Access OpenVPN connection from local network through WAN IP?Problems setting up a VPN: can connect but can't ping anyoneOpenVPN server will not redirect trafficOpenVPN connection from within 2nd subnet in office?openvpn: connection established, can't ping server tun interface (debian server, windows & os x clients)Connect AWS and Azure via OpenVPNHow to get OpenVPN Client (Mikrotik RouterOS) <-> OpenVPN server (Debian/Linux) setup to workConfiguring OpenVPN server (Debian 8) and client (Windows 10)tls error : tls handshake failedOpenVPN Client Local LAN AccessRouting and OpenVPN not running on the default gateway

When do you stop "pushing" a book?

Why is there a cap on 401k contributions?

Is there a need for better software for writers?

Does Thread.yield() do anything if we have enough processors to service all threads?

Is it safe to keep the GPU on 100% utilization for a very long time?

What are these round pads on the bottom of a PCB?

Are there vaccine ingredients which may not be disclosed ("hidden", "trade secret", or similar)?

Why do the Avengers care about returning these items in Endgame?

Best species to breed to intelligence

What is the Ancient One's mistake?

Locked my sa user out

What is the minimum required technology to reanimate someone who has been cryogenically frozen?

Integral with DiracDelta. Can Mathematica be made to solve this?

Origins of the "array like" strings in BASIC

What's the difference between "ricochet" and "bounce"?

Is there any evidence to support the claim that the United States was "suckered into WW1" by Zionists, made by Benjamin Freedman in his 1961 speech

What is the status of the three crises in the history of mathematics?

Are wands in any sort of book going to be too much like Harry Potter?

Can the president of the United States be guilty of insider trading?

Why did Missandei say this?

Why are thrust reversers not used to slow down to taxi speeds?

Two (probably) equal real numbers which are not proved to be equal?

How is Arya still alive?

"Estrontium" on poster



Access OpenVPN connection from local network through WAN IP?


Problems setting up a VPN: can connect but can't ping anyoneOpenVPN server will not redirect trafficOpenVPN connection from within 2nd subnet in office?openvpn: connection established, can't ping server tun interface (debian server, windows & os x clients)Connect AWS and Azure via OpenVPNHow to get OpenVPN Client (Mikrotik RouterOS) <-> OpenVPN server (Debian/Linux) setup to workConfiguring OpenVPN server (Debian 8) and client (Windows 10)tls error : tls handshake failedOpenVPN Client Local LAN AccessRouting and OpenVPN not running on the default gateway






.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;








0















I have 2 machines at home, one is a pine64 running a Debian linux and a desktop PC with windows 8.



I successfully installed openVPN server to the pine64 so I have a working setup, the openVPN service is accessible from the local network through the local IP address of the server, I tested the connection with my desktop PC.



The VPN is also working from the outside network through my router's WAN IP address, consequently the port 1994 is forwarded correctly to the openVPN host.



I also tested the connection from the outside network access with my cellphone (mobile network) and the openVPN connect client, everything went fine.



I would like to simulate/test the VPN access as it was an outside network from my desktop PC.
For example I want to check whether I could access my other other hosts in the network through SSH if I will be far away from my home network.



What I don't quite understand is why I cannot access my VPN server from the local network through the router's public WAN IP.



The 2 machines have static IPs on the same network:



desktop PC: 192.168.1.11



pine 64 (openVPN server): 192.168.1.20



let the router's public WAN IP be (for the sake of the example): 5.39.182.24



So I'm trying to access the openVPN server with the IP 5.39.182.24:1194, but unfortunately I am not able to.
There's no firewall setup on the PC or any other application I aware of that could disallow the connection.
Trying the same approach with my cellphone from the local network fails too, so it's proven that it is not strictly an issue of the desktop machine.



Here's the log I get from the openVPN client application



Mon Sep 12 20:31:08 2016 OpenVPN 2.3.12 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Aug 23 2016
Mon Sep 12 20:31:08 2016 Windows version 6.2 (Windows 8 or greater) 64bit
Mon Sep 12 20:31:08 2016 library versions: OpenSSL 1.0.1t 3 May 2016, LZO 2.09
Mon Sep 12 20:31:13 2016 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Mon Sep 12 20:31:13 2016 Control Channel Authentication: tls-auth using INLINE static key file
Mon Sep 12 20:31:13 2016 Attempting to establish TCP connection with [AF_INET]5.39.182.24:1194 [nonblock]
Mon Sep 12 20:31:23 2016 TCP: connect to [AF_INET]5.39.182.24:1194 failed, will try again in 5 seconds: Connection timed out (WSAETIMEDOUT)
Mon Sep 12 20:31:38 2016 TCP: connect to [AF_INET]5.39.182.24:1194 failed, will try again in 5 seconds: Connection timed out (WSAETIMEDOUT)


Server side settings



openVPN config



root@pine64:/etc# cat /etc/openvpn/server.conf
local 192.168.1.20 # SWAP THIS NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
dev tun
#proto udp #Some people prefer to use tcp. Don't change it if you don't know.
proto tcp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/pine64.crt # SWAP WITH YOUR CRT NAME
key /etc/openvpn/easy-rsa/keys/pine64.key # SWAP WITH YOUR KEY NAME
dh /etc/openvpn/easy-rsa/keys/dh2048.pem # If you changed to 2048, change that here!
server 10.8.0.0 255.255.255.0
# server and remote endpoints
ifconfig 10.8.0.1 10.8.0.2
# Add route to Client routing table for the OpenVPN Server
push "route 10.8.0.1 255.255.255.255"
# Add route to Client routing table for the OpenVPN Subnet
push "route 10.8.0.0 255.255.255.0"
# your local subnet
push "route 192.168.1.20 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
# Set primary domain name server address to the SOHO Router
# If your router does not do DNS, you can use Google DNS 8.8.8.8
#push "dhcp-option DNS 192.168.2.1" # This should already match your router address and not need to be changed.
push "dhcp-option DNS 8.8.8.8" # This should already match your router address and not need to be changed.
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 1


iptables



(exported the rules to a file with iptables-save)



root@pine64:/etc# cat /etc/iptables-firewall-rules.backup
# Generated by iptables-save v1.4.21 on Sun Sep 11 21:19:15 2016
*filter
:INPUT ACCEPT [16429:2363941]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [17426:8592638]
-A INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 1194 -j ACCEPT
-A INPUT -i tun+ -j ACCEPT
-A FORWARD -i tun+ -j ACCEPT
-A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o tun+ -j ACCEPT
COMMIT
# Completed on Sun Sep 11 21:19:15 2016
# Generated by iptables-save v1.4.21 on Sun Sep 11 21:19:15 2016
*nat
:PREROUTING ACCEPT [1172:103090]
:INPUT ACCEPT [157:31732]
:OUTPUT ACCEPT [205:14166]
:POSTROUTING ACCEPT [205:14166]
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.1.20
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.1.20
COMMIT
# Completed on Sun Sep 11 21:19:15 2016


Output of the route command



root@pine64:/etc# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default speedport.ip 0.0.0.0 UG 0 0 0 eth0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
10.8.0.2 * 255.255.255.255 UH 0 0 0 tun0
link-local * 255.255.0.0 U 1000 0 0 eth0
192.168.1.0 * 255.255.255.0 U 0 0 0 eth0


I hope someone could shed some light on this issue, I appreciate the help.










share|improve this question




























    0















    I have 2 machines at home, one is a pine64 running a Debian linux and a desktop PC with windows 8.



    I successfully installed openVPN server to the pine64 so I have a working setup, the openVPN service is accessible from the local network through the local IP address of the server, I tested the connection with my desktop PC.



    The VPN is also working from the outside network through my router's WAN IP address, consequently the port 1994 is forwarded correctly to the openVPN host.



    I also tested the connection from the outside network access with my cellphone (mobile network) and the openVPN connect client, everything went fine.



    I would like to simulate/test the VPN access as it was an outside network from my desktop PC.
    For example I want to check whether I could access my other other hosts in the network through SSH if I will be far away from my home network.



    What I don't quite understand is why I cannot access my VPN server from the local network through the router's public WAN IP.



    The 2 machines have static IPs on the same network:



    desktop PC: 192.168.1.11



    pine 64 (openVPN server): 192.168.1.20



    let the router's public WAN IP be (for the sake of the example): 5.39.182.24



    So I'm trying to access the openVPN server with the IP 5.39.182.24:1194, but unfortunately I am not able to.
    There's no firewall setup on the PC or any other application I aware of that could disallow the connection.
    Trying the same approach with my cellphone from the local network fails too, so it's proven that it is not strictly an issue of the desktop machine.



    Here's the log I get from the openVPN client application



    Mon Sep 12 20:31:08 2016 OpenVPN 2.3.12 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Aug 23 2016
    Mon Sep 12 20:31:08 2016 Windows version 6.2 (Windows 8 or greater) 64bit
    Mon Sep 12 20:31:08 2016 library versions: OpenSSL 1.0.1t 3 May 2016, LZO 2.09
    Mon Sep 12 20:31:13 2016 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
    Mon Sep 12 20:31:13 2016 Control Channel Authentication: tls-auth using INLINE static key file
    Mon Sep 12 20:31:13 2016 Attempting to establish TCP connection with [AF_INET]5.39.182.24:1194 [nonblock]
    Mon Sep 12 20:31:23 2016 TCP: connect to [AF_INET]5.39.182.24:1194 failed, will try again in 5 seconds: Connection timed out (WSAETIMEDOUT)
    Mon Sep 12 20:31:38 2016 TCP: connect to [AF_INET]5.39.182.24:1194 failed, will try again in 5 seconds: Connection timed out (WSAETIMEDOUT)


    Server side settings



    openVPN config



    root@pine64:/etc# cat /etc/openvpn/server.conf
    local 192.168.1.20 # SWAP THIS NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
    dev tun
    #proto udp #Some people prefer to use tcp. Don't change it if you don't know.
    proto tcp
    port 1194
    ca /etc/openvpn/easy-rsa/keys/ca.crt
    cert /etc/openvpn/easy-rsa/keys/pine64.crt # SWAP WITH YOUR CRT NAME
    key /etc/openvpn/easy-rsa/keys/pine64.key # SWAP WITH YOUR KEY NAME
    dh /etc/openvpn/easy-rsa/keys/dh2048.pem # If you changed to 2048, change that here!
    server 10.8.0.0 255.255.255.0
    # server and remote endpoints
    ifconfig 10.8.0.1 10.8.0.2
    # Add route to Client routing table for the OpenVPN Server
    push "route 10.8.0.1 255.255.255.255"
    # Add route to Client routing table for the OpenVPN Subnet
    push "route 10.8.0.0 255.255.255.0"
    # your local subnet
    push "route 192.168.1.20 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
    # Set primary domain name server address to the SOHO Router
    # If your router does not do DNS, you can use Google DNS 8.8.8.8
    #push "dhcp-option DNS 192.168.2.1" # This should already match your router address and not need to be changed.
    push "dhcp-option DNS 8.8.8.8" # This should already match your router address and not need to be changed.
    # Override the Client default gateway by using 0.0.0.0/1 and
    # 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
    # overriding but not wiping out the original default gateway.
    push "redirect-gateway def1"
    client-to-client
    duplicate-cn
    keepalive 10 120
    tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
    cipher AES-128-CBC
    comp-lzo
    user nobody
    group nogroup
    persist-key
    persist-tun
    status /var/log/openvpn-status.log 20
    log /var/log/openvpn.log
    verb 1


    iptables



    (exported the rules to a file with iptables-save)



    root@pine64:/etc# cat /etc/iptables-firewall-rules.backup
    # Generated by iptables-save v1.4.21 on Sun Sep 11 21:19:15 2016
    *filter
    :INPUT ACCEPT [16429:2363941]
    :FORWARD ACCEPT [0:0]
    :OUTPUT ACCEPT [17426:8592638]
    -A INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 1194 -j ACCEPT
    -A INPUT -i tun+ -j ACCEPT
    -A FORWARD -i tun+ -j ACCEPT
    -A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
    -A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
    -A OUTPUT -o tun+ -j ACCEPT
    COMMIT
    # Completed on Sun Sep 11 21:19:15 2016
    # Generated by iptables-save v1.4.21 on Sun Sep 11 21:19:15 2016
    *nat
    :PREROUTING ACCEPT [1172:103090]
    :INPUT ACCEPT [157:31732]
    :OUTPUT ACCEPT [205:14166]
    :POSTROUTING ACCEPT [205:14166]
    -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.1.20
    -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
    -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.1.20
    COMMIT
    # Completed on Sun Sep 11 21:19:15 2016


    Output of the route command



    root@pine64:/etc# route
    Kernel IP routing table
    Destination Gateway Genmask Flags Metric Ref Use Iface
    default speedport.ip 0.0.0.0 UG 0 0 0 eth0
    10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
    10.8.0.2 * 255.255.255.255 UH 0 0 0 tun0
    link-local * 255.255.0.0 U 1000 0 0 eth0
    192.168.1.0 * 255.255.255.0 U 0 0 0 eth0


    I hope someone could shed some light on this issue, I appreciate the help.










    share|improve this question
























      0












      0








      0








      I have 2 machines at home, one is a pine64 running a Debian linux and a desktop PC with windows 8.



      I successfully installed openVPN server to the pine64 so I have a working setup, the openVPN service is accessible from the local network through the local IP address of the server, I tested the connection with my desktop PC.



      The VPN is also working from the outside network through my router's WAN IP address, consequently the port 1994 is forwarded correctly to the openVPN host.



      I also tested the connection from the outside network access with my cellphone (mobile network) and the openVPN connect client, everything went fine.



      I would like to simulate/test the VPN access as it was an outside network from my desktop PC.
      For example I want to check whether I could access my other other hosts in the network through SSH if I will be far away from my home network.



      What I don't quite understand is why I cannot access my VPN server from the local network through the router's public WAN IP.



      The 2 machines have static IPs on the same network:



      desktop PC: 192.168.1.11



      pine 64 (openVPN server): 192.168.1.20



      let the router's public WAN IP be (for the sake of the example): 5.39.182.24



      So I'm trying to access the openVPN server with the IP 5.39.182.24:1194, but unfortunately I am not able to.
      There's no firewall setup on the PC or any other application I aware of that could disallow the connection.
      Trying the same approach with my cellphone from the local network fails too, so it's proven that it is not strictly an issue of the desktop machine.



      Here's the log I get from the openVPN client application



      Mon Sep 12 20:31:08 2016 OpenVPN 2.3.12 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Aug 23 2016
      Mon Sep 12 20:31:08 2016 Windows version 6.2 (Windows 8 or greater) 64bit
      Mon Sep 12 20:31:08 2016 library versions: OpenSSL 1.0.1t 3 May 2016, LZO 2.09
      Mon Sep 12 20:31:13 2016 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
      Mon Sep 12 20:31:13 2016 Control Channel Authentication: tls-auth using INLINE static key file
      Mon Sep 12 20:31:13 2016 Attempting to establish TCP connection with [AF_INET]5.39.182.24:1194 [nonblock]
      Mon Sep 12 20:31:23 2016 TCP: connect to [AF_INET]5.39.182.24:1194 failed, will try again in 5 seconds: Connection timed out (WSAETIMEDOUT)
      Mon Sep 12 20:31:38 2016 TCP: connect to [AF_INET]5.39.182.24:1194 failed, will try again in 5 seconds: Connection timed out (WSAETIMEDOUT)


      Server side settings



      openVPN config



      root@pine64:/etc# cat /etc/openvpn/server.conf
      local 192.168.1.20 # SWAP THIS NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
      dev tun
      #proto udp #Some people prefer to use tcp. Don't change it if you don't know.
      proto tcp
      port 1194
      ca /etc/openvpn/easy-rsa/keys/ca.crt
      cert /etc/openvpn/easy-rsa/keys/pine64.crt # SWAP WITH YOUR CRT NAME
      key /etc/openvpn/easy-rsa/keys/pine64.key # SWAP WITH YOUR KEY NAME
      dh /etc/openvpn/easy-rsa/keys/dh2048.pem # If you changed to 2048, change that here!
      server 10.8.0.0 255.255.255.0
      # server and remote endpoints
      ifconfig 10.8.0.1 10.8.0.2
      # Add route to Client routing table for the OpenVPN Server
      push "route 10.8.0.1 255.255.255.255"
      # Add route to Client routing table for the OpenVPN Subnet
      push "route 10.8.0.0 255.255.255.0"
      # your local subnet
      push "route 192.168.1.20 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
      # Set primary domain name server address to the SOHO Router
      # If your router does not do DNS, you can use Google DNS 8.8.8.8
      #push "dhcp-option DNS 192.168.2.1" # This should already match your router address and not need to be changed.
      push "dhcp-option DNS 8.8.8.8" # This should already match your router address and not need to be changed.
      # Override the Client default gateway by using 0.0.0.0/1 and
      # 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
      # overriding but not wiping out the original default gateway.
      push "redirect-gateway def1"
      client-to-client
      duplicate-cn
      keepalive 10 120
      tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
      cipher AES-128-CBC
      comp-lzo
      user nobody
      group nogroup
      persist-key
      persist-tun
      status /var/log/openvpn-status.log 20
      log /var/log/openvpn.log
      verb 1


      iptables



      (exported the rules to a file with iptables-save)



      root@pine64:/etc# cat /etc/iptables-firewall-rules.backup
      # Generated by iptables-save v1.4.21 on Sun Sep 11 21:19:15 2016
      *filter
      :INPUT ACCEPT [16429:2363941]
      :FORWARD ACCEPT [0:0]
      :OUTPUT ACCEPT [17426:8592638]
      -A INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 1194 -j ACCEPT
      -A INPUT -i tun+ -j ACCEPT
      -A FORWARD -i tun+ -j ACCEPT
      -A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
      -A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
      -A OUTPUT -o tun+ -j ACCEPT
      COMMIT
      # Completed on Sun Sep 11 21:19:15 2016
      # Generated by iptables-save v1.4.21 on Sun Sep 11 21:19:15 2016
      *nat
      :PREROUTING ACCEPT [1172:103090]
      :INPUT ACCEPT [157:31732]
      :OUTPUT ACCEPT [205:14166]
      :POSTROUTING ACCEPT [205:14166]
      -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.1.20
      -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
      -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.1.20
      COMMIT
      # Completed on Sun Sep 11 21:19:15 2016


      Output of the route command



      root@pine64:/etc# route
      Kernel IP routing table
      Destination Gateway Genmask Flags Metric Ref Use Iface
      default speedport.ip 0.0.0.0 UG 0 0 0 eth0
      10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
      10.8.0.2 * 255.255.255.255 UH 0 0 0 tun0
      link-local * 255.255.0.0 U 1000 0 0 eth0
      192.168.1.0 * 255.255.255.0 U 0 0 0 eth0


      I hope someone could shed some light on this issue, I appreciate the help.










      share|improve this question














      I have 2 machines at home, one is a pine64 running a Debian linux and a desktop PC with windows 8.



      I successfully installed openVPN server to the pine64 so I have a working setup, the openVPN service is accessible from the local network through the local IP address of the server, I tested the connection with my desktop PC.



      The VPN is also working from the outside network through my router's WAN IP address, consequently the port 1994 is forwarded correctly to the openVPN host.



      I also tested the connection from the outside network access with my cellphone (mobile network) and the openVPN connect client, everything went fine.



      I would like to simulate/test the VPN access as it was an outside network from my desktop PC.
      For example I want to check whether I could access my other other hosts in the network through SSH if I will be far away from my home network.



      What I don't quite understand is why I cannot access my VPN server from the local network through the router's public WAN IP.



      The 2 machines have static IPs on the same network:



      desktop PC: 192.168.1.11



      pine 64 (openVPN server): 192.168.1.20



      let the router's public WAN IP be (for the sake of the example): 5.39.182.24



      So I'm trying to access the openVPN server with the IP 5.39.182.24:1194, but unfortunately I am not able to.
      There's no firewall setup on the PC or any other application I aware of that could disallow the connection.
      Trying the same approach with my cellphone from the local network fails too, so it's proven that it is not strictly an issue of the desktop machine.



      Here's the log I get from the openVPN client application



      Mon Sep 12 20:31:08 2016 OpenVPN 2.3.12 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Aug 23 2016
      Mon Sep 12 20:31:08 2016 Windows version 6.2 (Windows 8 or greater) 64bit
      Mon Sep 12 20:31:08 2016 library versions: OpenSSL 1.0.1t 3 May 2016, LZO 2.09
      Mon Sep 12 20:31:13 2016 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
      Mon Sep 12 20:31:13 2016 Control Channel Authentication: tls-auth using INLINE static key file
      Mon Sep 12 20:31:13 2016 Attempting to establish TCP connection with [AF_INET]5.39.182.24:1194 [nonblock]
      Mon Sep 12 20:31:23 2016 TCP: connect to [AF_INET]5.39.182.24:1194 failed, will try again in 5 seconds: Connection timed out (WSAETIMEDOUT)
      Mon Sep 12 20:31:38 2016 TCP: connect to [AF_INET]5.39.182.24:1194 failed, will try again in 5 seconds: Connection timed out (WSAETIMEDOUT)


      Server side settings



      openVPN config



      root@pine64:/etc# cat /etc/openvpn/server.conf
      local 192.168.1.20 # SWAP THIS NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
      dev tun
      #proto udp #Some people prefer to use tcp. Don't change it if you don't know.
      proto tcp
      port 1194
      ca /etc/openvpn/easy-rsa/keys/ca.crt
      cert /etc/openvpn/easy-rsa/keys/pine64.crt # SWAP WITH YOUR CRT NAME
      key /etc/openvpn/easy-rsa/keys/pine64.key # SWAP WITH YOUR KEY NAME
      dh /etc/openvpn/easy-rsa/keys/dh2048.pem # If you changed to 2048, change that here!
      server 10.8.0.0 255.255.255.0
      # server and remote endpoints
      ifconfig 10.8.0.1 10.8.0.2
      # Add route to Client routing table for the OpenVPN Server
      push "route 10.8.0.1 255.255.255.255"
      # Add route to Client routing table for the OpenVPN Subnet
      push "route 10.8.0.0 255.255.255.0"
      # your local subnet
      push "route 192.168.1.20 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
      # Set primary domain name server address to the SOHO Router
      # If your router does not do DNS, you can use Google DNS 8.8.8.8
      #push "dhcp-option DNS 192.168.2.1" # This should already match your router address and not need to be changed.
      push "dhcp-option DNS 8.8.8.8" # This should already match your router address and not need to be changed.
      # Override the Client default gateway by using 0.0.0.0/1 and
      # 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
      # overriding but not wiping out the original default gateway.
      push "redirect-gateway def1"
      client-to-client
      duplicate-cn
      keepalive 10 120
      tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
      cipher AES-128-CBC
      comp-lzo
      user nobody
      group nogroup
      persist-key
      persist-tun
      status /var/log/openvpn-status.log 20
      log /var/log/openvpn.log
      verb 1


      iptables



      (exported the rules to a file with iptables-save)



      root@pine64:/etc# cat /etc/iptables-firewall-rules.backup
      # Generated by iptables-save v1.4.21 on Sun Sep 11 21:19:15 2016
      *filter
      :INPUT ACCEPT [16429:2363941]
      :FORWARD ACCEPT [0:0]
      :OUTPUT ACCEPT [17426:8592638]
      -A INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 1194 -j ACCEPT
      -A INPUT -i tun+ -j ACCEPT
      -A FORWARD -i tun+ -j ACCEPT
      -A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
      -A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
      -A OUTPUT -o tun+ -j ACCEPT
      COMMIT
      # Completed on Sun Sep 11 21:19:15 2016
      # Generated by iptables-save v1.4.21 on Sun Sep 11 21:19:15 2016
      *nat
      :PREROUTING ACCEPT [1172:103090]
      :INPUT ACCEPT [157:31732]
      :OUTPUT ACCEPT [205:14166]
      :POSTROUTING ACCEPT [205:14166]
      -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.1.20
      -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
      -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.1.20
      COMMIT
      # Completed on Sun Sep 11 21:19:15 2016


      Output of the route command



      root@pine64:/etc# route
      Kernel IP routing table
      Destination Gateway Genmask Flags Metric Ref Use Iface
      default speedport.ip 0.0.0.0 UG 0 0 0 eth0
      10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
      10.8.0.2 * 255.255.255.255 UH 0 0 0 tun0
      link-local * 255.255.0.0 U 1000 0 0 eth0
      192.168.1.0 * 255.255.255.0 U 0 0 0 eth0


      I hope someone could shed some light on this issue, I appreciate the help.







      openvpn router nat connection






      share|improve this question













      share|improve this question











      share|improve this question




      share|improve this question










      asked Sep 12 '16 at 18:57









      Szilárd NémethSzilárd Németh

      61




      61




















          1 Answer
          1






          active

          oldest

          votes


















          0














          You can not connect your VPN from the lan using the external IP because if you think about it for a second the purpose of the VPN is to connect two (or more) machines that are not in the same network but in your case they already are on the same network.






          share|improve this answer























          • I know that the purpose of the VPN is to connect two networks remotely, but it doesn't mean that technically it's not possible. I remember when I was working for a big telecommunication company, I could either use the VPN flawlessly from inside the local network and from a remote network as well. Do you have any reference the prove the contrary?

            – Szilárd Németh
            Sep 12 '16 at 21:09












          Your Answer








          StackExchange.ready(function()
          var channelOptions =
          tags: "".split(" "),
          id: "2"
          ;
          initTagRenderer("".split(" "), "".split(" "), channelOptions);

          StackExchange.using("externalEditor", function()
          // Have to fire editor after snippets, if snippets enabled
          if (StackExchange.settings.snippets.snippetsEnabled)
          StackExchange.using("snippets", function()
          createEditor();
          );

          else
          createEditor();

          );

          function createEditor()
          StackExchange.prepareEditor(
          heartbeatType: 'answer',
          autoActivateHeartbeat: false,
          convertImagesToLinks: true,
          noModals: true,
          showLowRepImageUploadWarning: true,
          reputationToPostImages: 10,
          bindNavPrevention: true,
          postfix: "",
          imageUploader:
          brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
          contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
          allowUrls: true
          ,
          onDemand: true,
          discardSelector: ".discard-answer"
          ,immediatelyShowMarkdownHelp:true
          );



          );













          draft saved

          draft discarded


















          StackExchange.ready(
          function ()
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f802644%2faccess-openvpn-connection-from-local-network-through-wan-ip%23new-answer', 'question_page');

          );

          Post as a guest















          Required, but never shown

























          1 Answer
          1






          active

          oldest

          votes








          1 Answer
          1






          active

          oldest

          votes









          active

          oldest

          votes






          active

          oldest

          votes









          0














          You can not connect your VPN from the lan using the external IP because if you think about it for a second the purpose of the VPN is to connect two (or more) machines that are not in the same network but in your case they already are on the same network.






          share|improve this answer























          • I know that the purpose of the VPN is to connect two networks remotely, but it doesn't mean that technically it's not possible. I remember when I was working for a big telecommunication company, I could either use the VPN flawlessly from inside the local network and from a remote network as well. Do you have any reference the prove the contrary?

            – Szilárd Németh
            Sep 12 '16 at 21:09
















          0














          You can not connect your VPN from the lan using the external IP because if you think about it for a second the purpose of the VPN is to connect two (or more) machines that are not in the same network but in your case they already are on the same network.






          share|improve this answer























          • I know that the purpose of the VPN is to connect two networks remotely, but it doesn't mean that technically it's not possible. I remember when I was working for a big telecommunication company, I could either use the VPN flawlessly from inside the local network and from a remote network as well. Do you have any reference the prove the contrary?

            – Szilárd Németh
            Sep 12 '16 at 21:09














          0












          0








          0







          You can not connect your VPN from the lan using the external IP because if you think about it for a second the purpose of the VPN is to connect two (or more) machines that are not in the same network but in your case they already are on the same network.






          share|improve this answer













          You can not connect your VPN from the lan using the external IP because if you think about it for a second the purpose of the VPN is to connect two (or more) machines that are not in the same network but in your case they already are on the same network.







          share|improve this answer












          share|improve this answer



          share|improve this answer










          answered Sep 12 '16 at 19:24









          sebastienvgsebastienvg

          894




          894












          • I know that the purpose of the VPN is to connect two networks remotely, but it doesn't mean that technically it's not possible. I remember when I was working for a big telecommunication company, I could either use the VPN flawlessly from inside the local network and from a remote network as well. Do you have any reference the prove the contrary?

            – Szilárd Németh
            Sep 12 '16 at 21:09


















          • I know that the purpose of the VPN is to connect two networks remotely, but it doesn't mean that technically it's not possible. I remember when I was working for a big telecommunication company, I could either use the VPN flawlessly from inside the local network and from a remote network as well. Do you have any reference the prove the contrary?

            – Szilárd Németh
            Sep 12 '16 at 21:09

















          I know that the purpose of the VPN is to connect two networks remotely, but it doesn't mean that technically it's not possible. I remember when I was working for a big telecommunication company, I could either use the VPN flawlessly from inside the local network and from a remote network as well. Do you have any reference the prove the contrary?

          – Szilárd Németh
          Sep 12 '16 at 21:09






          I know that the purpose of the VPN is to connect two networks remotely, but it doesn't mean that technically it's not possible. I remember when I was working for a big telecommunication company, I could either use the VPN flawlessly from inside the local network and from a remote network as well. Do you have any reference the prove the contrary?

          – Szilárd Németh
          Sep 12 '16 at 21:09


















          draft saved

          draft discarded
















































          Thanks for contributing an answer to Server Fault!


          • Please be sure to answer the question. Provide details and share your research!

          But avoid


          • Asking for help, clarification, or responding to other answers.

          • Making statements based on opinion; back them up with references or personal experience.

          To learn more, see our tips on writing great answers.




          draft saved


          draft discarded














          StackExchange.ready(
          function ()
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f802644%2faccess-openvpn-connection-from-local-network-through-wan-ip%23new-answer', 'question_page');

          );

          Post as a guest















          Required, but never shown





















































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown

































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown







          Popular posts from this blog

          Wikipedia:Vital articles Мазмуну Biography - Өмүр баян Philosophy and psychology - Философия жана психология Religion - Дин Social sciences - Коомдук илимдер Language and literature - Тил жана адабият Science - Илим Technology - Технология Arts and recreation - Искусство жана эс алуу History and geography - Тарых жана география Навигация менюсу

          Bruxelas-Capital Índice Historia | Composición | Situación lingüística | Clima | Cidades irmandadas | Notas | Véxase tamén | Menú de navegacióneO uso das linguas en Bruxelas e a situación do neerlandés"Rexión de Bruxelas Capital"o orixinalSitio da rexiónPáxina de Bruselas no sitio da Oficina de Promoción Turística de Valonia e BruxelasMapa Interactivo da Rexión de Bruxelas-CapitaleeWorldCat332144929079854441105155190212ID28008674080552-90000 0001 0666 3698n94104302ID540940339365017018237

          What should I write in an apology letter, since I have decided not to join a company after accepting an offer letterShould I keep looking after accepting a job offer?What should I do when I've been verbally told I would get an offer letter, but still haven't gotten one after 4 weeks?Do I accept an offer from a company that I am not likely to join?New job hasn't confirmed starting date and I want to give current employer as much notice as possibleHow should I address my manager in my resignation letter?HR delayed background verification, now jobless as resignedNo email communication after accepting a formal written offer. How should I phrase the call?What should I do if after receiving a verbal offer letter I am informed that my written job offer is put on hold due to some internal issues?Should I inform the current employer that I am about to resign within 1-2 weeks since I have signed the offer letter and waiting for visa?What company will do, if I send their offer letter to another company