I followed a guide here to turn my raspberry pi into a vpn router for my PS3. Basically it uses the Wi-Fi connection of the Pi to share internet to the ethernet connection.

It works perfectly on one provider, say PROV-A but on another provider, say PROV-B I have no internet connection. I have checked that the VPN is online and works. From the raspberry, I can ping, curl and my IP is that of the respective providers, but on the PS3 (or laptop that I'm using for troubleshooting on eth0) , I only have internet connection when using PROV-A. PROV-B doesn't work at all. Is there anything I'm missing? Maybe something on the routing since I don't think it has to do with iptables as it works on one but not on the other.

Ah yes, I also don't have connection when not connected to any VPN which is good since I don't want non-vpn traffic going through eth0.

Here are some configuration files:

PROV-A client.conf for openvpn

client
dev tun
proto tcp
remote 123.xxx.xxx.xxx 443
remote vpn.provider-a.com 443
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
tls-client
tls-cipher TLS-DHE-RSA-WITH-AES-128-CBC-SHA
auth-user-pass auth.txt
comp-lzo
verb 3
cipher AES-128-CBC
auth-nocache
remote-cert-tls server
fast-io
pull
route-delay 2
redirect-gateway
log /var/log/openvpn-client.log

PROV-B client.conf for openvpn

client
dev tun1
remote 129.xxx.xxx.xxx 1194
remote vpn.provider-b.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca cacert.pem
cert client.crt
key client.key
auth-user-pass auth.txt
verb 4
cipher AES-128-CBC
tls-client
tls-cipher TLS-DHE-RSA-WITH-AES-128-CBC-SHA
fast-io
pull
route-delay 2
redirect-gateway
auth-nocache
remote-cert-tls server
log-append /var/log/openvpn-b-client.log
ping 10
ping-restart 30

route when not connected to any VPN

# route -v -n -e
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.178.1   0.0.0.0         UG    0      0        0 wlan0
0.0.0.0         192.168.178.1   0.0.0.0         UG    303    0        0 wlan0
169.254.0.0     0.0.0.0         255.255.0.0     U     202    0        0 eth0
192.168.10.0    0.0.0.0         255.255.255.0   U     0      0        0 eth0
192.168.178.0   0.0.0.0         255.255.255.0   U     303    0        0 wlan0

# route -v -e
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
default         fritz.box       0.0.0.0         UG        0 0          0 wlan0
default         fritz.box       0.0.0.0         UG        0 0          0 wlan0
link-local      *               255.255.0.0     U         0 0          0 eth0
192.168.10.0    *               255.255.255.0   U         0 0          0 eth0
192.168.178.0   *               255.255.255.0   U         0 0          0 wlan0

route when connected to PROV-A

# route -v -n -e

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         10.9.0.69       128.0.0.0       UG        0 0          0 tun0
0.0.0.0         192.168.178.1   0.0.0.0         UG        0 0          0 wlan0
0.0.0.0         192.168.178.1   0.0.0.0         UG        0 0          0 wlan0
10.9.0.1        10.9.0.69       255.255.255.255 UGH       0 0          0 tun0
10.9.0.69       0.0.0.0         255.255.255.255 UH        0 0          0 tun0
128.0.0.0       10.9.0.69       128.0.0.0       UG        0 0          0 tun0
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 eth0
123.xxx.xxx.xxx 192.168.178.1   255.255.255.255 UGH       0 0          0 wlan0
192.168.10.0    0.0.0.0         255.255.255.0   U         0 0          0 eth0
192.168.178.0   0.0.0.0         255.255.255.0   U         0 0          0 wlan0

# route -v -e

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
default         10.9.0.69       128.0.0.0       UG        0 0          0 tun0
default         fritz.box       0.0.0.0         UG        0 0          0 wlan0
default         fritz.box       0.0.0.0         UG        0 0          0 wlan0
10.9.0.1        10.9.0.69       255.255.255.255 UGH       0 0          0 tun0
10.9.0.69       *               255.255.255.255 UH        0 0          0 tun0
128.0.0.0       10.9.0.69       128.0.0.0       UG        0 0          0 tun0
link-local      *               255.255.0.0     U         0 0          0 eth0
vpn.provider-a. fritz.box       255.255.255.255 UGH       0 0          0 wlan0
192.168.10.0    *               255.255.255.0   U         0 0          0 eth0
192.168.178.0   *               255.255.255.0   U         0 0          0 wlan0

route when connected to PROV-B

# route -v -n -e

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface    MSS   Window irtt
0.0.0.0         10.42.0.1       128.0.0.0       UG    0      0        0 tun1     0     0      0
0.0.0.0         192.168.178.1   0.0.0.0         UG    0      0        0 wlan0    0     0      0
0.0.0.0         192.168.178.1   0.0.0.0         UG    303    0        0 wlan0    0     0      0
10.42.0.0       0.0.0.0         255.255.248.0   U     0      0        0 tun1     0     0      0
128.0.0.0       10.42.0.1       128.0.0.0       UG    0      0        0 tun1     0     0      0
129.xxx.xxx.xxx 192.168.178.1   255.255.255.255 UGH   0      0        0 wlan0    0     0      0
169.254.0.0     0.0.0.0         255.255.0.0     U     202    0        0 eth0     0     0      0
192.168.10.0    0.0.0.0         255.255.255.0   U     0      0        0 eth0     0     0      0
192.168.178.0   0.0.0.0         255.255.255.0   U     303    0        0 wlan0    0     0      0

# route -v -e

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface    MSS   Window irtt
default         10.42.0.1       128.0.0.0       UG    0      0        0 tun1     0     0      0
default         fritz.box       0.0.0.0         UG    0      0        0 wlan0    0     0      0
default         fritz.box       0.0.0.0         UG    303    0        0 wlan0    0     0      0
10.42.0.0       *               255.255.248.0   U     0      0        0 tun1     0     0      0
128.0.0.0       10.42.0.1       128.0.0.0       UG    0      0        0 tun1     0     0      0
vpn.provider-b. fritz.box       255.255.255.255 UGH   0      0        0 wlan0    0     0      0
link-local      *               255.255.0.0     U     202    0        0 eth0     0     0      0
192.168.10.0    *               255.255.255.0   U     0      0        0 eth0     0     0      0
192.168.178.0   *               255.255.255.0   U     303    0        0 wlan0    0     0      0

my /etc/dnsmasq.d/dnsmasq.custom.conf

interface=eth0
dhcp-range=eth0,192.168.10.100,192.168.10.250,24h
dhcp-option=3,192.168.10.1 # our router
dhcp-option=6,77.109.148.136 # our DNS Server
dhcp-authoritative # force clients to grab a new IP

my /etc/network/interfaces

# interfaces(5) file used by ifup(8) and ifdown(8)

# Please note that this file is written to be used with dhcpcd
# For static IP, consult /etc/dhcpcd.conf and 'man dhcpcd.conf'

# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet static
    address 192.168.10.1
    netmask 255.255.255.0
    network 192.168.10.0
    broadcast 192.168.10.255

allow-hotplug wlan0
iface wlan0 inet dhcp
    wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

allow-hotplug wlan1
iface wlan1 inet manual
    wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

pre-up iptables-restore < /etc/network/iptables

my /etc/network/iptables

# Generated by iptables-save v1.4.21 on Fri Jan  8 10:12:12 2016
*raw
:PREROUTING ACCEPT [2329:305964]
:OUTPUT ACCEPT [1422:170407]
COMMIT
# Completed on Fri Jan  8 10:12:12 2016
# Generated by iptables-save v1.4.21 on Fri Jan  8 10:12:12 2016
*mangle
:PREROUTING ACCEPT [2329:305964]
:INPUT ACCEPT [1999:222660]
:FORWARD ACCEPT [330:83304]
:OUTPUT ACCEPT [1422:170407]
:POSTROUTING ACCEPT [1752:253711]
COMMIT
# Completed on Fri Jan  8 10:12:12 2016
# Generated by iptables-save v1.4.21 on Fri Jan  8 10:12:12 2016
*nat
:PREROUTING ACCEPT [69:4377]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [49:3489]
:POSTROUTING ACCEPT [86:5816]
-A POSTROUTING -o tun+ -j MASQUERADE
COMMIT
# Completed on Fri Jan  8 10:12:12 2016
# Generated by iptables-save v1.4.21 on Fri Jan  8 10:12:12 2016
*filter
:INPUT ACCEPT [1884:213027]
:FORWARD ACCEPT [102:6417]
:OUTPUT ACCEPT [1332:159707]
-A FORWARD -i eth0 -o tun+ -j ACCEPT
-A FORWARD -i tun+ -o eth0 -m conntrack --ctstate NEW -j ACCEPT
-A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Fri Jan  8 10:12:12 2016
up vote 3 down vote accepted

Change the vpn configs to both have dev tun and change your iptables to use:

*mangle
:PREROUTING ACCEPT
:INPUT ACCEPT
:FORWARD ACCEPT
:OUTPUT ACCEPT
:POSTROUTING ACCEPT
COMMIT
*raw
:PREROUTING ACCEPT
:OUTPUT ACCEPT
COMMIT
*nat
:PREROUTING ACCEPT
:INPUT ACCEPT
:OUTPUT ACCEPT
:POSTROUTING ACCEPT
-A POSTROUTING -o tun0 -j MASQUERADE
COMMIT
*filter
:INPUT ACCEPT
:FORWARD ACCEPT
:OUTPUT ACCEPT
-A FORWARD -i eth0 -o tun0 -j ACCEPT
-A FORWARD -i tun0 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
COMMIT

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.