Hi, I have setup an OpenVPN server in my home LAN on a Ubuntu VM. OpenVPN version is "2.4.7-1ubuntu2", Ubuntu version is is "20.04.2 LTS". My router's (Unifi USG) WAN is connected to a fiber provider ("Deutsche Glasfaser") where only the IPv6 is directly accessible (there is a public IPv4, but this from a carrier grade NAT range not reachable from the internet) and OpenVPN is set up with IPv6 support. So I opened port 1194 for UDP in the router's firewall to the public IPv6 address of my OpenVPN server and registered the IPv6 address with a DynDNS provider. Client (iPhone not connected to LAN but to 4G with IPv6 address) connects immediately and some things work as expected: [list] I can ping all the servers on my internal network using their IPv4 addresses I can also SSH into the hosts where SSH is available [/list] So it looks like routes are pushed from the iOS client's 10.8 address to my 192.168 local network. But there are a lot of things not working as expected: [list] Open a web site on one of my local servers RDP into one of my Windows servers And what is really strange: I have an iPerf3 server running on one of my VMs which I use for intranet performance measurements. The OpenVPN client can upload to the iPerf3 server with no problems with the expected line speed but cannot download (no error, just a rate of 0 bytes). [/list] All above works fine when the iPhone is directly connected to my local network. This is my OpenVPN server.conf file: [code] port 1194 proto udp6 dev tun user nobody group nogroup persist-key persist-tun keepalive 10 120 topology subnet server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "dhcp-option DNS 8.8.8.8" push "dhcp-option DNS 8.8.4.4" push "redirect-gateway def1 bypass-dhcp" server-ipv6 fd42:42:42:42::/112 tun-ipv6 push tun-ipv6 push "route-ipv6 2000::/3" push "redirect-gateway ipv6" dh none ecdh-curve prime256v1 tls-crypt tls-crypt.key crl-verify crl.pem ca ca.crt cert server_7AtP1obGU6y5b3Xr.crt key server_7AtP1obGU6y5b3Xr.key auth SHA256 cipher AES-128-GCM ncp-ciphers AES-128-GCM tls-server tls-version-min 1.2 tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 client-config-dir /etc/openvpn/ccd status /var/log/openvpn/status.log verb 3 route "192.168.0.0 255.255.255.0" push "route 192.168.0.0 255.255.255.0" client-to-client [/code] Any suggestions / ideas? Chris

iOS client can only ping / ssh LAN servers, http or rdp not working

chkk1963

Hi,

I have setup an OpenVPN server in my home LAN on a Ubuntu VM. OpenVPN version is "2.4.7-1ubuntu2", Ubuntu version is is "20.04.2 LTS".

My router's (Unifi USG) WAN is connected to a fiber provider ("Deutsche Glasfaser") where only the IPv6 is directly accessible (there is a public IPv4, but this from a carrier grade NAT range not reachable from the internet) and OpenVPN is set up with IPv6 support. So I opened port 1194 for UDP in the router's firewall to the public IPv6 address of my OpenVPN server and registered the IPv6 address with a DynDNS provider.

Client (iPhone not connected to LAN but to 4G with IPv6 address) connects immediately and some things work as expected:

I can ping all the servers on my internal network using their IPv4 addresses
I can also SSH into the hosts where SSH is available

So it looks like routes are pushed from the iOS client's 10.8 address to my 192.168 local network. But there are a lot of things not working as expected:

Open a web site on one of my local servers
RDP into one of my Windows servers
And what is really strange: I have an iPerf3 server running on one of my VMs which I use for intranet performance measurements. The OpenVPN client can upload to the iPerf3 server with no problems with the expected line speed but cannot download (no error, just a rate of 0 bytes).

All above works fine when the iPhone is directly connected to my local network.

This is my OpenVPN server.conf file:

port 1194
proto udp6
dev tun
user nobody
group nogroup
persist-key
persist-tun
keepalive 10 120
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
push "redirect-gateway def1 bypass-dhcp"
server-ipv6 fd42:42:42:42::/112
tun-ipv6
push tun-ipv6
push "route-ipv6 2000::/3"
push "redirect-gateway ipv6"
dh none
ecdh-curve prime256v1
tls-crypt tls-crypt.key
crl-verify crl.pem
ca ca.crt
cert server_7AtP1obGU6y5b3Xr.crt
key server_7AtP1obGU6y5b3Xr.key
auth SHA256
cipher AES-128-GCM
ncp-ciphers AES-128-GCM
tls-server
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
client-config-dir /etc/openvpn/ccd
status /var/log/openvpn/status.log
verb 3
route "192.168.0.0 255.255.255.0"
push "route 192.168.0.0 255.255.255.0"
client-to-client

Any suggestions / ideas?

Chris