quote=lean79 post_id=92969 time=1594376333 user_id=50843] push "route [b]192.168.0.0[/b] 255.255.255.0" [/quote]This is the single most likely subnet to cause routing conflicts .. you ought to change it. https://community.openvpn.net/openvpn/wiki/AvoidRoutingConflicts [quote=lean79 post_id=92969 time=1594376333 user_id=50843] on crontab I have: [/quote]There are much better ways to make iptables rules persistent .. search for it.

[quote]There are much better ways to make iptables rules persistent .. search for it. [/quote] I know, before to fix that I want to be sure everythig works fine. Thanks for your advice! [quote=TinCanTech post_id=92970 time=1594377352 user_id=37053] This is the single most likely subnet to cause routing conflicts .. you ought to change it. https://community.openvpn.net/openvpn/wiki/AvoidRoutingConflicts [/quote] ok fine, but my iPhone is not connected to any 192.168.x.x wifi, it is connected through its own sim card over 4G connection. It has been assigned a 10.5.0.x according to the server.conf the routing table should be fine, it must ping 192.168.0.x while connected through VPN I do not understand what I'm doing wrong :oops:

[quote=lean79 post_id=92988 time=1594391047 user_id=50843] [quote]There are much better ways to make iptables rules persistent .. search for it. [/quote] I know, before to fix that I want to be sure everythig works fine. Thanks for your advice! I do not understand what I'm doing wrong :oops: [/quote]Fix your iptables now. See the Howto.

there are two iphone one can connect and do everything on it my client (iPhone) connects correctly and then difference On the contrary iPhone cannot ping any device on the network 192.168.0.x. cant do anything when connect to openvpn server . is that correct? so which phone is working for you and which one not working? if the first work ok so your server is working nothing need to be done at all only the iphone not working need to check that all you can do .

[quote=300000 post_id=93004 time=1594403799 user_id=19319] there are two iphone one can connect and do everything on it my client (iPhone) connects correctly and then difference On the contrary iPhone cannot ping any device on the network 192.168.0.x. cant do anything when connect to openvpn server . is that correct? so which phone is working for you and which one not working? if the first work ok so your server is working nothing need to be done at all only the iphone not working need to check that all you can do . [/quote] hi no, we have just 1 iPhone it can be reached from the subnet 192.168.0.x but it cannot reach 192.168.0.x

subnet 192.168.0.x but it cannot reach 192.168.0.x that is the same subnet so whst do you want?

What you mean is device inside your lan 192.168.0.* can ping your iphone ip 10.5.0.6 but your iphone cant ping any device on subnet 192.168.0.* . You can try this on your raspberry iptables -t nat -A POSTROUTING -s 10.5.0.0/24 -j MASQUERADE

[quote=300000 post_id=93017 time=1594466050 user_id=19319] What you mean is device inside your lan 192.168.0.* can ping your iphone ip 10.5.0.6 but your iphone cant ping any device on subnet 192.168.0.* . You can try this on your raspberry iptables -t nat -A POSTROUTING -s 10.5.0.0/24 -j MASQUERADE [/quote] Exactly, no ping from iPhone Already done sudo iptables -t nat -A POSTROUTING -s 10.5.0.0/24 -j MASQUERADE But nothing to do

what the log iphone verb 4 so it will show how routing add to your phone? sometime iptable not working as you think and we can reset it so just try this one reset iptables iptables-save | awk '/^[*]/ { print $1 }/^:[A-Z]+ [^-]/ { print $1 " ACCEPT" ; } /COMMIT/ { print $0; }' | iptables-restore iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE iptables -t nat -A POSTROUTING -s 10.5.0.0/24 -j MASQUERADE just add line by line to see if the iphone can ping anything to subnet inside lan . the NAT is working but somehow it not return back and have been block by iptables.

Reaching internal network from clients

lean79

TinCanTech wrote
lean79 wrote Long story short: my client (iPhone) connects correctly to VPN (Raspberry, 192.168.0.46). It has IP 10.5.0.6 and I can ping it from any device of the network 192.168.0.x.
On the contrary iPhone cannot ping any device on the network 192.168.0.x
All I can tell you is that it looks like you have things setup correctly. That it does not work is a mystery ..

Also, while your iptables rules look ok this is the normal rule:
-t nat -A POSTROUTING -s 10.5.0.0/24 -o eth0 -j MASQUERADE

exactly, I'm not a total noob... I think I've done it correctly and all it seems OK.
f**k off, I'll buy a Fritzbox

TinCanTech

You could try tcpdump on the server to see if it is dropping packets ..

300000

ok dont know if you lan routing all network or not nothing to show it so let try one more just lan routing to see . copy this on terminal with sudo

  perl -pi -e 's/#{1,}?net.ipv4.ip_forward ?= ?(0|1)/net.ipv4.ip_forward = 1/g' /etc/sysctl.conf

after that type

   net.ipv4.ip_forward

if it is 0 is not work , if it is 1 should be work

TinCanTech

@300000

lean79 wrote Dear all, I've been lurking on forum and followed almost all the advices but I cannot figure out what the problem is.

Long story short: my client (iPhone) connects correctly to VPN (Raspberry, 192.168.0.46). It has IP 10.5.0.6 and I can ping it from any device of the network 192.168.0.x.
On the contrary iPhone cannot ping any device on the network 192.168.0.x. No access to Internet too.

IP Forwarding must already be enabled ..

lean79

TinCanTech wrote @300000
lean79 wrote Dear all, I've been lurking on forum and followed almost all the advices but I cannot figure out what the problem is.

Long story short: my client (iPhone) connects correctly to VPN (Raspberry, 192.168.0.46). It has IP 10.5.0.6 and I can ping it from any device of the network 192.168.0.x.
On the contrary iPhone cannot ping any device on the network 192.168.0.x. No access to Internet too.

IP Forwarding must already be enabled ..

indeed it is

« Previous Page