OpenVPN not working on android?

[richtj99]

Hi,

I followed this youtube guide:  https://www.youtube.com/watch?v=ekl8rwHomRs

I saw a number of them & setup seems to be pretty basic.  Setup server cert, user, openvpn wizard, setup firewall rules (wizard).

I try to connect using the user/password & get the attached error.

Am I doing something stupid here?

Thanks,
Rich


[divsys]

Well at first blush, the "unsupported certificate purpose" error would lead me to believe your trying to use a Client certificate for your OpenVPN server vice versa.

Normally these are very easy installs, I have many multiple android, iOS, PC, etc. clients talking successfully to pfSense.

Check your certificate types and usage for all the pieces here.

[richtj99]

Thank you very much!  That was it.  It works!

Is VPN generally much slower than port forwarding?

I am having an issue accessing my PBX over VPN.  However, accessing it over WIFI is OK.  Again using an android app.  Using the same android phone on VPN I can get to the PBX web interface.

Separately I can access my camera server via VPN or Wifi.

All are on the same network.

[divsys]

Voip definitely works fine for me over OpenVPN, do it all the time.

One thing to watch out for when testing at "home".
Using an android device via home wifi and a the same VPN conx you use from "outside" will potentially (if it works at all) double up on your latency and connection jitter due to NAT reflection as you pass through the router twice for each connection.
Safest way to test is connect via Cell data or the neighbour's WiFi.  ;)

Video has a little more overhead (relative to the needed bandwidth), but still works very well.  Given the state-of-the-art for many (most) add-on video cameras/recorders, I don't port-forward anymore.  Too much opportunity for outside exploits of ugly bugs in manufacturer's equipment.

Just my $.02

[johnpoz]

I stream video through my vpn all the time off my plex server, I don't think voip should be an issue.  Are you using udp or tcp for the vpn connection?

[richtj99]

Hi,

I am using UDP which I think is the default.  I am using the LTE connection of my nexus 6p & can log into the VPN.

I can do cameras on VPN & access the PBX web admin page but cant get the android app working on the VPN.  When i login via wifi the android app works great.  I am using Asterisk (freepbx) if it matters - Still cant get it working right over the VPN.

[divsys]

I run FreePBX (just an Asterisk Frontend GUI), but I've run straight Asterisk boxes as well.

The only thing I had to do to get my Voip client (Zoiper) working via OpenVPN as well as in house Wifi was to enable the OpenVPN subnet on the Asterisk box.

If I remember right when I was debugging this years ago, I turned up the verbosity on the asterisk box so I could watch the registration attempts when the phone connected.
It was fairly obvious that the registration was denied when the phone came in via OpenVPN and the reason was clear because it tried on an "unknown" (to asterisk) network

Remember, when you connect via OpenVPN, your phone will get a Tunnel IP address, not a LAN address.
For the purposes of setting up Asterisk, you can treat it like you have another network that you enable as well as your original LAN.

Works via SIP or IAX2 and UDP is just fine.

[richtj99]

I am also using Freepbx as my pbx.

I saw this post:

https://forum.pfsense.org/index.php?topic=79276.0

I am guessing it could be related.  What I am a little confused about is on my DDWRT router with Open VPN (didnt really use it much as it was to slow) - I was able to get the sip softphone software working fine on Wifi or VPN.

Is a possible solution to allow the tunnel network to be on the same subnet?  Maybe change the range from 192.168.5.x/24 to 192.168.5.x/25 & give 192.168.5.x/25 to the local network & put the VPN on 192.168.6.x/25 to keep it all on the same network?

[richtj99]

Do you think you could post part of your config settings on adding that second tunnel network to Freepbx?

[johnpoz]

your dd-wrt was prob setup as tap vs tunnel so your vpn clients were getting IPs that were on your lan network.

The solution provided by divsys seems logical and appropriate…

[divsys]

In FreePBX the change is part of the Extension's config, go to "Applications->Extensions-><extension you="" want="" to="" allow="">"

Then under "- Device Options" find "permit"

The entry is a "&" separated list of networks to be allowed for the extension to connect , you can have more than 2  ;)

</extension>

[richtj99]

Thank for pointing me in the right direction.  I am still having problems though.

I went to the extension I am using which works fine on wifi (same app).  I connect to the VPN & nothing happens.

I put this:

192.168.168.0/255.255.255.0&192.168.167.0/255.255.255.0

192.168.168.0 is my main network, 192.168.167.x is my tunnel network.

Interestingly enough I did get this:

Hi,

The IP 100.99.139.197 has just been banned by Fail2Ban after
8 attempts against SIP on localhost.

Regards,
Fail2Ban

I am assuming that is my VPN connection coming in somehow on another IP scheme - since the only way in is through the VPN (I think).

Any ideas what I may be doing wrong?

Thanks,
Rich

[divsys]

Yeah, Fail2Ban has found the Tunnel address the VPN'd phone is coming in on.

Wait a minute 100.99.139.197 is an outside address, how did that get reported to FreePBX?
(Does that happen to be your current WAN address by any chance?)

Are you connecting your phone's VPN over your home WiFi or from outside (via cell data, neighbour's WiFi,etc.)?
You don't have any port forwarding setup do you?

What Voip app are you trying to connect in with?

[richtj99]

My cablemodem IP is:  24.190.x.x
My phone IP (verizon) is: really wierd looking - see the screenshot.  Maybe that is my issue?

When I left wifi (which was connected using Media5) to LTE, my phone sent another fail2ban message - within 2 minutes of turning off wifi.

I suspect that is my phone.

This is strange - my verizon LTE tablet is also giving some strange looking IP.  Similar to the attached.

My cell phone is a Nexus6p, my tablet is a samsung galaxy 10 note.


[divsys]

That IP address is IPv6, there should be a different IPv4 address as well.
You may (should) be able to turn off IPv6 addressing for initial testing purposes - just to eliminate variables.

Is the Voip app built into the phone or is it something you've added?

[richtj99]

I didnt realize that Verizon went with IPv6.  I am not sure how to turn it on or off on my devices.  I will have to check it out though.

I am using Media 5 for my softphone:

https://play.google.com/store/apps/details?id=com.media5corp.m5f.Media5fone&hl=en

[divsys]

Haven't used that particular Voip app before.

Perhaps you could try Zoiper (its free and the one I use regularly) just to see if another app responds the same way.

[richtj99]

Perfect - you fixed the PBX issue for me!  Zoiper works well!

Only two other issues for me seem to be related to external web traffic.

If I am browsing facebook or reddit it works fine on:  Wifi or cell service.  If I log into the VPN, the web isnt loading anymore.

It seems like I am good for internal things on my network (for the most part) Root Explorer on Android is having a hard time browsing SMB folders on my freenas box over VPN but works fine on wifi.