FOOD FOR THOUGHT OpenVPN Client Can't Access Internet Sites

[wardmundy]

UPDATE: On some cell phones and on Windows and Linux platforms, you may observe that you can no longer reach your favorite web sites after enabling the OpenVPN client. Luckily there’s a simple fix that allows 10.8.0.x traffic to be sent through the OpenVPN tunnel while all other traffic is routed out of your standard network connection. Here’s the fix.

Make sure the .ovpn client config file includes the following lines:

pull-filter ignore redirect-gateway
route-nopull
route 10.8.0.0 255.255.255.0

 

[ostridge]

UPDATE: On some cell phones and on Windows and Linux platforms, you may observe that you can no longer reach your favorite web sites after enabling the OpenVPN client. Luckily there’s a simple fix that allows 10.8.0.x traffic to be sent through the OpenVPN tunnel while all other traffic is routed out of your standard network connection. Here’s the fix.

Make sure the .ovpn client config file includes the following lines:

pull-filter ignore redirect-gateway
route-nopull
route 10.8.0.0 255.255.255.0

I already had the lines (from the sids in the MOD script -

"pull-filter ignore redirect-gateway"
# as well as the route 10.8.--
route 10.8.0.0 255.255.255.0

after adding 'route-nopull' (but while vpn already UP ) , realising need to stop openvpn to restart.

On a couple of unsuccessful stop commands and maybe a service networking restart, it blew away the route -4 table. Happily I had previously enabled ipv6 to play with, and was able to ip route add and I'm still wondering why and how I got bitten.

Found a link here - but will read further -
Overriding a pushed "route" in the client's config throws an error

Now I was happily using the vpn from my PC by routing PC > thro the RPi4b i2021 > 10.0.0.2xx Oracle-Ubuntu
And thro Pi -ipv4 > 192.168.1.1 router > inetv4. While PC inetv6 > fe80::1 router using 2a02:: /64 prefix.

I have commented out the route-nopull for now until I know what is what.

P.S. The router (ipv46) is on dynamic IPv4 with fqdn.dyn updater. so far not noticed any DN time.

And Oh I noticed that pbxstatus ward had was testing for OVPN - which test does that use??

 

[wardmundy]

And Oh I noticed that pbxstatus ward had was testing for OVPN - which test does that use??

I just replaced nrservice with openvpn and adjusted the display from NR VPN to OpenVPN while deleting a space to the left of NR VPN.

As for OpenVPN routing, my test machine was Windows 11 and the route command alone didn't work. Not sure where I found the route-nopull tip, but that solved it. YMMV.

 

[ostridge]

I just replaced nrservice with openvpn and adjusted the display from NR VPN to OpenVPN while deleting a space to the left of NR VPN.

As for OpenVPN routing, my test machine was Windows 11 and the route command alone didn't work. Not sure where I found the route-nopull tip, but that solved it. YMMV.

I reckoned on it being simples so here is a few of sed lines for the update and installer files

#!/bin/bash
#filename pbxstatus-update-for-OpenVPN
echo " "
echo "    pbxstatus-update-for-OpenVPN"
 sed -i 's/nrservice/openvpn/' /usr/local/sbin/pbxstatus
 sed -i 's/nrclient/vpn/' /usr/local/sbin/pbxstatus
 sed -i '/TOP=/s/knockd   /knockd  /' /usr/local/sbin/pbxstatus
 sed -i '/TOP=/s/ZbNR VPN/ZbOpenVPN/' /usr/local/sbin/pbxstatus