Access OpenVPN connection from local network through WAN IP?Problems setting up a VPN: can connect but can't ping anyoneOpenVPN server will not redirect trafficOpenVPN connection from within 2nd subnet in office?openvpn: connection established, can't ping server tun interface (debian server, windows & os x clients)Connect AWS and Azure via OpenVPNHow to get OpenVPN Client (Mikrotik RouterOS) <-> OpenVPN server (Debian/Linux) setup to workConfiguring OpenVPN server (Debian 8) and client (Windows 10)tls error : tls handshake failedOpenVPN Client Local LAN AccessRouting and OpenVPN not running on the default gateway

When do you stop "pushing" a book?

Why is there a cap on 401k contributions?

Is there a need for better software for writers?

Does Thread.yield() do anything if we have enough processors to service all threads?

Is it safe to keep the GPU on 100% utilization for a very long time?

What are these round pads on the bottom of a PCB?

Are there vaccine ingredients which may not be disclosed ("hidden", "trade secret", or similar)?

Why do the Avengers care about returning these items in Endgame?

Best species to breed to intelligence

What is the Ancient One's mistake?

Locked my sa user out

What is the minimum required technology to reanimate someone who has been cryogenically frozen?

Integral with DiracDelta. Can Mathematica be made to solve this?

Origins of the "array like" strings in BASIC

What's the difference between "ricochet" and "bounce"?

Is there any evidence to support the claim that the United States was "suckered into WW1" by Zionists, made by Benjamin Freedman in his 1961 speech

What is the status of the three crises in the history of mathematics?

Are wands in any sort of book going to be too much like Harry Potter?

Can the president of the United States be guilty of insider trading?

Why did Missandei say this?

Why are thrust reversers not used to slow down to taxi speeds?

Two (probably) equal real numbers which are not proved to be equal?

How is Arya still alive?

"Estrontium" on poster



Access OpenVPN connection from local network through WAN IP?


Problems setting up a VPN: can connect but can't ping anyoneOpenVPN server will not redirect trafficOpenVPN connection from within 2nd subnet in office?openvpn: connection established, can't ping server tun interface (debian server, windows & os x clients)Connect AWS and Azure via OpenVPNHow to get OpenVPN Client (Mikrotik RouterOS) <-> OpenVPN server (Debian/Linux) setup to workConfiguring OpenVPN server (Debian 8) and client (Windows 10)tls error : tls handshake failedOpenVPN Client Local LAN AccessRouting and OpenVPN not running on the default gateway






.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;








0















I have 2 machines at home, one is a pine64 running a Debian linux and a desktop PC with windows 8.



I successfully installed openVPN server to the pine64 so I have a working setup, the openVPN service is accessible from the local network through the local IP address of the server, I tested the connection with my desktop PC.



The VPN is also working from the outside network through my router's WAN IP address, consequently the port 1994 is forwarded correctly to the openVPN host.



I also tested the connection from the outside network access with my cellphone (mobile network) and the openVPN connect client, everything went fine.



I would like to simulate/test the VPN access as it was an outside network from my desktop PC.
For example I want to check whether I could access my other other hosts in the network through SSH if I will be far away from my home network.



What I don't quite understand is why I cannot access my VPN server from the local network through the router's public WAN IP.



The 2 machines have static IPs on the same network:



desktop PC: 192.168.1.11



pine 64 (openVPN server): 192.168.1.20



let the router's public WAN IP be (for the sake of the example): 5.39.182.24



So I'm trying to access the openVPN server with the IP 5.39.182.24:1194, but unfortunately I am not able to.
There's no firewall setup on the PC or any other application I aware of that could disallow the connection.
Trying the same approach with my cellphone from the local network fails too, so it's proven that it is not strictly an issue of the desktop machine.



Here's the log I get from the openVPN client application



Mon Sep 12 20:31:08 2016 OpenVPN 2.3.12 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Aug 23 2016
Mon Sep 12 20:31:08 2016 Windows version 6.2 (Windows 8 or greater) 64bit
Mon Sep 12 20:31:08 2016 library versions: OpenSSL 1.0.1t 3 May 2016, LZO 2.09
Mon Sep 12 20:31:13 2016 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Mon Sep 12 20:31:13 2016 Control Channel Authentication: tls-auth using INLINE static key file
Mon Sep 12 20:31:13 2016 Attempting to establish TCP connection with [AF_INET]5.39.182.24:1194 [nonblock]
Mon Sep 12 20:31:23 2016 TCP: connect to [AF_INET]5.39.182.24:1194 failed, will try again in 5 seconds: Connection timed out (WSAETIMEDOUT)
Mon Sep 12 20:31:38 2016 TCP: connect to [AF_INET]5.39.182.24:1194 failed, will try again in 5 seconds: Connection timed out (WSAETIMEDOUT)


Server side settings



openVPN config



root@pine64:/etc# cat /etc/openvpn/server.conf
local 192.168.1.20 # SWAP THIS NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
dev tun
#proto udp #Some people prefer to use tcp. Don't change it if you don't know.
proto tcp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/pine64.crt # SWAP WITH YOUR CRT NAME
key /etc/openvpn/easy-rsa/keys/pine64.key # SWAP WITH YOUR KEY NAME
dh /etc/openvpn/easy-rsa/keys/dh2048.pem # If you changed to 2048, change that here!
server 10.8.0.0 255.255.255.0
# server and remote endpoints
ifconfig 10.8.0.1 10.8.0.2
# Add route to Client routing table for the OpenVPN Server
push "route 10.8.0.1 255.255.255.255"
# Add route to Client routing table for the OpenVPN Subnet
push "route 10.8.0.0 255.255.255.0"
# your local subnet
push "route 192.168.1.20 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
# Set primary domain name server address to the SOHO Router
# If your router does not do DNS, you can use Google DNS 8.8.8.8
#push "dhcp-option DNS 192.168.2.1" # This should already match your router address and not need to be changed.
push "dhcp-option DNS 8.8.8.8" # This should already match your router address and not need to be changed.
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 1


iptables



(exported the rules to a file with iptables-save)



root@pine64:/etc# cat /etc/iptables-firewall-rules.backup
# Generated by iptables-save v1.4.21 on Sun Sep 11 21:19:15 2016
*filter
:INPUT ACCEPT [16429:2363941]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [17426:8592638]
-A INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 1194 -j ACCEPT
-A INPUT -i tun+ -j ACCEPT
-A FORWARD -i tun+ -j ACCEPT
-A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o tun+ -j ACCEPT
COMMIT
# Completed on Sun Sep 11 21:19:15 2016
# Generated by iptables-save v1.4.21 on Sun Sep 11 21:19:15 2016
*nat
:PREROUTING ACCEPT [1172:103090]
:INPUT ACCEPT [157:31732]
:OUTPUT ACCEPT [205:14166]
:POSTROUTING ACCEPT [205:14166]
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.1.20
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.1.20
COMMIT
# Completed on Sun Sep 11 21:19:15 2016


Output of the route command



root@pine64:/etc# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default speedport.ip 0.0.0.0 UG 0 0 0 eth0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
10.8.0.2 * 255.255.255.255 UH 0 0 0 tun0
link-local * 255.255.0.0 U 1000 0 0 eth0
192.168.1.0 * 255.255.255.0 U 0 0 0 eth0


I hope someone could shed some light on this issue, I appreciate the help.










share|improve this question




























    0















    I have 2 machines at home, one is a pine64 running a Debian linux and a desktop PC with windows 8.



    I successfully installed openVPN server to the pine64 so I have a working setup, the openVPN service is accessible from the local network through the local IP address of the server, I tested the connection with my desktop PC.



    The VPN is also working from the outside network through my router's WAN IP address, consequently the port 1994 is forwarded correctly to the openVPN host.



    I also tested the connection from the outside network access with my cellphone (mobile network) and the openVPN connect client, everything went fine.



    I would like to simulate/test the VPN access as it was an outside network from my desktop PC.
    For example I want to check whether I could access my other other hosts in the network through SSH if I will be far away from my home network.



    What I don't quite understand is why I cannot access my VPN server from the local network through the router's public WAN IP.



    The 2 machines have static IPs on the same network:



    desktop PC: 192.168.1.11



    pine 64 (openVPN server): 192.168.1.20



    let the router's public WAN IP be (for the sake of the example): 5.39.182.24



    So I'm trying to access the openVPN server with the IP 5.39.182.24:1194, but unfortunately I am not able to.
    There's no firewall setup on the PC or any other application I aware of that could disallow the connection.
    Trying the same approach with my cellphone from the local network fails too, so it's proven that it is not strictly an issue of the desktop machine.



    Here's the log I get from the openVPN client application



    Mon Sep 12 20:31:08 2016 OpenVPN 2.3.12 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Aug 23 2016
    Mon Sep 12 20:31:08 2016 Windows version 6.2 (Windows 8 or greater) 64bit
    Mon Sep 12 20:31:08 2016 library versions: OpenSSL 1.0.1t 3 May 2016, LZO 2.09
    Mon Sep 12 20:31:13 2016 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
    Mon Sep 12 20:31:13 2016 Control Channel Authentication: tls-auth using INLINE static key file
    Mon Sep 12 20:31:13 2016 Attempting to establish TCP connection with [AF_INET]5.39.182.24:1194 [nonblock]
    Mon Sep 12 20:31:23 2016 TCP: connect to [AF_INET]5.39.182.24:1194 failed, will try again in 5 seconds: Connection timed out (WSAETIMEDOUT)
    Mon Sep 12 20:31:38 2016 TCP: connect to [AF_INET]5.39.182.24:1194 failed, will try again in 5 seconds: Connection timed out (WSAETIMEDOUT)


    Server side settings



    openVPN config



    root@pine64:/etc# cat /etc/openvpn/server.conf
    local 192.168.1.20 # SWAP THIS NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
    dev tun
    #proto udp #Some people prefer to use tcp. Don't change it if you don't know.
    proto tcp
    port 1194
    ca /etc/openvpn/easy-rsa/keys/ca.crt
    cert /etc/openvpn/easy-rsa/keys/pine64.crt # SWAP WITH YOUR CRT NAME
    key /etc/openvpn/easy-rsa/keys/pine64.key # SWAP WITH YOUR KEY NAME
    dh /etc/openvpn/easy-rsa/keys/dh2048.pem # If you changed to 2048, change that here!
    server 10.8.0.0 255.255.255.0
    # server and remote endpoints
    ifconfig 10.8.0.1 10.8.0.2
    # Add route to Client routing table for the OpenVPN Server
    push "route 10.8.0.1 255.255.255.255"
    # Add route to Client routing table for the OpenVPN Subnet
    push "route 10.8.0.0 255.255.255.0"
    # your local subnet
    push "route 192.168.1.20 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
    # Set primary domain name server address to the SOHO Router
    # If your router does not do DNS, you can use Google DNS 8.8.8.8
    #push "dhcp-option DNS 192.168.2.1" # This should already match your router address and not need to be changed.
    push "dhcp-option DNS 8.8.8.8" # This should already match your router address and not need to be changed.
    # Override the Client default gateway by using 0.0.0.0/1 and
    # 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
    # overriding but not wiping out the original default gateway.
    push "redirect-gateway def1"
    client-to-client
    duplicate-cn
    keepalive 10 120
    tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
    cipher AES-128-CBC
    comp-lzo
    user nobody
    group nogroup
    persist-key
    persist-tun
    status /var/log/openvpn-status.log 20
    log /var/log/openvpn.log
    verb 1


    iptables



    (exported the rules to a file with iptables-save)



    root@pine64:/etc# cat /etc/iptables-firewall-rules.backup
    # Generated by iptables-save v1.4.21 on Sun Sep 11 21:19:15 2016
    *filter
    :INPUT ACCEPT [16429:2363941]
    :FORWARD ACCEPT [0:0]
    :OUTPUT ACCEPT [17426:8592638]
    -A INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 1194 -j ACCEPT
    -A INPUT -i tun+ -j ACCEPT
    -A FORWARD -i tun+ -j ACCEPT
    -A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
    -A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
    -A OUTPUT -o tun+ -j ACCEPT
    COMMIT
    # Completed on Sun Sep 11 21:19:15 2016
    # Generated by iptables-save v1.4.21 on Sun Sep 11 21:19:15 2016
    *nat
    :PREROUTING ACCEPT [1172:103090]
    :INPUT ACCEPT [157:31732]
    :OUTPUT ACCEPT [205:14166]
    :POSTROUTING ACCEPT [205:14166]
    -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.1.20
    -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
    -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.1.20
    COMMIT
    # Completed on Sun Sep 11 21:19:15 2016


    Output of the route command



    root@pine64:/etc# route
    Kernel IP routing table
    Destination Gateway Genmask Flags Metric Ref Use Iface
    default speedport.ip 0.0.0.0 UG 0 0 0 eth0
    10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
    10.8.0.2 * 255.255.255.255 UH 0 0 0 tun0
    link-local * 255.255.0.0 U 1000 0 0 eth0
    192.168.1.0 * 255.255.255.0 U 0 0 0 eth0


    I hope someone could shed some light on this issue, I appreciate the help.










    share|improve this question
























      0












      0








      0








      I have 2 machines at home, one is a pine64 running a Debian linux and a desktop PC with windows 8.



      I successfully installed openVPN server to the pine64 so I have a working setup, the openVPN service is accessible from the local network through the local IP address of the server, I tested the connection with my desktop PC.



      The VPN is also working from the outside network through my router's WAN IP address, consequently the port 1994 is forwarded correctly to the openVPN host.



      I also tested the connection from the outside network access with my cellphone (mobile network) and the openVPN connect client, everything went fine.



      I would like to simulate/test the VPN access as it was an outside network from my desktop PC.
      For example I want to check whether I could access my other other hosts in the network through SSH if I will be far away from my home network.



      What I don't quite understand is why I cannot access my VPN server from the local network through the router's public WAN IP.



      The 2 machines have static IPs on the same network:



      desktop PC: 192.168.1.11



      pine 64 (openVPN server): 192.168.1.20



      let the router's public WAN IP be (for the sake of the example): 5.39.182.24



      So I'm trying to access the openVPN server with the IP 5.39.182.24:1194, but unfortunately I am not able to.
      There's no firewall setup on the PC or any other application I aware of that could disallow the connection.
      Trying the same approach with my cellphone from the local network fails too, so it's proven that it is not strictly an issue of the desktop machine.



      Here's the log I get from the openVPN client application



      Mon Sep 12 20:31:08 2016 OpenVPN 2.3.12 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Aug 23 2016
      Mon Sep 12 20:31:08 2016 Windows version 6.2 (Windows 8 or greater) 64bit
      Mon Sep 12 20:31:08 2016 library versions: OpenSSL 1.0.1t 3 May 2016, LZO 2.09
      Mon Sep 12 20:31:13 2016 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
      Mon Sep 12 20:31:13 2016 Control Channel Authentication: tls-auth using INLINE static key file
      Mon Sep 12 20:31:13 2016 Attempting to establish TCP connection with [AF_INET]5.39.182.24:1194 [nonblock]
      Mon Sep 12 20:31:23 2016 TCP: connect to [AF_INET]5.39.182.24:1194 failed, will try again in 5 seconds: Connection timed out (WSAETIMEDOUT)
      Mon Sep 12 20:31:38 2016 TCP: connect to [AF_INET]5.39.182.24:1194 failed, will try again in 5 seconds: Connection timed out (WSAETIMEDOUT)


      Server side settings



      openVPN config



      root@pine64:/etc# cat /etc/openvpn/server.conf
      local 192.168.1.20 # SWAP THIS NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
      dev tun
      #proto udp #Some people prefer to use tcp. Don't change it if you don't know.
      proto tcp
      port 1194
      ca /etc/openvpn/easy-rsa/keys/ca.crt
      cert /etc/openvpn/easy-rsa/keys/pine64.crt # SWAP WITH YOUR CRT NAME
      key /etc/openvpn/easy-rsa/keys/pine64.key # SWAP WITH YOUR KEY NAME
      dh /etc/openvpn/easy-rsa/keys/dh2048.pem # If you changed to 2048, change that here!
      server 10.8.0.0 255.255.255.0
      # server and remote endpoints
      ifconfig 10.8.0.1 10.8.0.2
      # Add route to Client routing table for the OpenVPN Server
      push "route 10.8.0.1 255.255.255.255"
      # Add route to Client routing table for the OpenVPN Subnet
      push "route 10.8.0.0 255.255.255.0"
      # your local subnet
      push "route 192.168.1.20 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
      # Set primary domain name server address to the SOHO Router
      # If your router does not do DNS, you can use Google DNS 8.8.8.8
      #push "dhcp-option DNS 192.168.2.1" # This should already match your router address and not need to be changed.
      push "dhcp-option DNS 8.8.8.8" # This should already match your router address and not need to be changed.
      # Override the Client default gateway by using 0.0.0.0/1 and
      # 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
      # overriding but not wiping out the original default gateway.
      push "redirect-gateway def1"
      client-to-client
      duplicate-cn
      keepalive 10 120
      tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
      cipher AES-128-CBC
      comp-lzo
      user nobody
      group nogroup
      persist-key
      persist-tun
      status /var/log/openvpn-status.log 20
      log /var/log/openvpn.log
      verb 1


      iptables



      (exported the rules to a file with iptables-save)



      root@pine64:/etc# cat /etc/iptables-firewall-rules.backup
      # Generated by iptables-save v1.4.21 on Sun Sep 11 21:19:15 2016
      *filter
      :INPUT ACCEPT [16429:2363941]
      :FORWARD ACCEPT [0:0]
      :OUTPUT ACCEPT [17426:8592638]
      -A INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 1194 -j ACCEPT
      -A INPUT -i tun+ -j ACCEPT
      -A FORWARD -i tun+ -j ACCEPT
      -A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
      -A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
      -A OUTPUT -o tun+ -j ACCEPT
      COMMIT
      # Completed on Sun Sep 11 21:19:15 2016
      # Generated by iptables-save v1.4.21 on Sun Sep 11 21:19:15 2016
      *nat
      :PREROUTING ACCEPT [1172:103090]
      :INPUT ACCEPT [157:31732]
      :OUTPUT ACCEPT [205:14166]
      :POSTROUTING ACCEPT [205:14166]
      -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.1.20
      -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
      -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.1.20
      COMMIT
      # Completed on Sun Sep 11 21:19:15 2016


      Output of the route command



      root@pine64:/etc# route
      Kernel IP routing table
      Destination Gateway Genmask Flags Metric Ref Use Iface
      default speedport.ip 0.0.0.0 UG 0 0 0 eth0
      10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
      10.8.0.2 * 255.255.255.255 UH 0 0 0 tun0
      link-local * 255.255.0.0 U 1000 0 0 eth0
      192.168.1.0 * 255.255.255.0 U 0 0 0 eth0


      I hope someone could shed some light on this issue, I appreciate the help.










      share|improve this question














      I have 2 machines at home, one is a pine64 running a Debian linux and a desktop PC with windows 8.



      I successfully installed openVPN server to the pine64 so I have a working setup, the openVPN service is accessible from the local network through the local IP address of the server, I tested the connection with my desktop PC.



      The VPN is also working from the outside network through my router's WAN IP address, consequently the port 1994 is forwarded correctly to the openVPN host.



      I also tested the connection from the outside network access with my cellphone (mobile network) and the openVPN connect client, everything went fine.



      I would like to simulate/test the VPN access as it was an outside network from my desktop PC.
      For example I want to check whether I could access my other other hosts in the network through SSH if I will be far away from my home network.



      What I don't quite understand is why I cannot access my VPN server from the local network through the router's public WAN IP.



      The 2 machines have static IPs on the same network:



      desktop PC: 192.168.1.11



      pine 64 (openVPN server): 192.168.1.20



      let the router's public WAN IP be (for the sake of the example): 5.39.182.24



      So I'm trying to access the openVPN server with the IP 5.39.182.24:1194, but unfortunately I am not able to.
      There's no firewall setup on the PC or any other application I aware of that could disallow the connection.
      Trying the same approach with my cellphone from the local network fails too, so it's proven that it is not strictly an issue of the desktop machine.



      Here's the log I get from the openVPN client application



      Mon Sep 12 20:31:08 2016 OpenVPN 2.3.12 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Aug 23 2016
      Mon Sep 12 20:31:08 2016 Windows version 6.2 (Windows 8 or greater) 64bit
      Mon Sep 12 20:31:08 2016 library versions: OpenSSL 1.0.1t 3 May 2016, LZO 2.09
      Mon Sep 12 20:31:13 2016 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
      Mon Sep 12 20:31:13 2016 Control Channel Authentication: tls-auth using INLINE static key file
      Mon Sep 12 20:31:13 2016 Attempting to establish TCP connection with [AF_INET]5.39.182.24:1194 [nonblock]
      Mon Sep 12 20:31:23 2016 TCP: connect to [AF_INET]5.39.182.24:1194 failed, will try again in 5 seconds: Connection timed out (WSAETIMEDOUT)
      Mon Sep 12 20:31:38 2016 TCP: connect to [AF_INET]5.39.182.24:1194 failed, will try again in 5 seconds: Connection timed out (WSAETIMEDOUT)


      Server side settings



      openVPN config



      root@pine64:/etc# cat /etc/openvpn/server.conf
      local 192.168.1.20 # SWAP THIS NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
      dev tun
      #proto udp #Some people prefer to use tcp. Don't change it if you don't know.
      proto tcp
      port 1194
      ca /etc/openvpn/easy-rsa/keys/ca.crt
      cert /etc/openvpn/easy-rsa/keys/pine64.crt # SWAP WITH YOUR CRT NAME
      key /etc/openvpn/easy-rsa/keys/pine64.key # SWAP WITH YOUR KEY NAME
      dh /etc/openvpn/easy-rsa/keys/dh2048.pem # If you changed to 2048, change that here!
      server 10.8.0.0 255.255.255.0
      # server and remote endpoints
      ifconfig 10.8.0.1 10.8.0.2
      # Add route to Client routing table for the OpenVPN Server
      push "route 10.8.0.1 255.255.255.255"
      # Add route to Client routing table for the OpenVPN Subnet
      push "route 10.8.0.0 255.255.255.0"
      # your local subnet
      push "route 192.168.1.20 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
      # Set primary domain name server address to the SOHO Router
      # If your router does not do DNS, you can use Google DNS 8.8.8.8
      #push "dhcp-option DNS 192.168.2.1" # This should already match your router address and not need to be changed.
      push "dhcp-option DNS 8.8.8.8" # This should already match your router address and not need to be changed.
      # Override the Client default gateway by using 0.0.0.0/1 and
      # 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
      # overriding but not wiping out the original default gateway.
      push "redirect-gateway def1"
      client-to-client
      duplicate-cn
      keepalive 10 120
      tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
      cipher AES-128-CBC
      comp-lzo
      user nobody
      group nogroup
      persist-key
      persist-tun
      status /var/log/openvpn-status.log 20
      log /var/log/openvpn.log
      verb 1


      iptables



      (exported the rules to a file with iptables-save)



      root@pine64:/etc# cat /etc/iptables-firewall-rules.backup
      # Generated by iptables-save v1.4.21 on Sun Sep 11 21:19:15 2016
      *filter
      :INPUT ACCEPT [16429:2363941]
      :FORWARD ACCEPT [0:0]
      :OUTPUT ACCEPT [17426:8592638]
      -A INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 1194 -j ACCEPT
      -A INPUT -i tun+ -j ACCEPT
      -A FORWARD -i tun+ -j ACCEPT
      -A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
      -A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
      -A OUTPUT -o tun+ -j ACCEPT
      COMMIT
      # Completed on Sun Sep 11 21:19:15 2016
      # Generated by iptables-save v1.4.21 on Sun Sep 11 21:19:15 2016
      *nat
      :PREROUTING ACCEPT [1172:103090]
      :INPUT ACCEPT [157:31732]
      :OUTPUT ACCEPT [205:14166]
      :POSTROUTING ACCEPT [205:14166]
      -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.1.20
      -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
      -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.1.20
      COMMIT
      # Completed on Sun Sep 11 21:19:15 2016


      Output of the route command



      root@pine64:/etc# route
      Kernel IP routing table
      Destination Gateway Genmask Flags Metric Ref Use Iface
      default speedport.ip 0.0.0.0 UG 0 0 0 eth0
      10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
      10.8.0.2 * 255.255.255.255 UH 0 0 0 tun0
      link-local * 255.255.0.0 U 1000 0 0 eth0
      192.168.1.0 * 255.255.255.0 U 0 0 0 eth0


      I hope someone could shed some light on this issue, I appreciate the help.







      openvpn router nat connection






      share|improve this question













      share|improve this question











      share|improve this question




      share|improve this question










      asked Sep 12 '16 at 18:57









      Szilárd NémethSzilárd Németh

      61




      61




















          1 Answer
          1






          active

          oldest

          votes


















          0














          You can not connect your VPN from the lan using the external IP because if you think about it for a second the purpose of the VPN is to connect two (or more) machines that are not in the same network but in your case they already are on the same network.






          share|improve this answer























          • I know that the purpose of the VPN is to connect two networks remotely, but it doesn't mean that technically it's not possible. I remember when I was working for a big telecommunication company, I could either use the VPN flawlessly from inside the local network and from a remote network as well. Do you have any reference the prove the contrary?

            – Szilárd Németh
            Sep 12 '16 at 21:09












          Your Answer








          StackExchange.ready(function()
          var channelOptions =
          tags: "".split(" "),
          id: "2"
          ;
          initTagRenderer("".split(" "), "".split(" "), channelOptions);

          StackExchange.using("externalEditor", function()
          // Have to fire editor after snippets, if snippets enabled
          if (StackExchange.settings.snippets.snippetsEnabled)
          StackExchange.using("snippets", function()
          createEditor();
          );

          else
          createEditor();

          );

          function createEditor()
          StackExchange.prepareEditor(
          heartbeatType: 'answer',
          autoActivateHeartbeat: false,
          convertImagesToLinks: true,
          noModals: true,
          showLowRepImageUploadWarning: true,
          reputationToPostImages: 10,
          bindNavPrevention: true,
          postfix: "",
          imageUploader:
          brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
          contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
          allowUrls: true
          ,
          onDemand: true,
          discardSelector: ".discard-answer"
          ,immediatelyShowMarkdownHelp:true
          );



          );













          draft saved

          draft discarded


















          StackExchange.ready(
          function ()
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f802644%2faccess-openvpn-connection-from-local-network-through-wan-ip%23new-answer', 'question_page');

          );

          Post as a guest















          Required, but never shown

























          1 Answer
          1






          active

          oldest

          votes








          1 Answer
          1






          active

          oldest

          votes









          active

          oldest

          votes






          active

          oldest

          votes









          0














          You can not connect your VPN from the lan using the external IP because if you think about it for a second the purpose of the VPN is to connect two (or more) machines that are not in the same network but in your case they already are on the same network.






          share|improve this answer























          • I know that the purpose of the VPN is to connect two networks remotely, but it doesn't mean that technically it's not possible. I remember when I was working for a big telecommunication company, I could either use the VPN flawlessly from inside the local network and from a remote network as well. Do you have any reference the prove the contrary?

            – Szilárd Németh
            Sep 12 '16 at 21:09
















          0














          You can not connect your VPN from the lan using the external IP because if you think about it for a second the purpose of the VPN is to connect two (or more) machines that are not in the same network but in your case they already are on the same network.






          share|improve this answer























          • I know that the purpose of the VPN is to connect two networks remotely, but it doesn't mean that technically it's not possible. I remember when I was working for a big telecommunication company, I could either use the VPN flawlessly from inside the local network and from a remote network as well. Do you have any reference the prove the contrary?

            – Szilárd Németh
            Sep 12 '16 at 21:09














          0












          0








          0







          You can not connect your VPN from the lan using the external IP because if you think about it for a second the purpose of the VPN is to connect two (or more) machines that are not in the same network but in your case they already are on the same network.






          share|improve this answer













          You can not connect your VPN from the lan using the external IP because if you think about it for a second the purpose of the VPN is to connect two (or more) machines that are not in the same network but in your case they already are on the same network.







          share|improve this answer












          share|improve this answer



          share|improve this answer










          answered Sep 12 '16 at 19:24









          sebastienvgsebastienvg

          894




          894












          • I know that the purpose of the VPN is to connect two networks remotely, but it doesn't mean that technically it's not possible. I remember when I was working for a big telecommunication company, I could either use the VPN flawlessly from inside the local network and from a remote network as well. Do you have any reference the prove the contrary?

            – Szilárd Németh
            Sep 12 '16 at 21:09


















          • I know that the purpose of the VPN is to connect two networks remotely, but it doesn't mean that technically it's not possible. I remember when I was working for a big telecommunication company, I could either use the VPN flawlessly from inside the local network and from a remote network as well. Do you have any reference the prove the contrary?

            – Szilárd Németh
            Sep 12 '16 at 21:09

















          I know that the purpose of the VPN is to connect two networks remotely, but it doesn't mean that technically it's not possible. I remember when I was working for a big telecommunication company, I could either use the VPN flawlessly from inside the local network and from a remote network as well. Do you have any reference the prove the contrary?

          – Szilárd Németh
          Sep 12 '16 at 21:09






          I know that the purpose of the VPN is to connect two networks remotely, but it doesn't mean that technically it's not possible. I remember when I was working for a big telecommunication company, I could either use the VPN flawlessly from inside the local network and from a remote network as well. Do you have any reference the prove the contrary?

          – Szilárd Németh
          Sep 12 '16 at 21:09


















          draft saved

          draft discarded
















































          Thanks for contributing an answer to Server Fault!


          • Please be sure to answer the question. Provide details and share your research!

          But avoid


          • Asking for help, clarification, or responding to other answers.

          • Making statements based on opinion; back them up with references or personal experience.

          To learn more, see our tips on writing great answers.




          draft saved


          draft discarded














          StackExchange.ready(
          function ()
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f802644%2faccess-openvpn-connection-from-local-network-through-wan-ip%23new-answer', 'question_page');

          );

          Post as a guest















          Required, but never shown





















































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown

































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown







          Popular posts from this blog

          Club Baloncesto Breogán Índice Historia | Pavillón | Nome | O Breogán na cultura popular | Xogadores | Adestradores | Presidentes | Palmarés | Historial | Líderes | Notas | Véxase tamén | Menú de navegacióncbbreogan.galCadroGuía oficial da ACB 2009-10, páxina 201Guía oficial ACB 1992, páxina 183. Editorial DB.É de 6.500 espectadores sentados axeitándose á última normativa"Estudiantes Junior, entre as mellores canteiras"o orixinalHemeroteca El Mundo Deportivo, 16 setembro de 1970, páxina 12Historia do BreogánAlfredo Pérez, o último canoneiroHistoria C.B. BreogánHemeroteca de El Mundo DeportivoJimmy Wright, norteamericano do Breogán deixará Lugo por ameazas de morteResultados de Breogán en 1986-87Resultados de Breogán en 1990-91Ficha de Velimir Perasović en acb.comResultados de Breogán en 1994-95Breogán arrasa al Barça. "El Mundo Deportivo", 27 de setembro de 1999, páxina 58CB Breogán - FC BarcelonaA FEB invita a participar nunha nova Liga EuropeaCharlie Bell na prensa estatalMáximos anotadores 2005Tempada 2005-06 : Tódolos Xogadores da Xornada""Non quero pensar nunha man negra, mais pregúntome que está a pasar""o orixinalRaúl López, orgulloso dos xogadores, presume da boa saúde económica do BreogánJulio González confirma que cesa como presidente del BreogánHomenaxe a Lisardo GómezA tempada do rexurdimento celesteEntrevista a Lisardo GómezEl COB dinamita el Pazo para forzar el quinto (69-73)Cafés Candelas, patrocinador del CB Breogán"Suso Lázare, novo presidente do Breogán"o orixinalCafés Candelas Breogán firma el mayor triunfo de la historiaEl Breogán realizará 17 homenajes por su cincuenta aniversario"O Breogán honra ao seu fundador e primeiro presidente"o orixinalMiguel Giao recibiu a homenaxe do PazoHomenaxe aos primeiros gladiadores celestesO home que nos amosa como ver o Breo co corazónTita Franco será homenaxeada polos #50anosdeBreoJulio Vila recibirá unha homenaxe in memoriam polos #50anosdeBreo"O Breogán homenaxeará aos seus aboados máis veteráns"Pechada ovación a «Capi» Sanmartín e Ricardo «Corazón de González»Homenaxe por décadas de informaciónPaco García volve ao Pazo con motivo do 50 aniversario"Resultados y clasificaciones""O Cafés Candelas Breogán, campión da Copa Princesa""O Cafés Candelas Breogán, equipo ACB"C.B. Breogán"Proxecto social"o orixinal"Centros asociados"o orixinalFicha en imdb.comMario Camus trata la recuperación del amor en 'La vieja música', su última película"Páxina web oficial""Club Baloncesto Breogán""C. B. Breogán S.A.D."eehttp://www.fegaba.com

          Vilaño, A Laracha Índice Patrimonio | Lugares e parroquias | Véxase tamén | Menú de navegación43°14′52″N 8°36′03″O / 43.24775, -8.60070

          Cegueira Índice Epidemioloxía | Deficiencia visual | Tipos de cegueira | Principais causas de cegueira | Tratamento | Técnicas de adaptación e axudas | Vida dos cegos | Primeiros auxilios | Crenzas respecto das persoas cegas | Crenzas das persoas cegas | O neno deficiente visual | Aspectos psicolóxicos da cegueira | Notas | Véxase tamén | Menú de navegación54.054.154.436928256blindnessDicionario da Real Academia GalegaPortal das Palabras"International Standards: Visual Standards — Aspects and Ranges of Vision Loss with Emphasis on Population Surveys.""Visual impairment and blindness""Presentan un plan para previr a cegueira"o orixinalACCDV Associació Catalana de Cecs i Disminuïts Visuals - PMFTrachoma"Effect of gene therapy on visual function in Leber's congenital amaurosis"1844137110.1056/NEJMoa0802268Cans guía - os mellores amigos dos cegosArquivadoEscola de cans guía para cegos en Mortágua, PortugalArquivado"Tecnología para ciegos y deficientes visuales. Recopilación de recursos gratuitos en la Red""Colorino""‘COL.diesis’, escuchar los sonidos del color""COL.diesis: Transforming Colour into Melody and Implementing the Result in a Colour Sensor Device"o orixinal"Sistema de desarrollo de sinestesia color-sonido para invidentes utilizando un protocolo de audio""Enseñanza táctil - geometría y color. Juegos didácticos para niños ciegos y videntes""Sistema Constanz"L'ocupació laboral dels cecs a l'Estat espanyol està pràcticament equiparada a la de les persones amb visió, entrevista amb Pedro ZuritaONCE (Organización Nacional de Cegos de España)Prevención da cegueiraDescrición de deficiencias visuais (Disc@pnet)Braillín, un boneco atractivo para calquera neno, con ou sen discapacidade, que permite familiarizarse co sistema de escritura e lectura brailleAxudas Técnicas36838ID00897494007150-90057129528256DOID:1432HP:0000618D001766C10.597.751.941.162C97109C0155020