Hello,
I want to install a home-server for several purposes, VPN being one of them.
So I bought a RaspberryPI-4B and installed FreedomBox Stable on it, using the rpi-imager (this is how I found out about the existence of freedombox, I just wanted something debian based and easy to setup; I’m just some software devoloper who knows the basics of administrating a server and networking, but not the advanced stuff).
After setting up the freedombox on the Pi, I have installed the OpenVPN App using the FreedomBox-UI (Website) next, and (after some dynDNS and router port-forwaring stuff unrelated to the server itself) I could log into the VPN from my mobile phone, but the only server that is reachable using the VPN is the freedombox itself (using the tun0
IP 10.91.0.1
), no other server from the network is reachable. This is not expected behaviour, is it? (I’m actually not sure, I have not found any documentation about what is supposed to be reachable when OpenVPN is installed, only that it should “just work”. For now I assume that this is not expected behaviour and I should be able to reach other servers in the network when OpenVPN is set up.)
After some searching why this is, I found that the VPN only works when there is at least one interface that is part of the external zone in the firewall. This was already the case, eth0
was already part of the external zone in the firewall UI. So that is not the reason.
At this point I left the path of what a non-techy user is expected to do and tried to solve this by connecting via ssh to it and messing with things.
First I activated IP packet forwarding:
echo 1 > /proc/sys/net/ipv4/ip_forward
That had no effect.
Then, after lots of googling, I stumbled over this:
# firewall-cmd --permanent --new-policy intToExt
# firewall-cmd --permanent --policy intToExt --add-ingress-zone internal
# firewall-cmd --permanent --policy intToExt --add-egress-zone external
# firewall-cmd --permanent --policy intToExt --set-target ACCEPT
# firewall-cmd --reload
This finally allowed me to reach other servers in the network over VPN… Until the next reboot of the server that is. At that point, things got weird.
When the server booted up the next time, it had (seemingly) no networking whatsoever. So I plugged it into a keyboard and “monitor” (a.k.a. A HDMI capture card on my laptop) and tried to see what was happening. With tcpdump -v eth0
I could see the incoming connection attempts to the sshd server incoming, but they did not reach the sshd process. Just a series of [SYN]
packets trying to open a TCP connection without a response from the ssh server. From the box itself I could connect to localhost via ssh without problems (ssh localhost
), but not from the outside. Same story for the webserver: A curl http://localhost/
works fine, but when attempting a request from another device (my laptop), it ends with the [SYN]
packages reaching the tcpdump on the freedombox, but not the webserver process (apache I presume).
To solve this, I tried several things from deactivating the firewall service firewalld stop
(resulting in an empty nft ruleset) (And yes, I learned a lot about nftables that day) to deactivating IPv6 on the server.
And after bashing my head against the wall for several hours, I desperately tried to remove the tun0 device (ip link delete tun0
) and this finally restored normal networking on the server. Both ssh and http(s) connections were possible again. Why in the world does the existance of the tun0 interface block packets from reaching their processes?
I can restore the broken state of the server just by rebooting it, and “fix” it by removing the tun0
interface again.
This is my current status. Can anybody tell me why this is happening? How do I make OpenVPN work so that the whole network is reachable and without networking getting broken?
Thank you for any answers.