Openvpn with tap cannot ping anything, Securefishnet or openvpn from the terminal works

[erikderzweite]

REPRODUCIBILITY: Always
OS VERSION: 4.4.0.64
HARDWARE: Xperia XA2
UI LANGUAGE: German
REGRESSION: Don’t know

DESCRIPTION:

After using standard GUI to connect to my openvpn server I cannot see any other addresses.

PRECONDITIONS:

.ovpn file is created on the server (which is a docker image) and downloaded to the Xperia XA2

client
nobind
dev tap
remote-cert-tls server

remote server.tld 1194 udp

<key>
-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----
</key>
<cert>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</cert>
<ca>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</ca>
key-direction 1
<tls-auth>
-----BEGIN OpenVPN Static key V1-----
...
-----END OpenVPN Static key V1-----
</tls-auth>

redirect-gateway def1

Config on the server:

server 192.168.255.0 255.255.255.0
verb 3
key /etc/openvpn/pki/private/domain.tld.key
ca /etc/openvpn/pki/ca.crt
cert /etc/openvpn/pki/issued/domain.tld.crt
dh /etc/openvpn/pki/dh.pem
tls-auth /etc/openvpn/pki/ta.key
key-direction 0
keepalive 10 60
persist-key
persist-tun
proto udp
port 1194
dev tap0
mode p2p
status /tmp/openvpn-status.log
user nobody
group nogroup
comp-lzo no
route 192.168.0.0 255.255.255.0
push "block-outside-dns"
push "dhcp-option DNS 172.21.0.2"
push "comp-lzo no"
push "redirect-gateway def1"
client-config-dir /etc/openvpn/ccd
client-to-client
ifconfig-pool-persist /etc/openvpn/ipp.txt
mssfix 1430
cipher AES-256-GCM

STEPS TO REPRODUCE:

1. create .ovpn client as shown above
2. connect via Sailfish VPN GUI

EXPECTED RESULT:

Connection established

ACTUAL RESULT:

Network device vpn0 is created and assigned correct address, but nothing can be pinged or accessed.

MODIFICATIONS:

None, fresh install

ADDITIONAL INFORMATION:

openvpn from command line (as devel-su) and Securefishnet both work with the .ovpn file. Looks like connman issue to me.

[thigg]

By nothing can be pinged you mean outside adresses, e.g. google?
Can you ping internal addresses, e.g. the router in the vpn?

[erikderzweite]

By “nothing” i mean “anything but localhost”. Routes seem to be set correctly, but I can ping neither DNS server (which is a pihole in the VPN network) nor gateway.

[nephros]

Maybe a stupid question, but ICMP is allowed through the firewall?

[Inte]

I’d suggest broken routing. I remember having similar issues and I think I was able to solve them by adjusting routing settings.

[Inte]

Maybe you can find some additional info here:

Open vpn routing issue

I have issues connecting to a open vpn server I’m running myself. I can connect frim both a linux PC and an embedded device running linux/mips and all connections are routed through the vpn. I copied the credentials to my SfOS phone. After the connection was established, all traffic is routed through the vpn as well on my pc as on my embedded device. The vpn is connecting from my jolla as well. However, traffic is not routed through the vpn on my jolla, even when i invoke openvpn manually u…

[nephros]

No it isn’t, usually:

Enable ping to SFOS/firewall settings

Ping is a ICMP Echo Request (i.e. ICMP Type 8, Code 0). Incomimg packets are blocked in /etc/connman/firewall.d/10-block-icmp-firewall.conf or more precisely, all other ICMP packets are allowed over there, the chain’s policy is DROP: IPv4.INPUT.RULES = -p icmp -m icmp ! --icmp-type 8/0 -j ACCEPT

[martinh]

Some ICMP messages are required for proper networking. By default Linux e.g. has Path-MTU-Discovery enabled and that requires ICMP “Destination Unreachable Fragmentation Needed” messages to come through. That’s why only Echo Requests are blocked.