0

I know this has been asked and answered many times, but i just can't make it work: I have a raspberry pi as an stunnel and openvpn server and an ubuntu client but although the connections seem correct, whenever I use the VPN all my internet is lost in the client side. Through lots of searching and reading this seem to be a routing problem, but I can't figure out where (the raspberry pi is located in 193.168.2.31 with ipv4 forwarding enabled, with public ip fake.ddns.net). The config files are as follows:

server stunnel:

foreground=yes
chroot = /var/lib/stunnel4
pid = /stunnel4.pid
setuid = stunnel4
setgid = stunnel4
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
cert = /etc/stunnel/stunnel.pem
[openvpn]
accept = 443
connect = localhost:1194
cert = /etc/stunnel/stunnel.pem

server openvpn:

port 1194
proto tcp
dev tun
sndbuf 0
rcvbuf 0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-auth ta.key 0
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "192.168.2.31 255.255.255.255 net_gateway"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem

client stunnel:

foreground = yes
[openvpn]
client = yes  
accept = 1194
connect = fake.ddns.net:443
cert = stunnel.pem

client openvpn

client
dev tun
proto tcp
sndbuf 0
rcvbuf 0
remote localhost 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
setenv opt block-outside-dns
key-direction 1
verb 3
<ca>...</ca>
<cert>...</cert>
<key>...</key>
<tls-auth>...</tls-auth>

It may be worth noting that I also have privoxy installed on the raspberry pi and when I use just stunnel (other configs, better explained here) everything works just fine

Thanks for the patience!!

As suggested by @Andy, here is the output of ip route show:

0.0.0.0/1 via 10.8.0.1 dev tun0 default via 192.168.2.1 dev wlp2s0 proto dhcp metric 600 10.8.0.0/24 dev tun0 proto kernel scope link src 10.8.0.2 127.0.0.1 via 192.168.2.1 dev wlp2s0 128.0.0.0/1 via 10.8.0.1 dev tun0 169.254.0.0/16 dev wlp2s0 scope link metric 1000 192.168.2.0/24 dev wlp2s0 proto kernel scope link src 192.168.2.100 metric 600 192.168.2.31 dev wlp2s0 scope link

  • Can you run route print (Windows) or ip route show (Linux) on your client? I think you are missing a push "route 0.0.0.0 0.0.0.0 192.168.2.31 1" on your server config. – Andy Feb 28 at 18:23
  • Hi, Andy. Thanks for your quick response. I updated my questions to show the output for my ubuntu client. – javier Mar 2 at 1:02
  • You have the routes, so, no, you werent missing a route push command. – Andy Mar 2 at 7:04
0

finally "brute forced" the answer, randomly adding or removing config parameters although biased to routing issues. I changed the route 192.168.2.31 255.255.255.255 net_gateway from server to client and now it works. So, now the openvpn configs are as follows:

server openvpn:

port 1194
proto tcp
dev tun
sndbuf 0
rcvbuf 0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-auth ta.key 0
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem

client openvpn

client
dev tun
proto tcp
sndbuf 0
rcvbuf 0
remote localhost 1194
route fake.ddns.net 255.255.255.255 net_gateway
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
setenv opt block-outside-dns
key-direction 1
verb 3
<ca>...</ca>
<cert>...</cert>
<key>...</key>
<tls-auth>...</tls-auth>

I have no idea what is the difference so please anyone who understand add to this solution

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.