I followed a guide here to turn my raspberry pi into a vpn router for my PS3. Basically it uses the Wi-Fi connection of the Pi to share internet to the ethernet connection.
It works perfectly on one provider, say PROV-A but on another provider, say PROV-B I have no internet connection. I have checked that the VPN is online and works. From the raspberry, I can ping, curl and my IP is that of the respective providers, but on the PS3 (or laptop that I'm using for troubleshooting on eth0) , I only have internet connection when using PROV-A. PROV-B doesn't work at all. Is there anything I'm missing? Maybe something on the routing since I don't think it has to do with iptables as it works on one but not on the other.
Ah yes, I also don't have connection when not connected to any VPN which is good since I don't want non-vpn traffic going through eth0.
Here are some configuration files:
PROV-A client.conf for openvpn
client dev tun proto tcp remote 123.xxx.xxx.xxx 443 remote vpn.provider-a.com 443 resolv-retry infinite nobind persist-key persist-tun ca ca.crt cert client.crt key client.key tls-client tls-cipher TLS-DHE-RSA-WITH-AES-128-CBC-SHA auth-user-pass auth.txt comp-lzo verb 3 cipher AES-128-CBC auth-nocache remote-cert-tls server fast-io pull route-delay 2 redirect-gateway log /var/log/openvpn-client.log
PROV-B client.conf for openvpn
client dev tun1 remote 129.xxx.xxx.xxx 1194 remote vpn.provider-b.com 1194 resolv-retry infinite nobind persist-key persist-tun ca cacert.pem cert client.crt key client.key auth-user-pass auth.txt verb 4 cipher AES-128-CBC tls-client tls-cipher TLS-DHE-RSA-WITH-AES-128-CBC-SHA fast-io pull route-delay 2 redirect-gateway auth-nocache remote-cert-tls server log-append /var/log/openvpn-b-client.log ping 10 ping-restart 30
route when not connected to any VPN
# route -v -n -e Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 192.168.178.1 0.0.0.0 UG 0 0 0 wlan0 0.0.0.0 192.168.178.1 0.0.0.0 UG 303 0 0 wlan0 169.254.0.0 0.0.0.0 255.255.0.0 U 202 0 0 eth0 192.168.10.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 192.168.178.0 0.0.0.0 255.255.255.0 U 303 0 0 wlan0 # route -v -e Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface default fritz.box 0.0.0.0 UG 0 0 0 wlan0 default fritz.box 0.0.0.0 UG 0 0 0 wlan0 link-local * 255.255.0.0 U 0 0 0 eth0 192.168.10.0 * 255.255.255.0 U 0 0 0 eth0 192.168.178.0 * 255.255.255.0 U 0 0 0 wlan0
route when connected to PROV-A
# route -v -n -e Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 0.0.0.0 10.9.0.69 128.0.0.0 UG 0 0 0 tun0 0.0.0.0 192.168.178.1 0.0.0.0 UG 0 0 0 wlan0 0.0.0.0 192.168.178.1 0.0.0.0 UG 0 0 0 wlan0 10.9.0.1 10.9.0.69 255.255.255.255 UGH 0 0 0 tun0 10.9.0.69 0.0.0.0 255.255.255.255 UH 0 0 0 tun0 128.0.0.0 10.9.0.69 128.0.0.0 UG 0 0 0 tun0 169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0 123.xxx.xxx.xxx 192.168.178.1 255.255.255.255 UGH 0 0 0 wlan0 192.168.10.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 192.168.178.0 0.0.0.0 255.255.255.0 U 0 0 0 wlan0 # route -v -e Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface default 10.9.0.69 128.0.0.0 UG 0 0 0 tun0 default fritz.box 0.0.0.0 UG 0 0 0 wlan0 default fritz.box 0.0.0.0 UG 0 0 0 wlan0 10.9.0.1 10.9.0.69 255.255.255.255 UGH 0 0 0 tun0 10.9.0.69 * 255.255.255.255 UH 0 0 0 tun0 128.0.0.0 10.9.0.69 128.0.0.0 UG 0 0 0 tun0 link-local * 255.255.0.0 U 0 0 0 eth0 vpn.provider-a. fritz.box 255.255.255.255 UGH 0 0 0 wlan0 192.168.10.0 * 255.255.255.0 U 0 0 0 eth0 192.168.178.0 * 255.255.255.0 U 0 0 0 wlan0
route when connected to PROV-B
# route -v -n -e Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface MSS Window irtt 0.0.0.0 10.42.0.1 128.0.0.0 UG 0 0 0 tun1 0 0 0 0.0.0.0 192.168.178.1 0.0.0.0 UG 0 0 0 wlan0 0 0 0 0.0.0.0 192.168.178.1 0.0.0.0 UG 303 0 0 wlan0 0 0 0 10.42.0.0 0.0.0.0 255.255.248.0 U 0 0 0 tun1 0 0 0 128.0.0.0 10.42.0.1 128.0.0.0 UG 0 0 0 tun1 0 0 0 129.xxx.xxx.xxx 192.168.178.1 255.255.255.255 UGH 0 0 0 wlan0 0 0 0 169.254.0.0 0.0.0.0 255.255.0.0 U 202 0 0 eth0 0 0 0 192.168.10.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 0 0 0 192.168.178.0 0.0.0.0 255.255.255.0 U 303 0 0 wlan0 0 0 0 # route -v -e Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface MSS Window irtt default 10.42.0.1 128.0.0.0 UG 0 0 0 tun1 0 0 0 default fritz.box 0.0.0.0 UG 0 0 0 wlan0 0 0 0 default fritz.box 0.0.0.0 UG 303 0 0 wlan0 0 0 0 10.42.0.0 * 255.255.248.0 U 0 0 0 tun1 0 0 0 128.0.0.0 10.42.0.1 128.0.0.0 UG 0 0 0 tun1 0 0 0 vpn.provider-b. fritz.box 255.255.255.255 UGH 0 0 0 wlan0 0 0 0 link-local * 255.255.0.0 U 202 0 0 eth0 0 0 0 192.168.10.0 * 255.255.255.0 U 0 0 0 eth0 0 0 0 192.168.178.0 * 255.255.255.0 U 303 0 0 wlan0 0 0 0
my /etc/dnsmasq.d/dnsmasq.custom.conf
interface=eth0 dhcp-range=eth0,192.168.10.100,192.168.10.250,24h dhcp-option=3,192.168.10.1 # our router dhcp-option=6,77.109.148.136 # our DNS Server dhcp-authoritative # force clients to grab a new IP
my /etc/network/interfaces
# interfaces(5) file used by ifup(8) and ifdown(8)
# Please note that this file is written to be used with dhcpcd
# For static IP, consult /etc/dhcpcd.conf and 'man dhcpcd.conf'
# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
address 192.168.10.1
netmask 255.255.255.0
network 192.168.10.0
broadcast 192.168.10.255
allow-hotplug wlan0
iface wlan0 inet dhcp
wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf
allow-hotplug wlan1
iface wlan1 inet manual
wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf
pre-up iptables-restore < /etc/network/iptables
my /etc/network/iptables
# Generated by iptables-save v1.4.21 on Fri Jan 8 10:12:12 2016 *raw :PREROUTING ACCEPT [2329:305964] :OUTPUT ACCEPT [1422:170407] COMMIT # Completed on Fri Jan 8 10:12:12 2016 # Generated by iptables-save v1.4.21 on Fri Jan 8 10:12:12 2016 *mangle :PREROUTING ACCEPT [2329:305964] :INPUT ACCEPT [1999:222660] :FORWARD ACCEPT [330:83304] :OUTPUT ACCEPT [1422:170407] :POSTROUTING ACCEPT [1752:253711] COMMIT # Completed on Fri Jan 8 10:12:12 2016 # Generated by iptables-save v1.4.21 on Fri Jan 8 10:12:12 2016 *nat :PREROUTING ACCEPT [69:4377] :INPUT ACCEPT [0:0] :OUTPUT ACCEPT [49:3489] :POSTROUTING ACCEPT [86:5816] -A POSTROUTING -o tun+ -j MASQUERADE COMMIT # Completed on Fri Jan 8 10:12:12 2016 # Generated by iptables-save v1.4.21 on Fri Jan 8 10:12:12 2016 *filter :INPUT ACCEPT [1884:213027] :FORWARD ACCEPT [102:6417] :OUTPUT ACCEPT [1332:159707] -A FORWARD -i eth0 -o tun+ -j ACCEPT -A FORWARD -i tun+ -o eth0 -m conntrack --ctstate NEW -j ACCEPT -A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT COMMIT # Completed on Fri Jan 8 10:12:12 2016
