iOS OpenVPN - can’t connect while in same network

maxiedaniels

I’m not sure if it’s due to a new OpenVPN version or moving to a Microtik router, but suddenly I can’t connect to my vpn if I’m in the same network as the OpenVPN server.
I had the same problem with my laptop, but I ended up changing “client” to “float” in client config, and it works. But iOS still can’t connect.. what can I try?

TinCanTech

It sounds like the router.

Try connecting to the LAN address of the router.

maxiedaniels

I'm pulling my hair out over this. I've been using OpenVPN for years, and I've always been able to connect to it whether or not the client in the same network as the server. However, suddenly I can't do so unless I change the top of my client config to 'float' instead of 'client'. Problem is, this screws up the 10.8.0.1 route from my client computer - I can't ping it or access it in any way. Did something change recently with OpenVPN? And why does changing to float result in 10.8.0.1 not working? Or is there something that changed when I recently switched to a Microtik router (default config with ports forwarded)?

TinCanTech

maxiedaniels wrote suddenly I can't do so unless I change the top of my client config to 'float' instead of 'client'.

That is absurd ...

--client is a macro to do --tls-client and --pull.

--float allows remote peers to change IP address.

@Mod, suitable to merge ?
https://forums.openvpn.net/viewtopic.php?f=6&t=31520&p=96456#p96456

maxiedaniels

Apologies, I forgot I had posted about this already! Hmm well when I connect with 'client' in the config, it says `Incoming packet rejected from [AF_INET]<internal server network address>:1194[2],
expected peer address: [AF_INET]<external server network address>:1194
(allow this incoming source address/port by removing
--remote or adding --float)`

Pippin

It doesn't say "remove --client" .....

Anyway, you have to wait for the time out to expire before reconnecting.
The timeout is determined by --keep-alive or --ping/--ping-restart
If none of those are set the default applies which is:

keepalive 10 60

So if you do not wait, the server will "think" the first connection is still alive.

See --keepalive args in manual 2.5:
https://build.openvpn.net/man/openvpn-2.5/openvpn.8.html

You also might want to use --explicit-exit-notify

TinCanTech

maxiedaniels wrote when I connect with 'client' in the config, it says

Incoming packet rejected from [AF_INET]<internal server network address>:1194[2],
expected peer address: [AF_INET]<external server network address>:1194
(allow this incoming source address/port by removing --remote or adding --float)

Simply add float to your client config. You must also use client.

Pippin

Also what TinCanTech wrote ^^^