0

An OpenVPN server is running on a Raspberry Pi with Raspbian GNU Linux 8. The wlan0 interface of the Pi is associated with ip address 192.168.1.12. The Pi has internet access over wlan0 via gateway 192.168.1.1. The Pi is also equipped with an ethernet adapter eth0 with ip address 192.168.2.2. In order to expose the internet connection to the computers connected via VPN, I did

sudo iptables -t nat -A POSTROUTING -o wlan0 -s 10.8.0.0/24 -j MASQUERADE

I start the VPN server for testing purposes over the command line with

/usr/sbin/openvpn --writepid /run/whatever --cd /etc/openvpn/ --config openvpn.conf

Another Windows 8.1 machine has the OpenVPN Client version 2.3.11 installed and can access the Pi over both the wlan0 and the eth0 interface. The connection to the OpenVPN server from the Windows machine can be successfully established over both interfaces.

The problem: If the Windows machine connects to the VPN server via the eth0 interface, the internet is accessible. However, when changing the server ip in the client configuration to that of the wlan0 interface of the Pi, the internet does not work anymore. I tried to disable the firewall ZoneAlarm on the client computer and to flush all iptables on the Pi (except the POSTROUTING directive), without success. The OpenVPN log file (verbose level 9) shows

Sun Jul 31 18:21:58 2016 us=515039 ux32/192.168.1.11:53346 STATE S_NORMAL_OP
Sun Jul 31 18:21:58 2016 us=515133 ux32/192.168.1.11:53346 ACK 
reliable_can_send active=0 current=0 : [46]
Sun Jul 31 18:21:58 2016 us=515267 ux32/192.168.1.11:53346 ACK reliable_send_timeout 604800 [46]
Sun Jul 31 18:21:58 2016 us=515356 ux32/192.168.1.11:53346 TLS: tls_process: timeout set to 1096
Sun Jul 31 18:21:58 2016 us=515485 ux32/192.168.1.11:53346 TLS: tls_multi_process: i=1 state=S_INITIAL, mysid=8f6b297a 6d672983, stored-sid=00000000 00000000, stored-ip=[undef]
Sun Jul 31 18:21:58 2016 us=515616 ux32/192.168.1.11:53346 TLS: tls_multi_process: i=2 state=S_UNDEF, mysid=00000000 00000000, stored-sid=00000000 00000000, stored-ip=[undef]
Sun Jul 31 18:21:58 2016 us=515754 ux32/192.168.1.11:53346 RANDOM USEC=152453
Sun Jul 31 18:21:58 2016 us=515886 ux32/192.168.1.11:53346 SCHEDULE: schedule_add_modify wakeup=[Sun Jul 31 18:22:14 2016 us=102908] pri=1004941034
Sun Jul 31 18:21:58 2016 us=515977 MULTI TCP: multi_tcp_post TA_TIMEOUT -> TA_UNDEF
Sun Jul 31 18:21:58 2016 us=516098 SCHEDULE: schedule_find_least wakeup=[Sun Jul 31 18:22:14 2016 us=102908] pri=158513910

Here the OpenVPN server configuration:

dev tun
proto tcp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
user nobody
group nogroup
server 10.8.0.0 255.255.255.0
push "route 10.8.0.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
push "route 0.0.0.0 0.0.0.0"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option WINS 208.67.220.220"
client-to-client
status /var/log/openvpn-status.log
log-append /var/log/openvpn
persist-key
persist-tun
verb 9

And the OpenVPN client configuration:

dev tun
client
proto tcp
remote 192.168.1.12 1194 [no inet] / 192.168.2.2 1194 [inet]
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert ux32.crt
key ux32.key
verb 3

The only change between the working and not working configuration is the change of the server ip address via remote.

The routing table on the client computer:

IPv4-Routentabelle
===========================================================================
Aktive Routen:
     Netzwerkziel    Netzwerkmaske          Gateway    Schnittstelle Metrik
          0.0.0.0          0.0.0.0      192.168.1.1     192.168.1.11    281
          0.0.0.0          0.0.0.0         10.8.0.5         10.8.0.6     20
          0.0.0.0        128.0.0.0         10.8.0.5         10.8.0.6     20
         10.8.0.0    255.255.255.0         10.8.0.5         10.8.0.6     20
         10.8.0.4  255.255.255.252   Auf Verbindung          10.8.0.6    276
         10.8.0.6  255.255.255.255   Auf Verbindung          10.8.0.6    276
         10.8.0.7  255.255.255.255   Auf Verbindung          10.8.0.6    276
        127.0.0.0        255.0.0.0   Auf Verbindung         127.0.0.1    306
        127.0.0.1  255.255.255.255   Auf Verbindung         127.0.0.1    306
  127.255.255.255  255.255.255.255   Auf Verbindung         127.0.0.1    306
        128.0.0.0        128.0.0.0         10.8.0.5         10.8.0.6     20
      169.254.0.0      255.255.0.0   Auf Verbindung      192.168.1.11    306
      169.254.0.0      255.255.0.0   Auf Verbindung     192.168.195.1    306
      169.254.0.0      255.255.0.0   Auf Verbindung     192.168.235.1    306
  169.254.255.255  255.255.255.255   Auf Verbindung      192.168.1.11    281
  169.254.255.255  255.255.255.255   Auf Verbindung     192.168.195.1    276
  169.254.255.255  255.255.255.255   Auf Verbindung     192.168.235.1    276
      192.168.1.0    255.255.255.0   Auf Verbindung      192.168.1.11    281
     192.168.1.11  255.255.255.255   Auf Verbindung      192.168.1.11    281
     192.168.1.12  255.255.255.255      192.168.1.1     192.168.1.11     25
    192.168.1.255  255.255.255.255   Auf Verbindung      192.168.1.11    281
    192.168.195.0    255.255.255.0   Auf Verbindung     192.168.195.1    276
    192.168.195.1  255.255.255.255   Auf Verbindung     192.168.195.1    276
  192.168.195.255  255.255.255.255   Auf Verbindung     192.168.195.1    276
    192.168.235.0    255.255.255.0   Auf Verbindung     192.168.235.1    276
    192.168.235.1  255.255.255.255   Auf Verbindung     192.168.235.1    276
  192.168.235.255  255.255.255.255   Auf Verbindung     192.168.235.1    276
        224.0.0.0        240.0.0.0   Auf Verbindung         127.0.0.1    306
        224.0.0.0        240.0.0.0   Auf Verbindung          10.8.0.6    276
        224.0.0.0        240.0.0.0   Auf Verbindung     192.168.195.1    276
        224.0.0.0        240.0.0.0   Auf Verbindung     192.168.235.1    276
        224.0.0.0        240.0.0.0   Auf Verbindung      192.168.1.11    281
  255.255.255.255  255.255.255.255   Auf Verbindung         127.0.0.1    306
  255.255.255.255  255.255.255.255   Auf Verbindung          10.8.0.6    276
  255.255.255.255  255.255.255.255   Auf Verbindung     192.168.195.1    276
  255.255.255.255  255.255.255.255   Auf Verbindung     192.168.235.1    276
  255.255.255.255  255.255.255.255   Auf Verbindung      192.168.1.11    281
===========================================================================

Let me know if any other information is relevant to solve the problem. I am thankful for any advice.

  • Have you used an appropriately modified iptables rule (similar to the one you displayed) also for connections via eth0? – MariusMatutiae Aug 2 '16 at 8:16
  • No. There is no access to the internet over eth0, so to my understanding no reason to apply this POSTROUTING rule for eth0. – Georg Schnabel Aug 2 '16 at 8:22
  • Can you try by commenting out the server directive pushroute 0.0.0.0 0.0.0.0pushroute 0.0.0.0 0.0.0.0push "route 0.0.0.0 0.0.0.0"? Also, why do you push the route of the VPN, 10.8.0.0/24? There is no need for that. – MariusMatutiae Aug 2 '16 at 9:28
  • I am unable to replicate your problem. I have copied your configurations (I also own a Raspberry Pi) and everything works just fine, either via cable or via wifi. The only thing I can think of is: when you tried the wifi connection, did you detach the ethernet cable from the Windows pc? You should have. – MariusMatutiae Aug 2 '16 at 9:33
  • Thanks for your help. I am not at home now. I will try detaching the ethernet cable in the evening. – Georg Schnabel Aug 2 '16 at 9:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.