1

I have a custom setup and wish someone could help.

I have a main router(R1) and a secondary router(R2). I will refer to main router as (r1) and secondary router as (R2). (R1) is used for home everybody use. (r2) Is used when I need to connect to a vpn within my network or on a public network. I have pihole and pivpn installed on my rpi. Pihole working nicely but I cannot connect to vpn with my iOS device. I am using openvpn from the App Store to connect iOS device. also note I am using the latest version of advanced tomato on router (1) and (2).

I Understand this firmware has its own Adblock which I have enabled on router (1) and vpn NOT ENABLED on either because The vpn side is a bit confusing to setup with tomato and I figure since I have been successful in the past with both pihole and pivpn separately it would be easier to just take my extra pi and make it work.

Well enough backstory here is my setup (r1) 12.345.160.62 (r2) ip 12.345.168.133. (r1) lan PORT to (r2) wan PORT. I can reach the internet with both routers. rpi static ip is 12.345.168.30 not real ip's the first 2 octets are the same for r1 and r2 and pi the last 2 are different hope my GRAMMAR is correct??

outputs of following commands

cat /etc/resolv.conf
nameserver=12.345.168.30

sudo iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT

sudo iptables -t nat -S
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

ifconfig eth0
Link encap:Ethernet HWaddr b8:27:eb:bc:7c:33
inet addr:12.345.168.30 Bcast:10.255.255.255 Mask:255.0.0.0
inet6 addr: fe80::fe94:796:3203:71f4/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:21130 errors:0 dropped:8 overruns:0 frame:0
TX packets:9122 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:15876437 (15.1 MiB) TX bytes:901096 (879.9 KiB)

dig google.com
; <<>> DiG 9.9.5-9+deb8u17-Raspbian <<>> google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16421
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1452
;; QUESTION SECTION:
;google.com. IN A
;; ANSWER SECTION:
google.com. 249 IN A 172.217.15.78
;; Query time: 43 msec
;; SERVER: 12.345.168.30#53(10.193.168.30)
;; WHEN: Wed Jun 05 18:26:34 EDT 2019
;; MSG SIZE rcvd: 55

systemctl status openvpn
openvpn.service - OpenVPN service
Loaded: loaded (/lib/systemd/system/openvpn.service; enabled)
Active: active (exited) since Mon 2019-06-03 13:17:16 EDT; 2 days ago
Process: 468 ExecStart=/bin/true (code=exited, status=0/SUCCESS)
Main PID: 468 (code=exited, status=0/SUCCESS)
CGroup: /system.slice/openvpn.service

cat xxxxxxxxx.ovpn
client
dev tun
proto udp
remote xxxxxxxxxx.ddns.net 3074
resolv-retry infinite
nobind
persist-key
persist-tun
key-direction 1
remote-cert-tls server
tls-version-min 1.2
verify-x509-name server_server_dbyHvQE84KOsxxxx name
cipher AES-256-CBC
auth SHA256
auth-nocache
verb 3
<ca>

Pivpn -d
::: Generating Debug Output
:::: PiVPN debug ::::
=============================================
:::: Latest commit ::::
commit 2e5b804893aa2c263f455e80b4aa56797e9cxxxx
Author: 4s3ti cfcolaco@gmail.com
Date: Tue May 14 09:58:15 2019 +0100
Merge pull request #740 from 4s3ti/master
Merging Test Branch into Master
=============================================
:::: Installation settings ::::
/etc/pivpn/DET_PLATFORM -> Raspbian
/etc/pivpn/INSTALL_PORT -> 3074
/etc/pivpn/INSTALL_PROTO -> udp
/etc/pivpn/INSTALL_USER -> pi
/etc/pivpn/NO_UFW -> 1
/etc/pivpn/pivpnINTERFACE -> eth0
=============================================
:::: setupVars file shown below ::::
pivpnUser=pi
UNATTUPG=unattended-upgrades
pivpnInterface=eth0
IPv4dns=127.0.0.1############MAYBE THIS LINE DO NOT KNOW WHERE TO CHANGE THIS AT???????
IPv4addr=12.345.168.30
IPv4gw=12.345.168.133
pivpnProto=udp
PORT=3074
ENCRYPT=2048
APPLY_TWO_POINT_FOUR=false
DOWNLOAD_DH_PARAM=false
PUBLICDNS=REMOTE
OVPNDNS1=1.1.1.1
OVPNDNS2=1.0.0.1
=============================================
:::: Server configuration shown below ::::
dev tun
proto udp
port 3074
ca /etc/openvpn/easy-rsa/pki/ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/server_dbyHvQE84KOsxxxx.crt
key /etc/openvpn/easy-rsa/pki/private/server_dbyHvQE84KOsxxxx.key
dh /etc/openvpn/easy-rsa/pki/dh2048.pem
topology subnet
server 10.8.0.0 255.255.255.0
# Set your primary domain name server address for clients
push “dhcp-option DNS 12.345.168.30”
#push "dhcp-option DNS 1.1.1.1"
#push "dhcp-option DNS 1.0.0.1"
# Prevent DNS leaks on Windows
push "block-outside-dns"
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
keepalive 1800 3600
remote-cert-tls client
tls-version-min 1.2
tls-auth /etc/openvpn/easy-rsa/pki/ta.key 0
cipher AES-256-CBC
auth SHA256
user nobody
group nogroup
persist-key
persist-tun
crl-verify /etc/openvpn/crl.pem
status /var/log/openvpn-status.log 20
status-version 3
syslog
verb 3
#DuplicateCNs allow access control on a less-granular, per user basis.
#Remove # if you will manage access by user instead of device.
#duplicate-cn
# Generated for use by PiVPN.io
=============================================
:::: Client template file shown below ::::
client
dev tun
proto udp
remote REMOTE 3074
resolv-retry infinite
nobind
persist-key
persist-tun
key-direction 1
remote-cert-tls server
tls-version-min 1.2
verify-x509-name server_dbyHvQE84KOsxxxx name
cipher AES-256-CBC
auth SHA256
auth-nocache
verb 3
=============================================
:::: Recursive list of files in ::::
::: /etc/openvpn/easy-rsa/pki shows below :::
/etc/openvpn/easy-rsa/pki/:
ca.crt
crl.pem
Default.txt
dh2048.pem
extensions.temp
index.txt
index.txt.attr
index.txt.attr.old
index.txt.old
issued
xxxxxxxxx.ovpn
openssl-easyrsa.cnf
private
renewed
revoked
safessl-easyrsa.cnf
serial
serial.old
ta.key
/etc/openvpn/easy-rsa/pki/issued:
xxxxxxxxx.crt
server_dbyHvQE84KOsxxxx.crt
/etc/openvpn/easy-rsa/pki/private:
ca.key
xxxxxxxxxx.key
server_dbyHvQE84KOsxxxx.key
/etc/openvpn/easy-rsa/pki/renewed:
private_by_serial
reqs_by_serial
/etc/openvpn/easy-rsa/pki/renewed/private_by_serial:
/etc/openvpn/easy-rsa/pki/renewed/reqs_by_serial:
/etc/openvpn/easy-rsa/pki/revoked:
private_by_serial
reqs_by_serial
/etc/openvpn/easy-rsa/pki/revoked/private_by_serial:
/etc/openvpn/easy-rsa/pki/revoked/reqs_by_serial:
=============================================
:::: Self check ::::
:: [OK] IP forwarding is enabled
:: [OK] Iptables MASQUERADE rule set
:: [OK] OpenVPN is running
:: [OK] OpenVPN is enabled (it will automatically start on reboot)
:: [OK] OpenVPN is listening on port 3074/udp
=============================================
:::: Snippet of the server log ::::
Jun 3 13:17:12 pivpn ovpn-server[405]: OpenVPN 2.3.4 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jun 27 2017
Jun 3 13:17:13 pivpn ovpn-server[405]: library versions: OpenSSL 1.0.1t 3 May 2016, LZO 2.08
Jun 3 13:17:13 pivpn ovpn-server[405]: Diffie-Hellman initialized with 2048 bit key
Jun 3 13:17:13 pivpn ovpn-server[405]: Control Channel Authentication: using '/etc/openvpn/easy-rsa/pki/ta.key' as a OpenVPN static key file
Jun 3 13:17:13 pivpn ovpn-server[405]: Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Jun 3 13:17:13 pivpn ovpn-server[405]: Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Jun 3 13:17:13 pivpn ovpn-server[405]: Socket Buffers: R=[163840->131072] S=[163840->131072]
Jun 3 13:17:13 pivpn ovpn-server[405]: TUN/TAP device tun0 opened
Jun 3 13:17:13 pivpn ovpn-server[405]: TUN/TAP TX queue length set to 100
Jun 3 13:17:13 pivpn ovpn-server[405]: do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Jun 3 13:17:13 pivpn ovpn-server[405]: /sbin/ip link set dev tun0 up mtu 1500
Jun 3 13:17:13 pivpn ovpn-server[405]: /sbin/ip addr add dev tun0 10.8.0.1/24 broadcast 10.8.0.255
Jun 3 13:17:13 pivpn ovpn-server[431]: GID set to nogroup
Jun 3 13:17:13 pivpn ovpn-server[431]: UID set to nobody
Jun 3 13:17:13 pivpn ovpn-server[431]: UDPv4 link local (bound): [undef]
Jun 3 13:17:13 pivpn ovpn-server[431]: UDPv4 link remote: [undef]
Jun 3 13:17:13 pivpn ovpn-server[431]: MULTI: multi_init called, r=256 v=256
Jun 3 13:17:13 pivpn ovpn-server[431]: IFCONFIG POOL: base=10.8.0.2 size=252, ipv6=0
Jun 3 13:17:13 pivpn ovpn-server[431]: Initialization Sequence Completed
=============================================
:::: Debug complete ::::
:::
:::
##################openvpn app ios##############################
2019-06-05 18:22:25 ----- OpenVPN Start -----
OpenVPN core 3.2 ios arm64 64-bit PT_PROXY built on Oct 3 2018 06:35:04
2019-06-05 18:22:25 Frame=512/2048/512 mssfix-ctrl=1250
2019-06-05 18:22:25 UNUSED OPTIONS
4 [resolv-retry] [infinite]
5 [nobind]
6 [persist-key]
7 [persist-tun]
11 [verify-x509-name] [server_dbyHvQE84KOsxxxx] [name]
14 [auth-nocache]
15 [verb] [3]
2019-06-05 18:22:25 EVENT: RESOLVE
2019-06-05 18:22:25 Contacting [public ip]:3074/UDP via UDP
2019-06-05 18:22:25 EVENT: WAIT
2019-06-05 18:22:25 Connecting to [xxxxxxxx.ddns.net]:3074 (public ip) via UDPv4
2019-06-05 18:22:35 Server poll timeout, trying next remote entry...
2019-06-05 18:22:35 EVENT: RECONNECTING
2019-06-05 18:22:35 EVENT: RESOLVE
2019-06-05 18:22:35 Contacting [public ip]:3074/UDP via UDP
2019-06-05 18:22:35 EVENT: WAIT
2019-06-05 18:22:35 Connecting to [xxxxxxxx.ddns.net]:3074 (public ip) via UDPv4
2019-06-05 18:22:45 Server poll timeout, trying next remote entry...
#######################################
console log iOS attempting to connect
2019-06-05 18:22:25 ----- OpenVPN Start -----
OpenVPN core 3.2 ios arm64 64-bit PT_PROXY built on Oct 3 2018 06:35:04
2019-06-05 18:22:25 Frame=512/2048/512 mssfix-ctrl=1250
2019-06-05 18:22:25 UNUSED OPTIONS
4 [resolv-retry] [infinite]
5 [nobind]
6 [persist-key]
7 [persist-tun]
11 [verify-x509-name] [server_dbyHvQE84KOsxxxx] [name]
14 [auth-nocache]
15 [verb] [3]
2019-06-05 18:22:25 EVENT: RESOLVE
2019-06-05 18:22:25 Contacting [public ip]:3074/UDP via UDP
2019-06-05 18:22:25 EVENT: WAIT
2019-06-05 18:22:25 Connecting to [xxxxxxxxx.ddns.net]:3074 (public ip) via UDPv4
2019-06-05 18:22:35 Server poll timeout, trying next remote entry...
2019-06-05 18:22:35 EVENT: RECONNECTING
2019-06-05 18:22:35 EVENT: RESOLVE
2019-06-05 18:22:35 Contacting [public ip]:3074/UDP via UDP
2019-06-05 18:22:35 EVENT: WAIT
2019-06-05 18:22:35 Connecting to [xxxxxxx.ddns.net]:3074 (public ip) via UDPv4
2019-06-05 18:22:45 Server poll timeout, trying next remote entry...
2019-06-05 18:22:45 EVENT: RECONNECTING
2019-06-05 18:22:45 EVENT: RESOLVE
2019-06-05 18:22:45 Contacting [public ip]:3074/UDP via UDP
2019-06-05 18:22:45 EVENT: WAIT
2019-06-05 18:22:45 Connecting to [xxxxxxxx.ddns.net]:3074 (public ip) via UDPv4
2019-06-05 18:22:55 EVENT: CONNECTION_TIMEOUT [ERR]
2019-06-05 18:22:56 Raw stats on disconnect:
BYTES_OUT : 1620
PACKETS_OUT : 30
CONNECTION_TIMEOUT : 1
N_RECONNECT : 2
2019-06-05 18:22:56 Performance stats on disconnect:
CPU usage (microseconds): 66298
Network bytes per CPU second: 24435
Tunnel bytes per CPU second: 0
2019-06-05 18:22:56 EVENT: DISCONNECTED
2019-06-05 18:22:56 Raw stats on disconnect:
BYTES_OUT : 1620
PACKETS_OUT : 30
CONNECTION_TIMEOUT : 1
N_RECONNECT : 2
2019-06-05 18:22:56 Performance stats on disconnect:
CPU usage (microseconds): 66828
Network bytes per CPU second: 24241
Tunnel bytes per CPU second: 0
2019-39-05 18:39:20 RECONNECT TEST: Internet:ReachableViaWiFi/-R t------
2019-39-05 18:39:20 EARLY RECONNECT
##################################
(R1) settings
Dyn dns noir.com
Wan dns 1.1.1.1; 1.0.0.1
Dhcp enabled
[![forward ports][1]][1]

forward ports
(R2)
Wan ip 12.345.160.99
Dyn dns none
Wan Dns server auto
Dhcp enabled
[![forward ports][2]][2]
forward ports thats a 62 at the end. ^^

possibly don’t have my ports forwarded right I’m guessing since everything going coming to a from R1 I need to open the ports on both routers. Once again I can reach the internet with r1 and r2

  • Your setup is far to complicated with to much third party software. I would start only with the two router without iptables and additional software (e.g. pihole, pivpn) to ensure main functionality and then improve it step by step with security and filters. – Ingo Jun 6 at 10:21
  • ok thank you I will try it step by step – Nsain38 Jun 7 at 16:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.