OpenVPN port is not open/reachable from outside

[c_korn]

I'm not sure i understand what you did exactly, so how are are you using the vserver in the middle? I'm assuming you setup a client in the vserver to connect to pivpn, and then connected to the vserver. Have you tried connecting directly to pivpn from your phone or another device?

The problem is, that my ISP only gives me an IPv6 address. So to also be able to connect to the OpenVPN from outside where no IPv6 is available (like on my mobile phone) I need to connect to an IPv4 address (my vServer) which then routes the connection to my openvpn server on the PI using IPv6.
To do this, I run this command on my vServer:

Code: Select all

socat -d -d UDP4-LISTEN:443,fork,su=nobody UDP6:xxx.xxx:1294

In the openvpn profile I then insert the IPv4 of the vServer on port 443 which should then route the connection to my PI.

And this leads to the output in the log that I posted.

When I use the profile on my computer to directlyconnect to my PI on port 1294 (udp6) and the local IPv6 address it works.

[default_user8]

Ok, I'm not exactly sure but I don't think openvpn protocol will allow a VPN connection through a relay(ie. your vserver) since VPN is an endpoint to endpoint encrypted connection. I searched online but I couldn't confirm this. I don't know if this will help you with what you are trying to accomplish, but you could try setting up an openvpn client on your vserver that connects to your pivpn server. You could then connect to your vserver and have an encrypted tunnel from the server to your home network. But that's a bit of overkill since there are easier ways to do the same. At this point I'd suggest you look into ddwrt or openwrt software for your router. You may be able to setup a router with and ipv4 to ipv6 bridge that will let you connect directly to your pi. Also wireguard may work for you instead of openvpn, however I have never successfully set up a wireguard server.

[c_korn]

Thanks for your continuous help.

I am still having problems setting everything up.
What I know did was creating an ovpn profile on my PI which I know use on my vServer.
I also installed openvpn directly on the vServer using the same script and created a profile for my mobile phone.

The idea is (when I understand correctly) to connect with openvpn from the vServer to my PI.
And use the profile from the vServer to connect through it into my network.

The good news is, my mobile phone successfully connects to the openvpn on my vServer.
But from there I cannot connect to any local IP address in my network. (do IPv4 addresses even work here
or do I have to use IPv6?).

Also when I launch "openvpn --config netcup.ovpn 2>&1 | tee openvpn.log" on the vSercer to connect to my PI I lose connection to my vServer and can only reboot it with my control panel.
This is the openvpn.log file.

Code: Select all

Tue Oct 29 19:24:33 2019 OpenVPN 2.4.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on May 14 2019
Tue Oct 29 19:24:33 2019 library versions: OpenSSL 1.1.1  11 Sep 2018, LZO 2.08
Tue Oct 29 19:24:33 2019 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Tue Oct 29 19:24:33 2019 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Tue Oct 29 19:24:33 2019 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Tue Oct 29 19:24:33 2019 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Tue Oct 29 19:24:33 2019 TCP/UDP: Preserving recently used remote address: [AF_INET6]xxxx:xxxx:x:xxx:xxxx:xxxx:xxxx:xxxx
Tue Oct 29 19:24:33 2019 Socket Buffers: R=[212992->212992] S=[212992->212992]
Tue Oct 29 19:24:33 2019 UDP link local: (not bound)
Tue Oct 29 19:24:33 2019 UDP link remote: [AF_INET6]xxxx:xxxx:x:xxx:xxxx:xxxx:xxxx:xxxx
Tue Oct 29 19:24:33 2019 TLS: Initial packet from [AF_INET6]xxxx:xxxx:x:xxx:xxxx:xxxx:xxxx:xxxx, sid=f23ac3c4 e76a87e1
Tue Oct 29 19:24:34 2019 VERIFY OK: depth=1, CN=ChangeMe
Tue Oct 29 19:24:34 2019 VERIFY KU OK
Tue Oct 29 19:24:34 2019 Validating certificate extended key usage
Tue Oct 29 19:24:34 2019 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Oct 29 19:24:34 2019 VERIFY EKU OK
Tue Oct 29 19:24:34 2019 VERIFY X509NAME OK: CN=OpenVPN_d11d0c2c-7520-457c-824d-c9c1fe8b9ebf
Tue Oct 29 19:24:34 2019 VERIFY OK: depth=0, CN=OpenVPN_d11d0c2c-7520-457c-824d-c9c1fe8b9ebf
Tue Oct 29 19:24:34 2019 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 256 bit EC, curve: prime256v1
Tue Oct 29 19:24:34 2019 [OpenVPN_d11d0c2c-7520-457c-824d-c9c1fe8b9ebf] Peer Connection Initiated with [AF_INET6]xxxx:xxxx:x:xxx:xxxx:xxxx:xxxx:xxxx
Tue Oct 29 19:24:35 2019 SENT CONTROL [OpenVPN_d11d0c2c-7520-457c-824d-c9c1fe8b9ebf]: 'PUSH_REQUEST' (status=1)
Tue Oct 29 19:24:35 2019 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,block-outside-dns,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 1800,ping-restart 3600,ifconfig 10.8.0.2 255.255.255.0,peer-id 1,cipher AES-256-GCM'
Tue Oct 29 19:24:35 2019 Options error: Unrecognized option or missing or extra parameter(s) in [PUSH-OPTIONS]:3: block-outside-dns (2.4.4)
Tue Oct 29 19:24:35 2019 OPTIONS IMPORT: timers and/or timeouts modified
Tue Oct 29 19:24:35 2019 OPTIONS IMPORT: --ifconfig/up options modified
Tue Oct 29 19:24:35 2019 OPTIONS IMPORT: route options modified
Tue Oct 29 19:24:35 2019 OPTIONS IMPORT: route-related options modified
Tue Oct 29 19:24:35 2019 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Oct 29 19:24:35 2019 OPTIONS IMPORT: peer-id set
Tue Oct 29 19:24:35 2019 OPTIONS IMPORT: adjusting link_mtu to 1624
Tue Oct 29 19:24:35 2019 OPTIONS IMPORT: data channel crypto options modified
Tue Oct 29 19:24:35 2019 Data Channel: using negotiated cipher 'AES-256-GCM'
Tue Oct 29 19:24:35 2019 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Oct 29 19:24:35 2019 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Oct 29 19:24:35 2019 ROUTE_GATEWAY xx.xxx.xx.1/255.255.252.0 IFACE=eth0 HWADDR=e6:cc:34:6b:57:80
Tue Oct 29 19:24:35 2019 TUN/TAP device tun1 opened
Tue Oct 29 19:24:35 2019 TUN/TAP TX queue length set to 100
Tue Oct 29 19:24:35 2019 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Tue Oct 29 19:24:35 2019 /sbin/ip link set dev tun1 up mtu 1500
Tue Oct 29 19:24:35 2019 /sbin/ip addr add dev tun1 10.8.0.2/24 broadcast 10.8.0.255
Tue Oct 29 19:24:35 2019 ROUTE remote_host protocol differs from tunneled
Tue Oct 29 19:24:35 2019 /sbin/ip route add 0.0.0.0/1 via 10.8.0.1
Tue Oct 29 19:24:35 2019 /sbin/ip route add 128.0.0.0/1 via 10.8.0.1
Tue Oct 29 19:24:35 2019 Initialization Sequence Completed

[default_user8]

Ipv4 to ipv6 may still be an issue, here is a tutorial on a double hop vpn that should help with your connection.

https://www.proxyrack.com/how-to-setup- ... pn-server/

Opvnvpn supports both 4 and 6, however your will need to tunnel the traffic through a packet translator(your vserver is there for this purpose i'm pretty sure). Your issue is extremely unique and one i've never ran across before, but it should be solvable. It's a matter of pushing the correct routes in your server.conf.

[c_korn]

Ipv4 to ipv6 may still be an issue, here is a tutorial on a double hop vpn that should help with your connection.

https://www.proxyrack.com/how-to-setup- ... pn-server/

Opvnvpn supports both 4 and 6, however your will need to tunnel the traffic through a packet translator(your vserver is there for this purpose i'm pretty sure). Your issue is extremely unique and one i've never ran across before, but it should be solvable. It's a matter of pushing the correct routes in your server.conf.

Thank you. But I already have problems with the first command.
This is the output of ifconfig on my vServer:

Code: Select all

# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet xxx.xxx.xxx.xxx  netmask 255.255.252.0  broadcast xxx.xxx.xxx.xxx
        inet6 xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx  prefixlen 64  scopeid 0x0<global>
        inet6 xxxx::xxxx:xxxx:xxxx:xxxx  prefixlen 64  scopeid 0x20<link>
        ether xx:xx:xx:xx:xx:xx  txqueuelen 1000  (Ethernet)
        RX packets 4376  bytes 830869 (830.8 KB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 127  bytes 18348 (18.3 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 102  bytes 7914 (7.9 KB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 102  bytes 7914 (7.9 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 10.8.0.1  netmask 255.255.255.0  destination 10.8.0.1
        inet6 xxxx::xxxx:xxxx:xxxx:xxxx  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Now the first command I am supposed to run gives this error:

Code: Select all

# ip route add default via 10.8.0.1 dev eth0 table 102
Error: Nexthop has invalid gateway.