I want to be clear, because nothing ever said I needed two of them -- can I achieve Pi-Hole and a VPN (either I scrap the work I did so far with OpenVPN and try pivpn or keep tweaking stuff) on the same physical single raspberry pi?
I'll explore the latest thread topic you shared, and if not, I'll uninstall all of my openvpn stuff and try the pivpn from the start.
I can say that about 30% of queries are blocked this morning without using the VPN, so the pihole sinkhole/dns aspect *seems* to be working. If not blocked, it forwards requests to OpenDNS's DNS servers; checking pihole logs I get "OK, answered by
dns.opendns.com#53"
---
Edit with all the files requested from the thread. If you see a glaring error, would appreciate it, because everything is as walkthrough said to do. (IDK if anyone here is in touch with pihole team... they may want to change their wiki if you find a mistake). I had just changed the verb 4 at the very end because pihole team says use verb 3 but your "help request" thread says use 4. After saving this change and restarting the server, I got the other information requests. I guess the verb 3 on line 23 gets ignored with the verb 4 at line 27.
local 192.168.0.19
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-crypt tc.key
topology subnet
server 10.8.0.0 255.255.255.0
server-ipv6 fddd:1194:1194:1194::/64
push "redirect-gateway def1 ipv6 bypass-dhcp"
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 10.8.0.1"
#push "dhcp-option DNS 208.67.222.222"
#push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
verb 3
crl-verify crl.pem
explicit-exit-notify
log /var/log/openvpn.log
verb 4
After restarting at 10:38 I connected my Android via VPN via cell data. I navigated to Yahoo where it timed out. At 10:39 I connected to the youtube app where it was functional.
Immediately after, before 10:39:30 I had turned off my cell data and turned on Wifi. The VPN reconnected. I navigated to Yahoo where it loaded and also the youtube app loaded.
Server log
DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-256-CBC' to --data-ciphers or change --cipher 'AES-256-CBC' to --data-ciphers-fallback 'AES-256-CBC' to silence this warning.
Current Parameter Settings:
config = 'server.conf'
mode = 1
persist_config = DISABLED
persist_mode = 1
show_ciphers = DISABLED
show_digests = DISABLED
show_engines = DISABLED
genkey = DISABLED
genkey_filename = '[UNDEF]'
key_pass_file = '[UNDEF]'
show_tls_ciphers = DISABLED
connect_retry_max = 0
Connection profiles [0]:
proto = udp
local = '192.168.0.19'
local_port = '1194'
remote = '[UNDEF]'
remote_port = '1194'
remote_float = DISABLED
bind_defined = DISABLED
bind_local = ENABLED
bind_ipv6_only = DISABLED
connect_retry_seconds = 5
connect_timeout = 120
socks_proxy_server = '[UNDEF]'
socks_proxy_port = '[UNDEF]'
tun_mtu = 1500
tun_mtu_defined = ENABLED
link_mtu = 1500
link_mtu_defined = DISABLED
tun_mtu_extra = 0
tun_mtu_extra_defined = DISABLED
mtu_discover_type = -1
fragment = 0
mssfix = 1450
explicit_exit_notification = 1
tls_auth_file = '[UNDEF]'
key_direction = not set
tls_crypt_file = '[INLINE]'
tls_crypt_v2_file = '[UNDEF]'
Connection profiles END
remote_random = DISABLED
ipchange = '[UNDEF]'
dev = 'tun'
dev_type = '[UNDEF]'
dev_node = '[UNDEF]'
lladdr = '[UNDEF]'
topology = 3
ifconfig_local = '10.8.0.1'
ifconfig_remote_netmask = '255.255.255.0'
ifconfig_noexec = DISABLED
ifconfig_nowarn = DISABLED
ifconfig_ipv6_local = 'fddd:1194:1194:1194::1'
ifconfig_ipv6_netbits = 64
ifconfig_ipv6_remote = 'fddd:1194:1194:1194::2'
shaper = 0
mtu_test = 0
mlock = DISABLED
keepalive_ping = 10
keepalive_timeout = 120
inactivity_timeout = 0
ping_send_timeout = 10
ping_rec_timeout = 240
ping_rec_timeout_action = 2
ping_timer_remote = DISABLED
remap_sigusr1 = 0
persist_tun = ENABLED
persist_local_ip = DISABLED
persist_remote_ip = DISABLED
persist_key = ENABLED
passtos = DISABLED
resolve_retry_seconds = 1000000000
resolve_in_advance = DISABLED
username = 'nobody'
groupname = 'nogroup'
chroot_dir = '[UNDEF]'
cd_dir = '[UNDEF]'
writepid = '[UNDEF]'
up_script = '[UNDEF]'
down_script = '[UNDEF]'
down_pre = DISABLED
up_restart = DISABLED
up_delay = DISABLED
daemon = DISABLED
inetd = 0
log = ENABLED
suppress_timestamps = ENABLED
machine_readable_output = DISABLED
nice = 0
verbosity = 4
mute = 0
gremlin = 0
status_file = '/run/openvpn-server/status-server.log'
status_file_version = 2
status_file_update_freq = 60
occ = ENABLED
rcvbuf = 0
sndbuf = 0
mark = 0
sockflags = 0
fast_io = DISABLED
comp.alg = 0
comp.flags = 0
route_script = '[UNDEF]'
route_default_gateway = '10.8.0.2'
route_default_metric = 0
route_noexec = DISABLED
route_delay = 0
route_delay_window = 30
route_delay_defined = DISABLED
route_nopull = DISABLED
route_gateway_via_dhcp = DISABLED
allow_pull_fqdn = DISABLED
management_addr = '[UNDEF]'
management_port = '[UNDEF]'
management_user_pass = '[UNDEF]'
management_log_history_cache = 250
management_echo_buffer_size = 100
management_write_peer_info_file = '[UNDEF]'
management_client_user = '[UNDEF]'
management_client_group = '[UNDEF]'
management_flags = 0
shared_secret_file = '[UNDEF]'
key_direction = not set
ciphername = 'AES-256-CBC'
ncp_enabled = ENABLED
ncp_ciphers = 'AES-256-GCM:AES-128-GCM:AES-256-CBC'
authname = 'SHA512'
prng_hash = 'SHA1'
prng_nonce_secret_len = 16
keysize = 0
engine = DISABLED
replay = ENABLED
mute_replay_warnings = DISABLED
replay_window = 64
replay_time = 15
packet_id_file = '[UNDEF]'
test_crypto = DISABLED
tls_server = ENABLED
tls_client = DISABLED
ca_file = 'ca.crt'
ca_path = '[UNDEF]'
dh_file = 'dh.pem'
cert_file = 'server.crt'
extra_certs_file = '[UNDEF]'
priv_key_file = 'server.key'
pkcs12_file = '[UNDEF]'
cipher_list = '[UNDEF]'
cipher_list_tls13 = '[UNDEF]'
tls_cert_profile = '[UNDEF]'
tls_verify = '[UNDEF]'
tls_export_cert = '[UNDEF]'
verify_x509_type = 0
verify_x509_name = '[UNDEF]'
crl_file = 'crl.pem'
ns_cert_type = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_eku = '[UNDEF]'
ssl_flags = 0
tls_timeout = 2
renegotiate_bytes = -1
renegotiate_packets = 0
renegotiate_seconds = 3600
handshake_window = 60
transition_window = 3600
single_session = DISABLED
push_peer_info = DISABLED
tls_exit = DISABLED
tls_crypt_v2_metadata = '[UNDEF]'
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_pin_cache_period = -1
pkcs11_id = '[UNDEF]'
pkcs11_id_management = DISABLED
server_network = 10.8.0.0
server_netmask = 255.255.255.0
server_network_ipv6 = fddd:1194:1194:1194::
server_netbits_ipv6 = 64
server_bridge_ip = 0.0.0.0
server_bridge_netmask = 0.0.0.0
server_bridge_pool_start = 0.0.0.0
server_bridge_pool_end = 0.0.0.0
push_entry = 'redirect-gateway def1 ipv6 bypass-dhcp'
push_entry = 'dhcp-option DNS 10.8.0.1'
push_entry = 'tun-ipv6'
push_entry = 'route-gateway 10.8.0.1'
push_entry = 'topology subnet'
push_entry = 'ping 10'
push_entry = 'ping-restart 120'
ifconfig_pool_defined = ENABLED
ifconfig_pool_start = 10.8.0.2
ifconfig_pool_end = 10.8.0.253
ifconfig_pool_netmask = 255.255.255.0
ifconfig_pool_persist_filename = 'ipp.txt'
ifconfig_pool_persist_refresh_freq = 600
ifconfig_ipv6_pool_defined = ENABLED
ifconfig_ipv6_pool_base = fddd:1194:1194:1194::1000
ifconfig_ipv6_pool_netbits = 64
n_bcast_buf = 256
tcp_queue_limit = 64
real_hash_size = 256
virtual_hash_size = 256
client_connect_script = '[UNDEF]'
learn_address_script = '[UNDEF]'
client_disconnect_script = '[UNDEF]'
client_config_dir = '[UNDEF]'
ccd_exclusive = DISABLED
tmp_dir = '/tmp'
push_ifconfig_defined = DISABLED
push_ifconfig_local = 0.0.0.0
push_ifconfig_remote_netmask = 0.0.0.0
push_ifconfig_ipv6_defined = DISABLED
push_ifconfig_ipv6_local = ::/0
push_ifconfig_ipv6_remote = ::
enable_c2c = DISABLED
duplicate_cn = DISABLED
cf_max = 0
cf_per = 0
max_clients = 1024
max_routes_per_client = 256
auth_user_pass_verify_script = '[UNDEF]'
auth_user_pass_verify_script_via_file = DISABLED
auth_token_generate = DISABLED
auth_token_lifetime = 0
auth_token_secret_file = '[UNDEF]'
port_share_host = '[UNDEF]'
port_share_port = '[UNDEF]'
vlan_tagging = DISABLED
vlan_accept = all
vlan_pvid = 1
client = DISABLED
pull = DISABLED
auth_user_pass_file = '[UNDEF]'
OpenVPN 2.5.1 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on May 14 2021
library versions: OpenSSL 1.1.1k 25 Mar 2021, LZO 2.10
net_route_v4_best_gw query: dst 0.0.0.0
net_route_v4_best_gw result: via 192.168.0.1 dev wlan0
NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Diffie-Hellman initialized with 2048 bit key
CRL: loaded 1 CRLs from file crl.pem
Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
TLS-Auth MTU parms [ L:1621 D:1156 EF:94 EB:0 ET:0 EL:3 ]
TUN/TAP device tun0 opened
do_ifconfig, ipv4=1, ipv6=1
net_iface_mtu_set: mtu 1500 for tun0
net_iface_up: set tun0 up
net_addr_v4_add: 10.8.0.1/24 dev tun0
net_iface_mtu_set: mtu 1500 for tun0
net_iface_up: set tun0 up
net_addr_v6_add: fddd:1194:1194:1194::1/64 dev tun0
Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
Could not determine IPv4/IPv6 protocol. Using AF_INET
Socket Buffers: R=[180224->180224] S=[180224->180224]
UDPv4 link local (bound): [AF_INET]192.168.0.19:1194
UDPv4 link remote: [AF_UNSPEC]
GID set to nogroup
UID set to nobody
MULTI: multi_init called, r=256 v=256
IFCONFIG POOL IPv4: base=10.8.0.2 size=252
IFCONFIG POOL IPv6: base=fddd:1194:1194:1194::1000 size=65536 netbits=64
NOTE: IPv4 pool size is 252, IPv6 pool size is 65536. IPv4 pool size limits the number of clients that can be served from the pool
ifconfig_pool_read(), in='oneplus7,10.8.0.2,fddd:1194:1194:1194::1000'
succeeded -> ifconfig_pool_set(hand=0)
IFCONFIG POOL LIST
oneplus7,10.8.0.2,fddd:1194:1194:1194::1000
Initialization Sequence Completed
MULTI: multi_create_instance called
172.abc.def.ghi:56557 Re-using SSL/TLS context
172.abc.def.ghi:56557 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
172.abc.def.ghi:56557 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
172.abc.def.ghi:56557 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
172.abc.def.ghi:56557 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
172.abc.def.ghi:56557 Control Channel MTU parms [ L:1621 D:1156 EF:94 EB:0 ET:0 EL:3 ]
172.abc.def.ghi:56557 Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
172.abc.def.ghi:56557 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-server'
172.abc.def.ghi:56557 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-client'
172.abc.def.ghi:56557 TLS: Initial packet from [AF_INET]172.abc.def.ghi:56557, sid=71a0b65e 6cc2c4fe
172.abc.def.ghi:56557 VERIFY OK: depth=1, CN=ChangeMe
172.abc.def.ghi:56557 VERIFY OK: depth=0, CN=oneplus7
172.abc.def.ghi:56557 peer info: IV_VER=3.git::662eae9a:Release
172.abc.def.ghi:56557 peer info: IV_PLAT=android
172.abc.def.ghi:56557 peer info: IV_NCP=2
172.abc.def.ghi:56557 peer info: IV_TCPNL=1
172.abc.def.ghi:56557 peer info: IV_PROTO=2
172.abc.def.ghi:56557 peer info: IV_IPv6=0
172.abc.def.ghi:56557 peer info: IV_AUTO_SESS=1
172.abc.def.ghi:56557 peer info: IV_GUI_VER=net.openvpn.connect.android_3.2.5-7182
172.abc.def.ghi:56557 peer info: IV_SSO=openurl
172.abc.def.ghi:56557 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
172.abc.def.ghi:56557 [oneplus7] Peer Connection Initiated with [AF_INET]172.abc.def.ghi:56557
oneplus7/172.abc.def.ghi:56557 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=fddd:1194:1194:1194::1000
oneplus7/172.abc.def.ghi:56557 MULTI: Learn: 10.8.0.2 -> oneplus7/172.abc.def.ghi:56557
oneplus7/172.abc.def.ghi:56557 MULTI: primary virtual IP for oneplus7/172.abc.def.ghi:56557: 10.8.0.2
oneplus7/172.abc.def.ghi:56557 MULTI: Learn: fddd:1194:1194:1194::1000 -> oneplus7/172.abc.def.ghi:56557
oneplus7/172.abc.def.ghi:56557 MULTI: primary virtual IPv6 for oneplus7/172.abc.def.ghi:56557: fddd:1194:1194:1194::1000
oneplus7/172.abc.def.ghi:56557 Data Channel: using negotiated cipher 'AES-256-GCM'
oneplus7/172.abc.def.ghi:56557 Data Channel MTU parms [ L:1549 D:1450 EF:49 EB:406 ET:0 EL:3 ]
oneplus7/172.abc.def.ghi:56557 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
oneplus7/172.abc.def.ghi:56557 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
oneplus7/172.abc.def.ghi:56557 PUSH: Received control message: 'PUSH_REQUEST'
oneplus7/172.abc.def.ghi:56557 SENT CONTROL [oneplus7]: 'PUSH_REPLY,redirect-gateway def1 ipv6 bypass-dhcp,dhcp-option DNS 10.8.0.1,tun-ipv6,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig-ipv6 fddd:1194:1194:1194::1000/64 fddd:1194:1194:1194::1,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
oneplus7/172.abc.def.ghi:56557 MULTI: bad source address from client [::], packet dropped
oneplus7/172.abc.def.ghi:56557 MULTI: bad source address from client [::], packet dropped
oneplus7/172.abc.def.ghi:56557 MULTI: bad source address from client [::], packet dropped
MULTI: multi_create_instance called
24.rst.uvw.xyz:40626 Re-using SSL/TLS context
24.rst.uvw.xyz:40626 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
24.rst.uvw.xyz:40626 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
24.rst.uvw.xyz:40626 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
24.rst.uvw.xyz:40626 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
24.rst.uvw.xyz:40626 Control Channel MTU parms [ L:1621 D:1156 EF:94 EB:0 ET:0 EL:3 ]
24.rst.uvw.xyz:40626 Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
24.rst.uvw.xyz:40626 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-server'
24.rst.uvw.xyz:40626 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-client'
24.rst.uvw.xyz:40626 TLS: Initial packet from [AF_INET]24.rst.uvw.xyz:40626, sid=2182942b 2930e8bf
24.rst.uvw.xyz:40626 VERIFY OK: depth=1, CN=ChangeMe
24.rst.uvw.xyz:40626 VERIFY OK: depth=0, CN=oneplus7
24.rst.uvw.xyz:40626 peer info: IV_VER=3.git::662eae9a:Release
24.rst.uvw.xyz:40626 peer info: IV_PLAT=android
24.rst.uvw.xyz:40626 peer info: IV_NCP=2
24.rst.uvw.xyz:40626 peer info: IV_TCPNL=1
24.rst.uvw.xyz:40626 peer info: IV_PROTO=2
24.rst.uvw.xyz:40626 peer info: IV_IPv6=0
24.rst.uvw.xyz:40626 peer info: IV_AUTO_SESS=1
24.rst.uvw.xyz:40626 peer info: IV_GUI_VER=net.openvpn.connect.android_3.2.5-7182
24.rst.uvw.xyz:40626 peer info: IV_SSO=openurl
24.rst.uvw.xyz:40626 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
24.rst.uvw.xyz:40626 [oneplus7] Peer Connection Initiated with [AF_INET]24.rst.uvw.xyz:40626
MULTI: new connection by client 'oneplus7' will cause previous active sessions by this client to be dropped. Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=fddd:1194:1194:1194::1000
MULTI: Learn: 10.8.0.2 -> oneplus7/24.rst.uvw.xyz:40626
MULTI: primary virtual IP for oneplus7/24.rst.uvw.xyz:40626: 10.8.0.2
MULTI: Learn: fddd:1194:1194:1194::1000 -> oneplus7/24.rst.uvw.xyz:40626
MULTI: primary virtual IPv6 for oneplus7/24.rst.uvw.xyz:40626: fddd:1194:1194:1194::1000
Data Channel: using negotiated cipher 'AES-256-GCM'
Data Channel MTU parms [ L:1549 D:1450 EF:49 EB:406 ET:0 EL:3 ]
Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
oneplus7/24.rst.uvw.xyz:40626 PUSH: Received control message: 'PUSH_REQUEST'
oneplus7/24.rst.uvw.xyz:40626 SENT CONTROL [oneplus7]: 'PUSH_REPLY,redirect-gateway def1 ipv6 bypass-dhcp,dhcp-option DNS 10.8.0.1,tun-ipv6,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig-ipv6 fddd:1194:1194:1194::1000/64 fddd:1194:1194:1194::1,ifconfig 10.8.0.2 255.255.255.0,peer-id 1,cipher AES-256-GCM' (status=1)
Client configuration...
OpenVPN on Android lacks this.. I guess I tell you the different settings?
Battery Saver = Off
Reconnect on Reboot = Off
Seamless Tunnel = On
VPN Protocol = UDP
IPv6 = IPV4-Only Tunnel (I've tried also "No Preference" and "Combined IPV4/IPV6 Tunnel with no change in functionality)
Connection Timeout = Continuously Retry
Allow Compression (insecure) = No
AES-CBC Cipher Algorithm = Off
Minimum TLS Version = TLS 1.1 (was at profile default, no change in functionality when I modified that)
DNS Fallback = Off
Shortcut Minimize = Yes
Notifications = Off (don't show them as toast messages)
Theme = Default
Seems a weird way to ask for the ovpn file, but I'll put it in here because odds are I'm going to retract the certificate anyway after all is said and done
client
dev tun
proto udp
remote 24.rst.uvw.xyz 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
ignore-unknown-option block-outside-dns
block-outside-dns
verb 3
<ca>
<retracted the rest>
10:38:04.444 -- ----- OpenVPN Start -----
10:38:04.444 -- EVENT: CORE_THREAD_ACTIVE
10:38:04.446 -- OpenVPN core 3.git::662eae9a:Release android arm64 64-bit PT_PROXY
10:38:04.446 -- Frame=512/2048/512 mssfix-ctrl=1250
10:38:04.447 -- UNUSED OPTIONS
4 [resolv-retry] [infinite]
5 [nobind]
6 [persist-key]
7 [persist-tun]
11 [ignore-unknown-option] [block-outside-dns]
12 [block-outside-dns]
13 [verb] [3]
10:38:04.447 -- EVENT: RESOLVE
10:38:04.451 -- Contacting 24.rst.uvw.xyz:1194 via UDP
10:38:04.451 -- EVENT: WAIT
10:38:04.453 -- Connecting to [24.rst.uvw.xyz]:1194 (24.rst.uvw.xyz) via UDPv4
10:38:04.548 -- EVENT: CONNECTING
10:38:04.551 -- Tunnel Options:V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-client
10:38:04.551 -- Creds: UsernameEmpty/PasswordEmpty
10:38:04.551 -- Peer Info:
IV_VER=3.git::662eae9a:Release
IV_PLAT=android
IV_NCP=2
IV_TCPNL=1
IV_PROTO=2
IV_IPv6=0
IV_AUTO_SESS=1
IV_GUI_VER=net.openvpn.connect.android_3.2.5-7182
IV_SSO=openurl
10:38:04.725 -- VERIFY OK: depth=1, /CN=ChangeMe
10:38:04.725 -- VERIFY OK: depth=0, /CN=server
10:38:04.842 -- SSL Handshake: CN=server, TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
10:38:04.842 -- Session is ACTIVE
10:38:04.843 -- EVENT: GET_CONFIG
10:38:04.845 -- Sending PUSH_REQUEST to server...
10:38:04.948 -- OPTIONS:
0 [redirect-gateway] [def1] [ipv6] [bypass-dhcp]
1 [dhcp-option] [DNS] [10.8.0.1]
2 [tun-ipv6]
3 [route-gateway] [10.8.0.1]
4 [topology] [subnet]
5 [ping] [10]
6 [ping-restart] [120]
7 [ifconfig-ipv6] [fddd:1194:1194:1194::1000/64] [fddd:1194:1194:1194::1]
8 [ifconfig] [10.8.0.2] [255.255.255.0]
9 [peer-id] [0]
10 [cipher] [AES-256-GCM]
11 [block-ipv6]
10:38:04.949 -- PROTOCOL OPTIONS:
cipher: AES-256-GCM
digest: NONE
compress: NONE
peer ID: 0
10:38:04.949 -- EVENT: ASSIGN_IP
10:38:04.970 -- TunPersist: saving tun context:
Session Name: 24.rst.uvw.xyz
Layer: OSI_LAYER_3
Remote Address: 24.rst.uvw.xyz
Tunnel Addresses:
10.8.0.2/24 -> 10.8.0.1
fddd:1194:1194:1194::1000/64 -> fddd:1194:1194:1194::1 [IPv6]
Reroute Gateway: IPv4=1 IPv6=1 flags=[ ENABLE REROUTE_GW DEF1 BYPASS_DHCP IPv4 IPv6 ]
Block IPv6: yes
Add Routes:
Exclude Routes:
DNS Servers:
10.8.0.1
Search Domains:
10:38:04.970 -- Connected via tun
10:38:04.970 -- EVENT: CONNECTED info='24.rst.uvw.xyz:1194 (24.rst.uvw.xyz) via /UDPv4 on tun/10.8.0.2/fddd:1194:1194:1194::1000 gw=[10.8.0.1/fddd:1194:1194:1194::1]'
10:39:12.660 -- EVENT: PAUSE
10:39:15.333 -- EVENT: RESUME
10:39:15.340 -- EVENT: RECONNECTING
10:39:15.341 -- Contacting 24.rst.uvw.xyz:1194 via UDP
10:39:15.341 -- EVENT: WAIT
10:39:15.345 -- Connecting to [24.rst.uvw.xyz]:1194 (24.rst.uvw.xyz) via UDPv4
10:39:15.594 -- EVENT: CONNECTING
10:39:15.598 -- Tunnel Options:V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-client
10:39:15.598 -- Creds: UsernameEmpty/PasswordEmpty
10:39:15.600 -- Peer Info:
IV_VER=3.git::662eae9a:Release
IV_PLAT=android
IV_NCP=2
IV_TCPNL=1
IV_PROTO=2
IV_IPv6=0
IV_AUTO_SESS=1
IV_GUI_VER=net.openvpn.connect.android_3.2.5-7182
IV_SSO=openurl
10:39:15.671 -- VERIFY OK: depth=1, /CN=ChangeMe
10:39:15.672 -- VERIFY OK: depth=0, /CN=server
10:39:15.698 -- SSL Handshake: CN=server, TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
10:39:15.699 -- Session is ACTIVE
10:39:15.699 -- EVENT: GET_CONFIG
10:39:15.701 -- Sending PUSH_REQUEST to server...
10:39:15.711 -- OPTIONS:
0 [redirect-gateway] [def1] [ipv6] [bypass-dhcp]
1 [dhcp-option] [DNS] [10.8.0.1]
2 [tun-ipv6]
3 [route-gateway] [10.8.0.1]
4 [topology] [subnet]
5 [ping] [10]
6 [ping-restart] [120]
7 [ifconfig-ipv6] [fddd:1194:1194:1194::1000/64] [fddd:1194:1194:1194::1]
8 [ifconfig] [10.8.0.2] [255.255.255.0]
9 [peer-id] [1]
10 [cipher] [AES-256-GCM]
11 [block-ipv6]
10:39:15.711 -- PROTOCOL OPTIONS:
cipher: AES-256-GCM
digest: NONE
compress: NONE
peer ID: 1
10:39:15.711 -- TunPersist: reused tun context
10:39:15.712 -- Connected via tun
10:39:15.712 -- EVENT: CONNECTED info='24.rst.uvw.xyz:1194 (24.rst.uvw.xyz) via /UDPv4 on tun/10.8.0.2/fddd:1194:1194:1194::1000 gw=[10.8.0.1/fddd:1194:1194:1194::1]'
I realize the .opvn file had verb 3 in there, so this may not get you all the details you need for a good diagnosis. I couldn't see a way to edit that in the android client itself.
If anyone sees why a 5G/LTE connection via T-Mobile can't access Yahoo via VPN but it can access YouTube App via VPN, and can do both via VPN on Wifi, I'd love to know. There seems to be no rhyme or reason. It's the same client, same server, just a different requesting IP address.
