What am I missing - no internal connection?

[tekguru]

I've just set up the VPN Server using OpenVPN, and I've imported the .ovpn file into OpenVPN on the iPad. I can connect just fine the connection looks valid on the iPad and in the VPN Server connections etc.
However what I wanted to do was to access the routers login page (192.168.1.254 or orbilogon.net) via Safari - no go I get a 'Safari could not open the page because the server stopped responding' message. Configuration is as per below. I've tried with the 'dhcp-option DNS' set and not set, no difference.

dev tun
tls-client

remote quickconnect.synology.me 1194

# The "float" tells OpenVPN to accept authenticated packets from any address,
# not only the address which was specified in the --remote option.
# This is useful when you are connecting to a peer which holds a dynamic address
# such as a dial-in user or DHCP client.
# (Please refer to the manual of OpenVPN for more information.)

#float

# If redirect-gateway is enabled, the client will redirect it's
# default network gateway through the VPN.
# It means the VPN connection will firstly connect to the VPN Server
# and then to the internet.
# (Please refer to the manual of OpenVPN for more information.)

#redirect-gateway def1

# dhcp-option DNS: To set primary domain name server address.
# Repeat this option to set secondary DNS server addresses.

dhcp-option DNS 192.168.1.254

pull

# If you want to connect by Server's IPv6 address, you should use
# "proto udp6" in UDP mode or "proto tcp6-client" in TCP mode
proto udp

script-security 2


comp-lzo

reneg-sec 0

cipher AES-256-CBC

auth SHA512

auth-user-pass
<ca>

Anyone any ideas as to what I'm missing?

 

[Gerard]

I've just set up the VPN Server using OpenVPN, and I've imported the .ovpn file into OpenVPN on the iPad. I can connect just fine the connection looks valid on the iPad and in the VPN Server connections etc.
However what I wanted to do was to access the routers login page (192.168.4.254 or orbilogon.net) via Safari - no go I get a 'Safari could not open the page because the server stopped responding' message. Configuration is as per below. I've tried with the 'dhcp-option DNS' set and not set, no difference.

dev tun
tls-client

remote quickconnect.synology.me 1194

# The "float" tells OpenVPN to accept authenticated packets from any address,
# not only the address which was specified in the --remote option.
# This is useful when you are connecting to a peer which holds a dynamic address
# such as a dial-in user or DHCP client.
# (Please refer to the manual of OpenVPN for more information.)

#float

# If redirect-gateway is enabled, the client will redirect it's
# default network gateway through the VPN.
# It means the VPN connection will firstly connect to the VPN Server
# and then to the internet.
# (Please refer to the manual of OpenVPN for more information.)

#redirect-gateway def1

# dhcp-option DNS: To set primary domain name server address.
# Repeat this option to set secondary DNS server addresses.

dhcp-option DNS 192.168.1.254

pull

# If you want to connect by Server's IPv6 address, you should use
# "proto udp6" in UDP mode or "proto tcp6-client" in TCP mode
proto udp

script-security 2


comp-lzo

reneg-sec 0

cipher AES-256-CBC

auth SHA512

auth-user-pass
<ca>

Anyone any ideas as to what I'm missing?

Try turning off your firewall for a brief minute on the synology device that’s doing the vpn, test and see if you can connect to what your looking for.

Report back with result. If it’s firewall we need to build the rule sets across subnets.

-- post merged: 14. Aug 2022 --

Also I see router is 192.168.4.x and your dns is 192.168.1.x Is your router doing the dns or is another device handling that? Should the dns in the config be 192.168.4.x??

 

[tekguru]

Okay, typo in first post corrected, DNS is the router (192.168.1.254). Yep just turned off the firewall and all connected perfectly.
So where do we start in rebuilding the subnets? What data do you need?

 

[Gerard]

Okay, typo in first post corrected, DNS is the router (192.168.1.254). Yep just turned off the firewall and all connected perfectly.
So where do we start in rebuilding the subnets? What data do you need?

Add a firewall rule with the subnet of your vpn network. Place it next to your local network firewall subnet rule (just preference it can go anywhere before deny, however I like grouping things).

The source will be whatever designated countries you want access to the vpn.

When your clients connect they connect and grab an ip from the vpn subnet, and since it’s a different subnet than your local network, You need to add a rule for that.

 

[tekguru]

Brilliant, rules now as below and it's all working! Anything else I need to change?

 

[Gerard]

Looks good. If i were you I’d limit the source ip for vpn 1194 unless you truly need it globally. Add the countries you know you would be in that would need vpn access. And then anytime you go someplace new you can always turn it on and then off.

Or you can certainly keep as is for convenience. It’s a balance between how tight you want to pull things.

 

[tekguru]

Good point I never go outside of the UK so yep geographical limits now in place Many thanks!

 

[fredbert]

#redirect-gateway def1

With this disabled you are not sending all macOS traffic down the VPN tunnel. Try editing the .ovpn file and remove the preceding '#' then import it again to the OpenVPN client (or TunnelBlick on macOS).

Have a read here, scroll to "Routing all client traffic (including web-traffic) through the VPN" (or search the page for redirect-), How To Guide: Set Up & Configure OpenVPN Client/server VPN | OpenVPN

 

[tekguru]

I'll take a look at that, but I'm using the VPN on iOS or iPadOS, my Mac Mini stays at home.
I guess it will still apply though?

 

[fredbert]

I'll take a look at that, but I'm using the VPN on iOS or iPadOS, my Mac Mini stays at home.
I guess it will still apply though?

It still applies. You use the same .ovpn file regardless of OpenVPN client device.

 

[tekguru]

Okay, I'll investigate it

 

[WST16]

Check this resource…

Tutorial - DS VPN Server OpenVPN configuration

Difficulty: medium Prerequisites: router port forwarding knowledge and a high-level understanding of the DS firewall is recommended. Hi, In this guide I’ll share how I configured my VPN Server package to allow access to my DS and LAN (with the...

www.synoforum.com

 

[tekguru]

Cheers, added to my reading list.