1

I setup PiVPN on my Pi3B. I have a Windows computer. I can connect through OpenVPN GUI on Windows to my Pi, because I changed the WAN address of my router in original .ovpn config file that my PiVPN generated to my Pi's local IP address. However, when I change it back to my external IP address for my router (Bell 3000), I cannot connect from Windows to Pi's VPN. OpenVPN GUI is allowed through my Windows Defender Firewall. I've port forwarded port 443 externally and internally from my router to my Pi. I've tried adding my Pi to my DMZ on my router to no avail. What can I do to fix this issue?I've added a picture for more clarification.

Edit - Here is my OVPN Config that works:

client
dev tun
proto udp
remote 192.168.2.37 443
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
tls-version-min 1.2
verify-x509-name server_08XRL6zHTfDaymUK name
cipher AES-256-CBC
auth SHA256
auth-nocache
verb 3
<ca>
-----BEGIN CERTIFICATE-----
MIIBnzCCAUWgAwIBAgIJAJbJod1X+
...
+W1kN37CaTI/qocSTEyGc=
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
MIIBuDCCAV2gAwIB
...
+H5wVZ4
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN ENCRYPTED PRIVATE KEY-----
MIHjME4GC
...
Pa52i051Fudhrk=
-----END ENCRYPTED PRIVATE KEY-----
</key>
<tls-crypt>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
bb0a39e1d55a264e237db76c5d9dc3ce
...
1425af36d2449f2c935b794e06407514
-----END OpenVPN Static key V1-----
</tls-crypt>

I've removed all the key contents. The original that didn't work had my router's WAN IP instead of 192.168.2.37.

Update: I have just tested it from another network; I can ssh to the pi, through port forwarding, but OpenVPN still doesn not work.

  • 1
    You are using three interfaces on your RasPi, wifi, ethernet and ovpn. There is a router with a demilitarized zone (DMZ) and routing the vpn tunnel. And anywhere there is a MS Windows PC with a firewall. And anywhere you are using port forwarding. You are using local and external ip addresses. And that's all said in only four sentences. Sorry, but that's to much in short to understand your setup. Can you please make an overview (ascii art, picture) which is connected to what with what? – Ingo Dec 8 '18 at 18:20
  • @Ingo I've clarified it. Hope you can now understand. – Raymo111 Dec 8 '18 at 18:26
  • 1
    DMZ opens ALL ports to the public internet. If you don't have a sensible iptables/ip6tables firewall and haven't set a strong password for every userid you will have the world knocking at your door seeing if there's a way in. My secure system is getting hundreds of attacks per day. My fail2ban policy blocks any attacker permanently. My ufw policy restricts everything apart from 80, 443, 22 and 1194. Try it with a fresh copy of Raspbian with userid=pi password=raspberry and it's about four minutes until your system will be compromised. – Dougie Dec 8 '18 at 20:14
  • 1
    The issue is it may not be open right now. But what happens six months from now when you forget your system is in the DMZ and you open another service like telnet or ftp or something else that has a high security risk. There is no reason to ever put a server system in the DMZ unless you fully understand the full consequences and risks of doing it. – Dougie Dec 8 '18 at 21:16
  • 1
    @Dougie Please address me with @Ingo, otherwise I won't see your reply. I agree with you that the OP should not use a DMZ in this case but in general a DMZ is to increase security for the main system. – Ingo Dec 8 '18 at 21:36
5

Info: To have a simple openvpn server installation for reference look at my second answer.

The first idea seeing the picture was that you confused WAN- and LAN-address. But lets look how I understand the setup so far with this example. I assume wifi and wired ethernet are bridged on the router (having the same ip address range).

                 vpn tunnel                         ┌──────────┐
       ╔═══════════════════════════════════════════════════════════ vpn client
RPi(eth0) <----------------> router <-------------> │ INTERNET │
         \     wired        /      \      wan       │          │
   192.168.4.2       192.168.4.1   172.217.18.174   └──────────┘
               wifi       /         (public ip)
      PC <~.~.~.~.~.~.~->/
        \
   192.168.4.3

Following this setup you can see that it makes no sense to try to connect from internal to the RPi with the public ip address 172.217.18.174. This is only important for the VPN client outside in the internet.

Update from the comments:
You want to connect to the VPNServer from outside everywhere in the internet. For testing you simply want to use the PC on your local area network, go to the internet and then try to connect to the tunnel like an external vpn client. As far as I can see this cannot work because PC and router are on the same local area network. Either the router sees the private source ip address 192.168.4.3 from the PC on its wan port 172.217.18.174, then it will reject it because no router accepts private ip addresses comming from the internet by specification. Or the router will NAT the PCs address to its wan port 127.217.18.174 as usual. Then you try to connect to the tunnels outside ip 127.217.18.174 from the (nated) PC ip 127.217.18.174. I don't think that equal source and destination addresses are accepted.

To test such situations I use a second independent 4G internet connection with my cell phone. Then the request to the router comes from a real outside internet address.

If you have established a VPN tunnel from the outside VPN client to the VPN server on the RasPi then the VPN client gets part of the local area network, just like it's local connected to it. The tunnel can be seen as a very long secured ethernet cable plugged in on the VPN client on one side and plugged in on the RasPi on the other side. There is no way back what you mean. But with the PC as part of your local area network it could be possible that you can connect to the internet like any other PC on that local network, not through the tunnel. I haven't tested it. There are specific routes set on the VPN client so this may avoid it.

If you still cannot connect from the outside public ip address it is difficult to say what's wrong with PiVPN for Jessie you installed on Stretch, with your DMZ and internal and external port forwarding, what ever this mean. You should start again from a fresh flashed Raspbian Stretch Lite image, install OpenVPN on it and configure it as VPN server, not using preconfigured PiVPN and not using a DMZ. I will have a look at such a setup but it will take some days.

  • 1
    That's not what @Raymo111's OpenVPN configuration looks like. The posted one is for an OpenVPN client not an OpenVPN server. – Dougie Dec 8 '18 at 21:17
  • @Dougie Do I misunderstood the headline "Cannot connect to PiVPN Server..." together with its drawing? Maybe, but firstly I've made the ascii art to clarify the situation. What should I change? – Ingo Dec 8 '18 at 21:31
  • @Ingo Traffic from my PC is going out to internet through router. Then it comes in through router to RasPi. Then it leaves Raspi, goes through router, and goes to Internet. This is how my RasPi is being used as a VPN server. – Raymo111 Dec 8 '18 at 21:41
  • 2
    As this answer has been flagged as "not an answer" I wanted to point out that "flags should not be used to indicate technical inaccuracies, or an altogether wrong answer"... but I am not judging if it is a wrong answer, just saying that it should not be flagged as "not an answer". – Ghanima Dec 8 '18 at 23:03
  • 1
    @Raymo111 It is difficult to say what's wrong with PiVPN for Jessie you installed on Stretch, with your DMZ and internal and external port forwarding, what ever this mean. You should start again from a fresh flashed Raspbian Stretch Lite image, install OpenVPN on it and configure it as VPN server, not using preconfigured PiVPN and not using a DMZ. I will have a look at such a setup but it will take some days. – Ingo Dec 9 '18 at 15:25
0

Here is another answer to give a simple example to establish an openvpn server as promised in my first answer. I assume we use a Debian like operating system on the PC as openvpn client instead of a MS Windows operating system to better show how it works. And yes, I'm not so familiar with MS Win because I haven't one. But when it works with Linux then you know where you have to look when you get problems. If you don't have a linux machine then simply boot a live CD from Debian or Ubuntu or something else.

For reference I use Raspbian Stretch Lite 2018-11-13.

Example for this setup:

          10.8.0.1                                              10.8.0.2
            /             vpn tunnel               ┌──────────┐     \
vpn-server ╔════════════════╗  ╔=═══════════════════════════════════ vpn-client
   RPi(eth0) <-----------> router <------------->  │ INTERNET │
            \    wired    /      \      wan        │          │
      192.168.4.2   192.168.4.1   172.217.18.174   └──────────┘
                                   (public ip)

I assume you have a working internet connection.
On the openvpn-server install openvpn:

rpi ~$ sudo -Es
rpi ~# apt update
rpi ~# apt full-upgrade
rpi ~# apt install openvpn
rpi ~# systemctl disable openvpn.service

If you use systemd-networkd then install also

rpi ~# apt install openvpn-systemd-resolved

Then generate a static secret key:

rpi ~# openvpn --genkey --secret /etc/openvpn/static.key

Create a server config file:

rpi ~# cat > /etc/openvpn/server.conf <<EOF
dev tun
ifconfig 10.8.0.1 10.8.0.2
secret static.key
cipher AES-256-CBC
EOF

Start the openvpn-server:

rpi ~# systemctl enable openvpn@server.service
rpi ~# systemctl start openvpn@server.service
rpi ~# exit
rpi ~$

On the openvpn-client also install openvpn as shown above with that 5 or 6 commands. Don't generate a new static key, instead copy that one you have made on the openvpn server to /etc/openvpn/ with same permission (sudo chmod 600 /etc/openvpn/static.key). Create a client config file:

mngmt ~# cat > /etc/openvpn/client.conf <<EOF
remote 192.168.4.3
dev tun
ifconfig 10.8.0.2 10.8.0.1
secret static.key
cipher AES-256-CBC
EOF

This config file is made to test the vpn tunnel on your local network first. I use the setup shown in my first answer. Now start the client with:

mngmt ~# exit
mngmt ~$ sudo systemctl start openvpn@client.service

Now you should be able to ping the server:

mngmt ~$ ping 10.8.0.1

If it works we can test to connect from the internet. To be sure not conflicting with local setup we have to use a complete different path to connect to the internet. For this I use my android cell phone with USB tethering to the management computer where I have disabled wifi on the phone to be sure only using 4G data uplink. I also disabled wifi on the management computer and pulled out its ethernet cord. The default port of openvpn is 1194 so you have to forward this port on your router to the local openvpn-server 192.168.4.2 port 1194 (192.168.4.2:1194). It is important to use protocol udp not tcp. Look at the router what it's current public ip address is, in my example 172.217.18.174. Then change the line remote 192.168.4.3 in /etc/openvpn/client.conf to remote 172.217.18.174 and
reboot.

Then enable USB tethering on your mobile phone, start the client and ping the server:

mngmt ~$ sudo systemctl start openvpn@client.service
mngmt ~$ ping 10.8.0.1
PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.
64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=743 ms
64 bytes from 10.8.0.1: icmp_seq=2 ttl=64 time=504 ms
64 bytes from 10.8.0.1: icmp_seq=3 ttl=64 time=403 ms
...

If this works then you have a running vpn tunnel through the internet to your local RasPi. With this simple setup with a pre shared secret key you can ensure that the environment is working (port forwarding, routing etc.). Now you can improve the setup of openvpn step by step with all its nice features like TLS public key authentication, connecting whole subnets, not only one RasPi, using tap interfaces instead of tun interfaces to remotely play games that need broadcasts and so on. But this isn't subject of this site.


References:
[1] openvpn - Static Key Mini-HOWTO
[2] man openvpn

  • Looks promising... will check this out. – Raymo111 Dec 17 '18 at 14:53
  • Wait you can write more than one answer to one question? – Raymo111 Dec 17 '18 at 14:54
  • 1
    @Raymo111 Yes, no problem to write more than one answer. After any answer I always get a button "Add Another Answer". I have not seen a limit so far. You self can answer your own question and it is explicitly desired. It is the way on this site to tell people important things you have found. – Ingo Dec 17 '18 at 20:48

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.