PiVPN client cant connect to local network

Question

I've managed to setup PiVPN on a Raspberry Pi 3+ and I can connect from the outside, I even have Internet access, but I don't have access to the local network.

These VLANs are created under my USG networks. Corporate network so they can communicate between each other.

VLAN2:

• Raspberry Pi @ 192.168.2.10

VLAN30:

• Laptop @ 192.168.30.10

VLAN100:

• OpenVPN @ 192.168.100.0/24

This is the physical setup. I'm using br0 because Im boardcasting a Wifi SSID from the Raspberry Pi on wlan0.

                 vpn tunnel                         ┌──────────┐
       ╔═══════════════════════════════════════════════════════════ vpn client
RPi(br0)  <---------------->  USG   <-------------> │ INTERNET │
         \     wired        /                       │          │
   192.168.2.1       192.168.30.1                   └──────────┘
               wifi       /         
      PC <~.~.~.~.~.~.~->/
        \
   192.168.30.10

I've created VLAN100 on my USG on 192.168.100.0/24 and assign this IP range to openVPN

dev tun
proto udp
port 1194
topology subnet
server 192.168.100.0 255.255.255.0
# Route gateway
push "route-gateway 192.168.100.1"
# Set your primary domain name server address for clients
push "dhcp-option DNS 192.168.1.1"
# Routes
push "route 192.168.30.0 255.255.255.0"

ifconfig on RPi

br0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
    inet 192.168.2.10  netmask 255.255.255.0  broadcast 192.168.2.255
    inet6 fe80::93db:ce25:c561:7628  prefixlen 64  scopeid 0x20<link>
    ether b8:27:eb:36:86:95  txqueuelen 1000  (Ethernet)
    RX packets 275827  bytes 43249972 (41.2 MiB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 529402  bytes 61574005 (58.7 MiB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        ether b8:27:eb:63:d3:c0  txqueuelen 1000  (Ethernet)
        RX packets 1922462  bytes 869206353 (828.9 MiB)
        RX errors 0  dropped 13625  overruns 0  frame 0
        TX packets 2520062  bytes 307984351 (293.7 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 192.168.100.1  netmask 255.255.255.0  destination 192.168.100.1
        inet6 fe80::8dc9:82fe:66ca:71fd  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100

wlan0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        ether b8:27:eb:36:86:95  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 187646  bytes 22435353 (21.3 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

iptables -S

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N f2b-sshd
-A INPUT -p tcp -m multiport --dports 22 -j f2b-sshd
-A f2b-sshd -j RETURN

iptables -t NAT -S

-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-A POSTROUTING -s 192.168.100.0/24 -o eth0 -j MASQUERADE
-A POSTROUTING -s 192.168.100.0/24 -o br0 -j MASQUERADE

ip route

default via 192.168.2.1 dev br0 src 192.168.2.10 metric 203 
default via 192.168.10.1 dev eth0.10 src 192.168.10.6 metric 208 
default via 192.168.20.1 dev eth0.20 src 192.168.20.6 metric 209 
192.168.2.0/24 dev br0 proto kernel scope link src 192.168.2.10 metric 203 
192.168.10.0/24 dev eth0.10 proto kernel scope link src 192.168.10.6 metric 208 
192.168.20.0/24 dev eth0.20 proto kernel scope link src 192.168.20.6 metric 209 
192.168.100.0/24 dev tun0 proto kernel scope link src 192.168.100.1 

Answer 1

It seems you are missing a route somewhere.

If you want to reach 192.168.30.10 from an external VPN client, you need the correct routing entries on every step along the way, and on the way back. I assume that 192.168.30.10 is reachable from the PI, so the way to 192.168.30.10 should be covered.

But what about the route back? 192.168.30.10 has only one connection, that to the USG, so there should already be a default route to the USG. But what about the USG, does it know to send traffic for 192.168.100.0/24 (the addresses of the VPN clients) to the PI?

In general, if you have routing problems, you can run a ping and use tcpdump so see the ICMP requests and responses. Watch the packets on each gateway and verify that they are directed to the proper destination, until you reach a router where the packets don't arrive or where they are sent to the wrong destination, then fix the routing tables so that they go to the correct destination.

You already push a route to 192.168.30.0/24 to the client, this is correct but should be not necessary, as it is covered by the default route (route-gateway).

to your 192.168.30.0 network. This network is not local to the PI in the sense that it is directly reachable. Instead it is reachable through the USB.

The problem is that as soon as the VPN goes up,