2

I am trying to use OpenVPN Connect (the official OpenVPN app) on Android.

I import the profile and everything seems to be correct until I notice that traffic is not passing trough the VPN. The status is displayed as connected, and there is some data passing trough, but obviously not everything (i tried 720p video for a couple of minutes but the app's traffic counter still shows something like 20 kilobytes).

enter image description here

The VPN appears in android's VPN settings,

enter image description here

but apparently I can't use it as Always-on VPN.

enter image description here

My goal is to be able to route all traffic trough the VPN.

My server config (OpenWRT uci config format):

config openvpn 'myvpn'
        option user nobody
        option group nogroup
        option keepalive '10 120'
        option persist_key 1
        option persist_tun 1
        option enabled '1'
        option verb '3'
        option port '1195'
        option proto 'udp'
        option server '10.8.0.0 255.255.255.0'
        option push "redirect-gateway def1"
        option push "dhcp-option DNS <router dns ip>"
        option ca '/etc/openvpn/ca.crt'
        option cert '/etc/openvpn/my-server.crt'
        option key '/etc/openvpn/my-server.key'
        option dh '/etc/openvpn/dh1024.pem'
        option dev 'tun0'
        option log_append '/var/log/openvpn.log'
        option status '/var/log/openvpn-status.log'

My client .ovpn profile:

dev tun
proto udp

log openvpn.log
verb 3

ca ca.crt.pem
cert my-client.crt.pem
key my-client.key.pem

client
remote-cert-tls server
remote <router wan ip> 1195

PS: I'm obviously new here, thanks in advance for directing me somewhere more appropriate if this is not the right community.

  • I see that you are from France. If you are with Orange then you cannot connect to your external IP from within the network (see this thread - in French). – WoJ Nov 3 '16 at 17:18
1

I think the issue lies in your OVPN profile. I see your server IP address is an internal 192.x.x.x address rather than a DDNS or external IP address.

I notice you're also connected to WiFi, which I'm assuming is at home / wherever you set up your VPN server. I imagine if you disconnect it'll give you an error?

It may be a simple matter of just changing the IP address in your OVPN file under remote x.x.x.x 1194 assuming 1194 is the port you've chosen and x.x.x.x is your public IP.

You should ensure that you have port forwarding set up on your router also, and the server will correctly forward your traffic.

This guide is comprehensive, and although its based on Ubuntu 14.04, it translates pretty well to other flavours OpenVPN Ubuntu 14.04 set up guide

  • Thanks for suggestions. There's one thing that's weird though: shouldn't I be unable to connect to internet or whatever network I forward to at all if the routing is wrong? Because I still have an internet connection, it just doesn't pass trough VPN. I.E. In OpenVPN Connect I have Seamless Tunnel enabled, but it has no effect. – Ivan Aug 3 '16 at 20:43
  • Its difficult to say without knowing how you've set it up. In your service configuration file, have you uncommented ;push "redirect-gateway def1 bypass-dhcp" which allows your server to pass traffic on? – 1ntgr Aug 4 '16 at 14:36
  • Had a bunch of things wrong with my config, "something is wrong with the profile" sums it up. – Ivan Oct 28 '17 at 2:43
0

Missing key/cert direction in server and client configuration is the first possible issue I see from looking at the posted configurations.

tls-auth ${Var_ovpns_ta_path} 0

above for server and below for client should have ${VAR_*} modified to where the key is located on each file system and 0 vs 1 is important for configurations

tls-auth ${Var_ovpnc_ta_path} 1
key-direction 1

Client configuration lines ending with .pem looks odd to me, ya may want to double check that those files exist or look into a "unified" client config setup; here's a script for these kinds of client configurations that was released this month, however, it may need editing for your environment.

Also try increasing the verbosity of both client and server in order to generate error logs and edit your question to include them if above suggestions didn't work.

verb 3

Last check that your forwarding rules/iptables are allowing clients back out once they've connected; above mentioned script should help with that too.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.