I am unable to get two instances of OpenVPN <Client+Server> to work
simultaneously. I have spent the last week looking for a solution and
now need to ask for help. Linux is not my forte. I have a basic
understanding so I ask you to bear with me. The Client works as a
single instance, and the Server works as a single instance. When running
simultaneous instances, Client+Server, the Client works correctly, but I am unable
to connect to the Server.
The system I am working with is a RaspberryPi 4, OS Lite (Debian)
The fact they work independently but not simultaneously makes me think
it is some sort of routing conflict, but it is beyond me.. I have found a
number of posts from people with the same issue, but no clear solution.
I have found one hint to reinforce my routing theory. I tried their suggestion
but it did not help. See below:
ip rule add from <your-server-ip> table 10
ip route add default via <your-router-ip> table 10
This is an area of Linux where my knowledge is limited. My instinct tells me
this is where the problem lies and I just can't see it!!!
I have included copies of:
client
dev tun1
remote ##.###.###.## 443 - Edited for privacy
resolv-retry infinite
nobind
persist-key
persist-tun
auth-nocache
verb 3
explicit-exit-notify 5
rcvbuf 262144
sndbuf 262144
push-peer-info
setenv UV_IPV6 yes
remote-cert-tls server
cipher AES-256-CBC
comp-lzo no
proto udp
key-direction 1
dev tun0
proto udp
port 51194
ca /etc/openvpn/easy-rsa/pki/ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/HO-RP1_d68ee749-f7a7-47e6-9522-163c4a368919.crt
key /etc/openvpn/easy-rsa/pki/private/HO-RP1_d68ee749-f7a7-47e6-9522-163c4a368919.key
dh none
ecdh-curve prime256v1
topology subnet
server 10.8.0.0 255.255.255.0
# Set your primary domain name server address for clients
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 1.0.0.1"
# Prevent DNS leaks on Windows
push "block-outside-dns"
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
client-config-dir /etc/openvpn/ccd
keepalive 15 120
remote-cert-tls client
tls-version-min 1.2
tls-crypt /etc/openvpn/easy-rsa/pki/ta.key
cipher AES-256-CBC
auth SHA256
user openvpn
group openvpn
persist-key
persist-tun
crl-verify /etc/openvpn/crl.pem
status /var/log/openvpn-status.log 20
status-version 3
syslog
verb 3
#DuplicateCNs allow access control on a less-granular, per user basis.
#Remove # if you will manage access by user instead of device.
#duplicate-cn
# Generated for use by PiVPN.io
ifconfig
tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1500
inet 10.8.0.1 netmask 255.255.255.0 destination 10.8.0.1
inet6 fe80::25e4:1590:99f3:f54f prefixlen 64 scopeid 0x20<link>
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 100 (UNSPEC)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 4 bytes 192 (192.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
tun1: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1500
inet 10.30.180.161 netmask 255.255.255.0 destination 10.30.180.161
inet6 fde6:7a:7d20:1ab4::109f prefixlen 64 scopeid 0x0<global>
inet6 fe80::d59b:e3cd:55ed:d2b5 prefixlen 64 scopeid 0x20<link>
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 100 (UNSPEC)
RX packets 16 bytes 1761 (1.7 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 29 bytes 1775 (1.7 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 10.30.180.1 128.0.0.0 UG 0 0 0 tun1
default 192.168.0.1 0.0.0.0 UG 202 0 0 eth0
10.8.0.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0
10.30.180.0 0.0.0.0 255.255.255.0 U 0 0 0 tun1
35.52.235.68.in 192.168.0.1 255.255.255.255 UGH 0 0 0 eth0
128.0.0.0 10.30.180.1 128.0.0.0 UG 0 0 0 tun1
192.168.0.0 0.0.0.0 255.255.255.0 U 202 0 0 eth0
iptables
[u]Filter[/u]
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
[u]NAT[/u]
Chain PREROUTING (policy ACCEPT 26 packets, 4756 bytes)
pkts bytes target prot opt in out source destination
Chain INPUT (policy ACCEPT 10 packets, 924 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 39 packets, 5133 bytes)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE all -- any eth0 10.8.0.0/24 anywhere /* openvpn-nat-rule */
Chain OUTPUT (policy ACCEPT 39 packets, 5133 bytes)
pkts bytes target prot opt in out source destination
-------------------------------------------------------------------------------------------------------------------------------
Any help would be greatly appreciated
Thank you - Hoping to return the favor !!!
Larry Franks
