Reach NAS in local network through pivpn

Tarrasque · 20 February 2024 15:58

Hi all.

I installed pivpn on my Pi3 with no issues. Works great and I’m able to configure and connect from my Linux Kubuntu PC with no issues.

I’m a complete newbie regarding VPNs and networking. All I did was generate the config file from pivpn and copy the data to the KDE Network MAnager with some help from the internet.

As I said everything seems to work at a basic level. I am connected and if I visit whatismyip.com I get the same IP as my RPi.

The next step would be to be able to see and mount the files residing on my NAS at home, but I can’t even ping it, which I think makes sense since my NAS and RP1 have 192.168.1.* addresses, while my VPN PC has a 10...* address and so is in a separate network.

Is there a way I can be in the same network as my NAS and RPi? Should I edit something on my PC side or do I also have to change something on the RPi/server side?

This is my conf file for reference. I created it basicallly giving all default answers.

[Interface]
PrivateKey = myPrivateKey
Address = 10.my.client.address/24
DNS = x.x.x.x

[Peer]
PublicKey = myPublicKey
PresharedKey = myPresharedKey
Endpoint = my.domain.org:51820
AllowedIPs = 0.0.0.0/0, ::0/0

Thanks.

Joulinar · 20 February 2024 17:05

what is the output of

sysctl net.ipv4.ip_forward

Maybe IP forwarding is not enabled.

Tarrasque · 20 February 2024 18:47

net.ipv4.ip_forward = 1

Joulinar · 20 February 2024 19:31

Ok this is the correct setting and it should be possible to reach network devices via VPN.

@trendy any further ideas?

Tarrasque · 20 February 2024 20:34

Even if their ip range is different? I didn’t think pivpn was so smart.

Joulinar · 20 February 2024 20:54

Yes. What is the local IP address of the PC you are having remotely? It should have a local network IP address beside VPN client IP.

PiVPN is just a user-friendly interface and not an own VPN software. You are using Wiregard at the end.

I user native Wireguard without issues and I’m able to reach every device within my network. It’s a matter of iptables rules.

trendy · 20 February 2024 23:00

What is the output from the following commands on the dietpi?

ip -4 addr; ip -4 ro list table all; ip -4 ru; iptables-save

Also we’ll need the IP of the NAS.

Tarrasque · 23 February 2024 13:54

This is the output:

dietpi@DietPi:~$ ip -4 addr; ip -4 ro list table all; ip -4 ru; iptables-save
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    inet 192.168.1.7/24 brd 192.168.1.255 scope global dynamic eth0
       valid_lft 3239sec preferred_lft 3239sec
3: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
    inet 10.205.139.1/24 scope global wg0
       valid_lft forever preferred_lft forever
4: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever
default via 192.168.1.1 dev eth0 
10.205.139.0/24 dev wg0 proto kernel scope link src 10.205.139.1 
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.7 
local 10.205.139.1 dev wg0 table local proto kernel scope host src 10.205.139.1 
broadcast 10.205.139.255 dev wg0 table local proto kernel scope link src 10.205.139.1 
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 
broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 
local 172.17.0.1 dev docker0 table local proto kernel scope host src 172.17.0.1 
broadcast 172.17.255.255 dev docker0 table local proto kernel scope link src 172.17.0.1 
local 192.168.1.7 dev eth0 table local proto kernel scope host src 192.168.1.7 
broadcast 192.168.1.255 dev eth0 table local proto kernel scope link src 192.168.1.7 
0:	from all lookup local
32766:	from all lookup main
32767:	from all lookup default
-bash: iptables-save: command not found

The NAS address is 192.168.1.9.

BTW, I did some more experimenting and I found out that I had to add a Google DNS in order to be able to surf the internet while connected to the VPN. Could it be a DNS issue?

I paste here the VPN. configuration of my Client PC. All data is from the dietvpn generated conf file.

Joulinar · 23 February 2024 14:38

AHH you are using Docker? This is blocking access to your local network

Can you try following to allow local access

iptables -I DOCKER-USER -i eth0 -o wg0 -j ACCEPT

Tarrasque · 23 February 2024 23:00

Funny, I didn’t even remember that I installed docker.

I copied and pasted the commsnd in the RPi (with sudo) but nothing seems to have changed.

Joulinar · 24 February 2024 14:55

If not needed, you should remove Docker.

Can you share following

iptables -S

trendy · 25 February 2024 15:02

It’s weird that there is no iptables-save command. How are you configuring the masquerade of the traffic going out of eth0?

Tarrasque · 25 February 2024 20:30

Ah, I found the issue!

When I wrote the last message I was doing the test from office, and I didn’t know that in the meantime there had been a power outage in my home so the Pi got back up, while the NAS stayed down. That’s why even after the command I could not ping it.

I tried now and now everything is working perfectly.

Thank you very much.

Joulinar · 25 February 2024 20:33

If docker is still installed, you would need to make the rule boot persistent using iptables-save

Tarrasque · 25 February 2024 20:34

I have no idea of what you are saying but I think the command failed because it needed sudo.

Tarrasque · 5 March 2024 12:10

Meh. I thought the problem was solved. I thought it was the last time I wrote.

Now I’m again outside home, I just connected back to the VPN and the other devices in my network do not answer the ping.

This is me pinging my RPI (the VPN server)

tarrasque@Flynn:~$ ping 192.168.1.7
PING 192.168.1.7 (192.168.1.7) 56(84) bytes of data.
From 192.168.1.102 icmp_seq=1 Destination Host Unreachable
From 192.168.1.102 icmp_seq=2 Destination Host Unreachable

This is me pinging my NAS

tarrasque@Flynn:~$ ping 192.168.1.9
PING 192.168.1.9 (192.168.1.9) 56(84) bytes of data.
From 192.168.1.102 icmp_seq=1 Destination Host Unreachable
From 192.168.1.102 icmp_seq=2 Destination Host Unreachable

Current PC IP settings.

tarrasque@Flynn:~$ ifconfig
RPi3VPN: flags=209<UP,POINTOPOINT,RUNNING,NOARP>  mtu 1420
        inet 10.205.139.5  netmask 255.255.255.0  destination 10.205.139.5
        inet6 fe80::1dc1:3bd8:6be5:b095  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 1000  (UNSPEC)
        RX packets 3201  bytes 2770496 (2.7 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 2019  bytes 572540 (572.5 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 3145  bytes 364852 (364.8 KB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 3145  bytes 364852 (364.8 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlp2s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.1.102  netmask 255.255.255.0  broadcast 192.168.1.255
        inet6 fe80::55eb:ee4b:b17e:d4be  prefixlen 64  scopeid 0x20<link>
        ether 50:2f:9b:ae:f1:d2  txqueuelen 1000  (Ethernet)
        RX packets 737617  bytes 1074945388 (1.0 GB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 82722  bytes 15908002 (15.9 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

iptables on the RPi

dietpi@DietPi:~$ sudo iptables -S
-P INPUT ACCEPT
-P FORWARD DROP
-P OUTPUT ACCEPT
-N DOCKER
-N DOCKER-ISOLATION-STAGE-1
-N DOCKER-ISOLATION-STAGE-2
-N DOCKER-USER
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A FORWARD -d 10.205.139.0/24 -i eth0 -o wg0 -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment wireguard-forward-rule -j ACCEPT
-A FORWARD -s 10.205.139.0/24 -i wg0 -o eth0 -m comment --comment wireguard-forward-rule -j ACCEPT
-A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 9000 -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
-A DOCKER-USER -j RETURN

Joulinar · 5 March 2024 14:00

You need to make the rule persistent using iptables-persistent. Otherwise the rule is lost on reboot.

Tarrasque · 5 March 2024 18:04

I don’t seem to have that command available.

dietpi@DietPi:/mnt/storage/aMule/Completed$ sudo iptables-
iptables-apply              iptables-legacy-restore     iptables-nft                iptables-nft-save           iptables-restore-translate  iptables-translate          
iptables-legacy             iptables-legacy-save        iptables-nft-restore        iptables-restore            iptables-save               iptables-xml

Joulinar · 5 March 2024 18:16

It’s a package to be installed

Tarrasque · 7 March 2024 13:42

Strangely, it should already be installed

dietpi@DietPi:~$ sudo apt-get install iptables-persistent
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
iptables-persistent is already the newest version (1.0.15).

But is does not seem so:

dietpi@DietPi:~$ sudo iptables-
iptables-apply              iptables-legacy-restore     iptables-nft                iptables-nft-save           iptables-restore-translate  iptables-translate          
iptables-legacy             iptables-legacy-save        iptables-nft-restore        iptables-restore            iptables-save               iptables-xml                

dietpi@DietPi:~$ sudo iptables-persistent
sudo: iptables-persistent: command not found

dietpi@DietPi:~$ whereis iptables-persistent
iptables-persistent:
dietpi@DietPi:~$