[Support] Cannot get OpenVPN to connect

[ashaychangwani]

---

name: Support Request
about: Request support from PiVPN comunity
title: "[Support] Cannot get OpenVPN to connect"
labels: ''
assignees: ''

---

In raising this issue, I confirm the following:

{please fill the checkboxes, e.g: [X]}

• I have read the documentation
• I have read and understood the contributors guide.
• The issue I am reporting can be replicated.
• The issue I am reporting can be is directly related to the pivpn installer script.

Have you searched for similar issues and solutions?

(yes/no / which issues?)

Yes, I have tried just about all solutions to check if my port is open and if the forwarding is working correctly.

Has your install failed?

no

Please provide your system information

What type of hardware are you running PiVPN at?

Raspberrypi 4

Output of uname -a

  Linux raspberrypi 5.10.63-v7l+ #1488 SMP Thu Nov 18 16:15:28 GMT 2021 armv7l GNU/Linux

Output of cat /etc/os-release

  PRETTY_NAME="Raspbian GNU/Linux 11 (bullseye)"
NAME="Raspbian GNU/Linux"
VERSION_ID="11"
VERSION="11 (bullseye)"
VERSION_CODENAME=bullseye
ID=raspbian
ID_LIKE=debian
HOME_URL="http://www.raspbian.org/"
SUPPORT_URL="http://www.raspbian.org/RaspbianForums"
BUG_REPORT_URL="http://www.raspbian.org/RaspbianBugs"

Issue

I have been trying to setup OpenVPN however, even though it seems everything is working on the server side, I am unable to connect to it at all. I have ensured that my port forwarding is theoretically correct and commands like nc and nmap report 1194 as open/filtered as well. Yet, I am completely stuck since the past few days on how to get OpenVPN to work.

Console output of curl -L install.pivpn.io | bash

 % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100    17  100    17    0     0     42      0 --:--:-- --:--:-- --:--:--    42
100   162  100   162    0     0    167      0 --:--:-- --:--:-- --:--:--   411
100 82818  100 82818    0     0  72204      0  0:00:01  0:00:01 --:--:-- 72204
:::
::: sudo will be used for the install.
::: Repair option selected.
::: Hostname length OK
::: Verifying free disk space...
:::
::: Package Cache update is needed, running apt-get update -y ...
 done!
:::
::: Checking apt-get for upgraded packages.... done!
:::
::: Your system is up to date! Continuing with PiVPN installation...
:::    Checking for git... already installed!
:::    Checking for tar... already installed!
:::    Checking for curl... already installed!
:::    Checking for grep... already installed!
:::    Checking for dnsutils... already installed!
:::    Checking for whiptail... already installed!
:::    Checking for net-tools... already installed!
:::    Checking for bsdmainutils... already installed!
:::    Checking for bash-completion... already installed!
:::    Checking for dhcpcd5... already installed!
:::    Checking for iptables-persistent... already installed!
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
::: PiVPN Automated Installer
::: This installer will transform your Raspbian host into an OpenVPN or WireGuard server!
::: Initiating network interface
::: Using interface: eth0
::: Your static IPv4 address:    192.168.1.146/24
::: Your static IPv4 gateway:    192.168.1.1
::: Static IP already configured.
::: pi will hold your ovpn configurations.
:::
::: Checking for existing base files...
:::    Checking /usr/local/src/pivpn is a repo... OK!
::: Repairing an existing installation, not downloading/updating local repos
::: OpenVPN will be installed
::: Installing OpenVPN from Debian package... 
:::    Checking for openvpn... already installed!
:::    Checking for grepcidr... already installed!
:::    Checking for expect... already installed!
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
::: Using the udp protocol
::: Using port 1194
::: Using DNS 208.67.222.222 208.67.220.220
::: Skipping custom domain
::: Using domain name ashaychangwani.mynetgear.com
::: Using OpenVPN 2.4 features
::: Using a 256-bit certificate
::: Backing up the openvpn folder to /etc/openvpn_2022-01-09-011723.tar.gz

::: Building CA...
Using SSL: openssl OpenSSL 1.1.1k  25 Mar 2021
read EC key
writing EC key


::: CA Complete.
::: The server key and HMAC key will now be generated.

Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars
Using SSL: openssl OpenSSL 1.1.1k  25 Mar 2021
Generating an EC private key
writing new private key to '/etc/openvpn/easy-rsa/pki/easy-rsa-17138.VAV8Wm/tmp.6Fnu6g'
-----
Using configuration from /etc/openvpn/easy-rsa/pki/easy-rsa-17138.VAV8Wm/tmp.hn2M1E
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :ASN.1 12:'raspberrypi_5b5d04c2-0d4e-414a-a52e-5109b39d1836'
Certificate is to be certified until Jan  6 19:47:25 2032 GMT (3650 days)

Write out database with 1 new entries
Data Base Updated

2022-01-09 01:17:25 WARNING: Using --genkey --secret filename is DEPRECATED.  Use --genkey secret filename instead.

Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars
Using SSL: openssl OpenSSL 1.1.1k  25 Mar 2021
Using configuration from /etc/openvpn/easy-rsa/pki/easy-rsa-17219.U9oRhN/tmp.dVbD6A

An updated CRL has been created.
CRL file: /etc/openvpn/easy-rsa/pki/crl.pem


openvpn:x:115:124::/var/lib/openvpn/:/usr/sbin/nologin
::: Install Complete...
::: Restarting services...
::: Enabling unattended upgrades
:::    Checking for unattended-upgrades... already installed!
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
::: Setupfiles copied to /etc/pivpn/openvpn/setupVars.conf
::: Installing scripts to /opt/pivpn...
 done.
::: Flushing writes to disk...
::: done.
::: Installation Complete!
::: Now run 'pivpn add' to create the client profiles.
::: Run 'pivpn help' to see what else you can do!

::: If you run into any issue, please read all our documentation carefully.
::: All incomplete posts or bug reports will be ignored or deleted.

::: Thank you for using PiVPN.
::: It is strongly recommended you reboot after installation.
:::

Console output of pivpn debug

::: Generating Debug Output
::::		PiVPN debug		 ::::
=============================================
::::		Latest commit		 ::::
Branch: master
Commit: f80b0a7962d91862132c0a4abd65c1e67bd37bd7
Author: 4s3ti
Date: Fri Dec 3 21:41:13 2021 +0100
Summary: Update Changelog
=============================================
::::	    Installation settings    	 ::::
PLAT=Raspbian
OSCN=bullseye
USING_UFW=0
IPv4dev=eth0
dhcpReserv=
IPv4addr=192.168.1.146/24
IPv4gw=192.168.1.1
install_user=pi
install_home=/home/pi
VPN=openvpn
pivpnPROTO=udp
pivpnPORT=1194
pivpnDNS1=208.67.222.222
pivpnDNS2=208.67.220.220
pivpnSEARCHDOMAIN=
pivpnHOST=REDACTED
TWO_POINT_FOUR=1
pivpnENCRYPT=256
USE_PREDEFINED_DH_PARAM=0
INPUT_CHAIN_EDITED=0
FORWARD_CHAIN_EDITED=0
pivpnDEV=tun0
pivpnNET=10.8.0.0
subnetClass=24
ALLOWED_IPS=""
UNATTUPG=1
INSTALLED_PACKAGES=(openvpn)
=============================================
::::  Server configuration shown below   ::::
dev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/pki/ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/raspberrypi_5b5d04c2-0d4e-414a-a52e-5109b39d1836.crt
key /etc/openvpn/easy-rsa/pki/private/raspberrypi_5b5d04c2-0d4e-414a-a52e-5109b39d1836.key
dh none
ecdh-curve prime256v1
topology subnet
server 10.8.0.0 255.255.255.0
# Set your primary domain name server address for clients
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
# Prevent DNS leaks on Windows
push "block-outside-dns"
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
client-config-dir /etc/openvpn/ccd
keepalive 15 120
remote-cert-tls client
tls-version-min 1.2
tls-crypt /etc/openvpn/easy-rsa/pki/ta.key
cipher AES-256-CBC
auth SHA256
user openvpn
group openvpn
persist-key
persist-tun
crl-verify /etc/openvpn/crl.pem
status /var/log/openvpn-status.log 20
status-version 3
syslog
verb 3
#DuplicateCNs allow access control on a less-granular, per user basis.
#Remove # if you will manage access by user instead of device. 
#duplicate-cn
# Generated for use by PiVPN.io
=============================================
::::  Client template file shown below   ::::
client
dev tun
proto udp
remote REDACTED 1194
resolv-retry infinite
nobind
remote-cert-tls server
tls-version-min 1.2
verify-x509-name raspberrypi_5b5d04c2-0d4e-414a-a52e-5109b39d1836 name
cipher AES-256-CBC
auth SHA256
auth-nocache
verb 3
=============================================
:::: 	Recursive list of files in	 ::::
::: /etc/openvpn/easy-rsa/pki shows below :::
/etc/openvpn/easy-rsa/pki/:
ca.crt
crl.pem
Default.txt
ecparams
index.txt
index.txt.attr
index.txt.attr.old
index.txt.old
issued
openssl-easyrsa.cnf
private
renewed
revoked
safessl-easyrsa.cnf
serial
serial.old
ta.key

/etc/openvpn/easy-rsa/pki/ecparams:
prime256v1.pem

/etc/openvpn/easy-rsa/pki/issued:
raspberrypi_5b5d04c2-0d4e-414a-a52e-5109b39d1836.crt

/etc/openvpn/easy-rsa/pki/private:
ca.key
raspberrypi_5b5d04c2-0d4e-414a-a52e-5109b39d1836.key

/etc/openvpn/easy-rsa/pki/renewed:
private_by_serial
reqs_by_serial

/etc/openvpn/easy-rsa/pki/renewed/private_by_serial:

/etc/openvpn/easy-rsa/pki/renewed/reqs_by_serial:

/etc/openvpn/easy-rsa/pki/revoked:
private_by_serial
reqs_by_serial

/etc/openvpn/easy-rsa/pki/revoked/private_by_serial:

/etc/openvpn/easy-rsa/pki/revoked/reqs_by_serial:
=============================================
::::		Self check		 ::::
:: [OK] IP forwarding is enabled
:: [OK] Iptables MASQUERADE rule set
:: [OK] OpenVPN is running
:: [OK] OpenVPN is enabled (it will automatically start on reboot)
:: [OK] OpenVPN is listening on port 1194/udp
=============================================
:::: Having trouble connecting? Take a look at the FAQ:
:::: https://docs.pivpn.io/faq
=============================================
::::      Snippet of the server log      ::::
Jan  9 01:17:29 raspberrypi ovpn-server[17384]: NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Jan  9 01:17:29 raspberrypi ovpn-server[17384]: CRL: loaded 1 CRLs from file /etc/openvpn/crl.pem
Jan  9 01:17:29 raspberrypi ovpn-server[17384]: ECDH curve prime256v1 added
Jan  9 01:17:29 raspberrypi ovpn-server[17384]: Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Jan  9 01:17:29 raspberrypi ovpn-server[17384]: Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Jan  9 01:17:29 raspberrypi ovpn-server[17384]: Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Jan  9 01:17:29 raspberrypi ovpn-server[17384]: Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Jan  9 01:17:29 raspberrypi ovpn-server[17384]: TUN/TAP device tun0 opened
Jan  9 01:17:29 raspberrypi ovpn-server[17384]: net_iface_mtu_set: mtu 1500 for tun0
Jan  9 01:17:29 raspberrypi ovpn-server[17384]: net_iface_up: set tun0 up
Jan  9 01:17:29 raspberrypi ovpn-server[17384]: net_addr_v4_add: 10.8.0.1/24 dev tun0
Jan  9 01:17:29 raspberrypi ovpn-server[17384]: Could not determine IPv4/IPv6 protocol. Using AF_INET
Jan  9 01:17:29 raspberrypi ovpn-server[17384]: Socket Buffers: R=[180224->180224] S=[180224->180224]
Jan  9 01:17:29 raspberrypi ovpn-server[17384]: UDPv4 link local (bound): [AF_INET][undef]:1194
Jan  9 01:17:29 raspberrypi ovpn-server[17384]: UDPv4 link remote: [AF_UNSPEC]
Jan  9 01:17:29 raspberrypi ovpn-server[17384]: GID set to openvpn
Jan  9 01:17:29 raspberrypi ovpn-server[17384]: UID set to openvpn
Jan  9 01:17:29 raspberrypi ovpn-server[17384]: MULTI: multi_init called, r=256 v=256
Jan  9 01:17:29 raspberrypi ovpn-server[17384]: IFCONFIG POOL IPv4: base=10.8.0.2 size=252
Jan  9 01:17:29 raspberrypi ovpn-server[17384]: Initialization Sequence Completed
=============================================
::::		Debug complete		 ::::
::: 
::: Debug output completed above.
::: Copy saved to /tmp/debug.log
::: 

Have you taken any steps towards solving your issue?

Reinstall PiVPN, tried multiple guides to get it to work. Checked port forwarding.

[coolapso]

Are you sure your ISP is not putting you behind a NAT? your description sounds a lot like it.

When the client tries to connect, do you get any error? which?

Moving this to discussions.

[ashaychangwani]

Are you sure your ISP is not putting you behind a NAT? your description sounds a lot like it.

I am not sure. How can I check that? My IP address on whatsmyip and under my router's Internet port->IP Address is different. Am I under a CGNAT?

When the client tries to connect, do you get any error? which?

Connection Timeout always

Is there any way to resolve this?

[coolapso]

Check with your ISP.