Resolving OpenVPN LAN Issue with Raspberry Pi 4, Raspbian Lite, NordVPN, and iOS Client
In this article, we will discuss the steps to resolve an issue where a Raspberry Pi 4 running Raspbian Lite and NordVPN's OpenVPN client cannot access devices on the local area network (LAN) when connected to a remote network through a router that also supports OpenVPN.
Prerequisites
Before we begin, make sure you have the following:
- A Raspberry Pi 4 with Raspbian Lite installed
- NordVPN account with OpenVPN access files for your desired server location
- A router that supports OpenVPN and has the necessary configuration files for connecting to NordVPN's servers
- An iOS device with the NordVPN app installed
Issue Overview
When you connect your Raspberry Pi to your router's OpenVPN server, everything works as expected. However, when you connect your iOS device to the same server, your Raspberry Pi cannot access the iOS device, and the iOS device cannot access the Raspberry Pi. This is because the OpenVPN connection on the iOS device creates a separate network interface, which breaks the direct connection between devices on the LAN.
Resolution
To resolve this issue, we need to change the routing configuration on the Raspberry Pi so that all traffic intended for the LAN is routed through the physical Ethernet interface, rather than the OpenVPN interface. We can accomplish this by following these steps:
1. Determine your LAN IP range
First, you need to determine the IP range of your LAN. This will typically be in the format 192.168.x.x/y, where x is the same as the third octet of your router's IP address, and y is the subnet mask (e.g., if your router's IP address is 192.168.1.1, your LAN IP range might be 192.168.1.0/24).
# Identify your router's IP address
ip addr show eth0 | grep inet | awk '{print $2}' | cut -d/ -f1
Use the third octet of the router's IP address to determine your LAN IP range.
2. Modify your OpenVPN configuration
Next, you need to edit your OpenVPN configuration file. This file will be located in /etc/openvpn and will have a name similar to client.ovpn.
# Open the OpenVPN configuration file for editing
sudo nano /etc/openvpn/client.ovpn
Add the following line at the end of the file, replacing x.x.x.x with the appropriate value for your LAN IP range:
route x.x.x.x 255.255.255.0
Save and close the file.
3. Add a script to override the routing table
After reconnecting to the OpenVPN server, you will notice that the new route has been added but the LAN traffic still goes through the OpenVPN interface. To fix this, you need to add a script that overrides the routing table after the OpenVPN connection is established. Create the following script:
sudo nano /etc/openvpn/update-resolv-conf
#!/bin/sh
# Update resolv.conf
openvpn --route-up /etc/openvpn/route-up.sh &
Next, create the route-up.sh script that adds the persistent routes:
sudo nano /etc/openvpn/route-up.sh
#!/bin/sh
# Add a persistent route for the LAN IP range
ip route add x.x.x.x/y via $5
Replace x.x.x.x/y with the appropriate LAN IP range values.
Make both scripts executable:
sudo chmod +x /etc/openvpn/update-resolv-conf
sudo chmod +x /etc/openvpn/route-up.sh
By adding a persistent route for the LAN IP range in the route-up.sh script and executing it after the OpenVPN connection is established, you can ensure that LAN traffic is routed properly, regardless of the device or operating system used.
References: