Can Connect to VPN Bridge But No Internet Access [Raspberry Pi]

Need help configuring your VPN? Just post here and you'll get that help.

Moderators: TinCanTech, TinCanTech, TinCanTech, TinCanTech, TinCanTech, TinCanTech

Forum rules
Please use the [oconf] BB tag for openvpn Configurations. See viewtopic.php?f=30&t=21589 for an example.
Post Reply
zadiste
OpenVpn Newbie
Posts: 3
Joined: Wed Oct 09, 2019 12:57 am

Can Connect to VPN Bridge But No Internet Access [Raspberry Pi]

Post by zadiste » Wed Oct 09, 2019 1:13 am

I've been trying to set up an ethernet bridge with openvpn on my raspberry pi. I was able to get tunneling to work no problem, but have had trouble with the bridged connection. I followed tutorials like https://openvpn.net/community-resources ... -bridging/ and https://www.aaflalo.me/2015/01/openvpn-tap-bridge-mode/. The bridge and openvpn run fine on the pi and I am still connected to the internet. Based on the feedback, the client seems to connect okay, but then I lose all internet connection on the client end.

I looked around at other tutorials and couldn't find any glaring differences between my setup and others. Any suggestions on fixes or places to look would be greatly appreciated! Here are my conf files and other relevant data:

Client feedback

Code: Select all

Tue Oct  8 20:47:41 2019 OpenVPN 2.4.7 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Aug 20 2019
Tue Oct  8 20:47:41 2019 library versions: OpenSSL 1.1.1d  10 Sep 2019, LZO 2.10
Tue Oct  8 20:47:41 2019 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Tue Oct  8 20:47:41 2019 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Tue Oct  8 20:47:41 2019 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Tue Oct  8 20:47:41 2019 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Tue Oct  8 20:47:41 2019 TCP/UDP: Preserving recently used remote address: [AF_INET]198.255.203.119:1194
Tue Oct  8 20:47:41 2019 Socket Buffers: R=[212992->212992] S=[212992->212992]
Tue Oct  8 20:47:41 2019 UDP link local: (not bound)
Tue Oct  8 20:47:41 2019 UDP link remote: [AF_INET]198.255.203.119:1194
Tue Oct  8 20:47:41 2019 TLS: Initial packet from [AF_INET]198.255.203.119:1194, sid=2d4f48fa c8fcb214
Tue Oct  8 20:47:42 2019 VERIFY OK: depth=1, CN=ChangeMe
Tue Oct  8 20:47:42 2019 VERIFY KU OK
Tue Oct  8 20:47:42 2019 Validating certificate extended key usage
Tue Oct  8 20:47:42 2019 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Oct  8 20:47:42 2019 VERIFY EKU OK
Tue Oct  8 20:47:42 2019 VERIFY X509NAME OK: CN=raspberrypi_4ede9bf6-dba2-4462-b373-ca3496eb4e1f
Tue Oct  8 20:47:42 2019 VERIFY OK: depth=0, CN=raspberrypi_4ede9bf6-dba2-4462-b373-ca3496eb4e1f
Tue Oct  8 20:47:42 2019 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 256 bit EC, curve: prime256v1
Tue Oct  8 20:47:42 2019 [raspberrypi_4ede9bf6-dba2-4462-b373-ca3496eb4e1f] Peer Connection Initiated with [AF_INET]198.255.203.119:1194
Tue Oct  8 20:47:43 2019 SENT CONTROL [raspberrypi_4ede9bf6-dba2-4462-b373-ca3496eb4e1f]: 'PUSH_REQUEST' (status=1)
Tue Oct  8 20:47:43 2019 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 192.168.0.1,redirect-gateway def1,route-gateway 192.168.0.229,ping 10,ping-restart 120,ifconfig 192.168.0.128 255.255.255.0,peer-id 0,cipher AES-256-GCM'
Tue Oct  8 20:47:43 2019 OPTIONS IMPORT: timers and/or timeouts modified
Tue Oct  8 20:47:43 2019 OPTIONS IMPORT: --ifconfig/up options modified
Tue Oct  8 20:47:43 2019 OPTIONS IMPORT: route options modified
Tue Oct  8 20:47:43 2019 OPTIONS IMPORT: route-related options modified
Tue Oct  8 20:47:43 2019 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Oct  8 20:47:43 2019 OPTIONS IMPORT: peer-id set
Tue Oct  8 20:47:43 2019 OPTIONS IMPORT: adjusting link_mtu to 1657
Tue Oct  8 20:47:43 2019 OPTIONS IMPORT: data channel crypto options modified
Tue Oct  8 20:47:43 2019 Data Channel: using negotiated cipher 'AES-256-GCM'
Tue Oct  8 20:47:43 2019 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Oct  8 20:47:43 2019 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Oct  8 20:47:43 2019 ROUTE_GATEWAY 192.168.0.1/255.255.255.0 IFACE=wlp3s0 HWADDR=4c:bb:58:fc:35:e1
Tue Oct  8 20:47:43 2019 TUN/TAP device tap0 opened
Tue Oct  8 20:47:43 2019 TUN/TAP TX queue length set to 100
Tue Oct  8 20:47:43 2019 /usr/sbin/ifconfig tap0 192.168.0.128 netmask 255.255.255.0 mtu 1500 broadcast 192.168.0.255
Tue Oct  8 20:47:43 2019 /usr/sbin/route add -net 198.255.203.119 netmask 255.255.255.255 gw 192.168.0.1
Tue Oct  8 20:47:43 2019 /usr/sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 192.168.0.229
Tue Oct  8 20:47:43 2019 /usr/sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 192.168.0.229
Tue Oct  8 20:47:43 2019 Initialization Sequence Completed
Server.conf
dev tap0
proto udp
port 1194
ca /etc/openvpn/easy-rsa/pki/ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/raspberrypi_4ede9bf6-dba2-4462-b373-ca3496eb4e1f.crt
key /etc/openvpn/easy-rsa/pki/private/raspberrypi_4ede9bf6-dba2-4462-b373-ca3496eb4e1f.key
dh none
topology subnet
server-bridge 192.168.0.229 255.255.255.0 192.168.0.128 192.168.0.254

mssfix

# Prevent DNS leaks on Windows
push "block-outside-dns"

push "dhcp-option DNS 192.168.0.1"

# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
keepalive 10 120
mute 50
remote-cert-tls client
tls-version-min 1.2
tls-crypt /etc/openvpn/easy-rsa/pki/ta.key
cipher AES-256-CBC
auth SHA256
user nobody
group nogroup
persist-key
persist-tun
crl-verify /etc/openvpn/crl.pem
status /var/log/openvpn-status.log 20
status-version 3
syslog
compress lz4-v2


Client.ovpn
dev tap0
proto udp
remote hostname.net 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
tls-version-min 1.2
verify-x509-name raspberrypi_4ede9bf6-dba2-4462-b373-ca3496eb4e1f name
cipher AES-256-CBC
auth SHA256
auth-nocache
compress lz4-v2
verb 3
pull
<ca>
...
</ca>
<cert>
...
</cert>
<key>
...
</key>
<tls-crypt>
...
</tls-crypt>


ifconfig (client-side)

Code: Select all

enp2s0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        ether f8:32:e4:e6:91:ee  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 22  bytes 3036 (2.9 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 22  bytes 3036 (2.9 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

tap0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.0.128  netmask 255.255.255.0  broadcast 192.168.0.255
        inet6 fe80::ec0b:ffff:fe8c:5dc9  prefixlen 64  scopeid 0x20<link>
        ether ee:0b:ff:8c:5d:c9  txqueuelen 100  (Ethernet)
        RX packets 20  bytes 2667 (2.6 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 18  bytes 1124 (1.0 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlp3s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.0.150  netmask 255.255.255.0  broadcast 192.168.0.255
        inet6 fe80::2893:d220:a6f7:795f  prefixlen 64  scopeid 0x20<link>
        ether 4c:bb:58:fc:35:e1  txqueuelen 1000  (Ethernet)
        RX packets 243  bytes 60067 (58.6 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 50  bytes 7775 (7.5 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
ifconfig (server-side)

Code: Select all

br0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.0.229  netmask 255.255.255.0  broadcast 192.168.0.255
        inet6 fe80::ba27:ebff:fe29:a3f5  prefixlen 64  scopeid 0x20<link>
        ether b8:27:eb:29:a3:f5  txqueuelen 1000  (Ethernet)
        RX packets 36  bytes 2843 (2.7 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 48  bytes 5883 (5.7 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

eth0: flags=4419<UP,BROADCAST,RUNNING,PROMISC,MULTICAST>  mtu 1500
        ether b8:27:eb:29:a3:f5  txqueuelen 1000  (Ethernet)
        RX packets 620  bytes 170028 (166.0 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 498  bytes 62420 (60.9 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

tap0: flags=4355<UP,BROADCAST,PROMISC,MULTICAST>  mtu 1500
        ether fa:11:12:21:74:1d  txqueuelen 100  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
bridge-conf

Code: Select all

#!/bin/bash

# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="eth0"
eth_ip="192.168.0.229"
eth_netmask="255.255.255.0"
eth_broadcast="192.168.0.255"
eth_gateway="192.168.0.1"
eth_mac="b8:27:eb:29:a3:f5"


# Define Bridge Interface
br="br0"

# Define list of TAP interfaces to be bridged together
tap="tap0"
bridge-start

Code: Select all

#!/bin/bash

. /etc/openvpn/bridge/bridge-conf 
#################################
# Set up Ethernet bridge on Linux
# Requires: bridge-utils
#################################

for t in $tap; do
    openvpn --mktun --dev $t
done

brctl addbr $br
brctl addif $br $eth

for t in $tap; do
    brctl addif $br $t
done

for t in $tap; do
    ifconfig $t 0.0.0.0 promisc up
    iptables -A INPUT -i $t -j ACCEPT
done

iptables -A INPUT -i $br -j ACCEPT
iptables -A FORWARD -i $br -j ACCEPT

ifconfig $eth 0.0.0.0 promisc up

ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast
ip link set $br address $eth_mac
route add default gw $eth_gateway $br
bridge-stop

Code: Select all

#!/bin/bash

. /etc/openvpn/bridge/bridge-conf
####################################
# Tear Down Ethernet bridge on Linux
####################################


iptables -D INPUT -i $br -j ACCEPT
iptables -D FORWARD -i $br -j ACCEPT

ifconfig $br down
brctl delbr $br

for t in $tap; do
    openvpn --rmtun --dev $t
    iptables -D INPUT -i $t -j ACCEPT
done

ifconfig $eth $eth_ip netmask $eth_netmask broadcast $eth_broadcast

zadiste
OpenVpn Newbie
Posts: 3
Joined: Wed Oct 09, 2019 12:57 am

Re: Can Connect to VPN Bridge But No Internet Access [Raspberry Pi]

Post by zadiste » Thu Oct 10, 2019 8:06 pm

I've been trying to troubleshoot this issue with tcpdump. I noticed that everything works if I use the internal ip (192.168.0.229) of the vpn server to connect with from my client while on my home network, but I'm still facing the same issue when I try to connect to the external ip. There is no firewall, ip forwarding is enabled, and I made a port forwarding rule for the server. I'm not sure how to interpret the info I got from tcpdump:

Code: Select all

15:59:39.689814  In 4c:bb:58:fc:35:e1 ethertype IPv4 (0x0800), length 100: 192.168.0.150 > 192.168.0.229: ICMP echo request, id 10092, seq 29, length 64
15:59:39.689846  In 4c:bb:58:fc:35:e1 ethertype IPv4 (0x0800), length 100: 192.168.0.150 > 192.168.0.229: ICMP echo request, id 10092, seq 29, length 64
15:59:39.689920 Out b8:27:eb:29:a3:f5 ethertype IPv4 (0x0800), length 100: 192.168.0.229 > 192.168.0.150: ICMP echo reply, id 10092, seq 29, length 64
15:59:39.689945 Out b8:27:eb:29:a3:f5 ethertype IPv4 (0x0800), length 100: 192.168.0.229 > 192.168.0.150: ICMP echo reply, id 10092, seq 29, length 64
Any help is really appreciated!

zadiste
OpenVpn Newbie
Posts: 3
Joined: Wed Oct 09, 2019 12:57 am

Re: Can Connect to VPN Bridge But No Internet Access [Raspberry Pi]

Post by zadiste » Fri Oct 11, 2019 1:41 am

Nevermind! I guess testing the vpn from my home network wasn't the best idea. Once outside of it, everything worked pretty good.

I suppose this can be marked as [solved].

TinCanTech
OpenVPN Protagonist
Posts: 11137
Joined: Fri Jun 03, 2016 1:17 pm

Re: Can Connect to VPN Bridge But No Internet Access [Raspberry Pi]

Post by TinCanTech » Fri Oct 11, 2019 2:45 pm

Thanks for letting us know your solution 8-)

Connecting to a bridged VPN from the same LAN would indeed cause strange behaviour.

Post Reply