OpenVPN not working on android?

richtj99

Hi,

I am using UDP which I think is the default. I am using the LTE connection of my nexus 6p & can log into the VPN.

I can do cameras on VPN & access the PBX web admin page but cant get the android app working on the VPN. When i login via wifi the android app works great. I am using Asterisk (freepbx) if it matters - Still cant get it working right over the VPN.

divsys

I run FreePBX (just an Asterisk Frontend GUI), but I've run straight Asterisk boxes as well.

The only thing I had to do to get my Voip client (Zoiper) working via OpenVPN as well as in house Wifi was to enable the OpenVPN subnet on the Asterisk box.

If I remember right when I was debugging this years ago, I turned up the verbosity on the asterisk box so I could watch the registration attempts when the phone connected.
It was fairly obvious that the registration was denied when the phone came in via OpenVPN and the reason was clear because it tried on an "unknown" (to asterisk) network

Remember, when you connect via OpenVPN, your phone will get a Tunnel IP address, not a LAN address.
For the purposes of setting up Asterisk, you can treat it like you have another network that you enable as well as your original LAN.

Works via SIP or IAX2 and UDP is just fine.

richtj99

I am also using Freepbx as my pbx.

I saw this post:

https://forum.pfsense.org/index.php?topic=79276.0

I am guessing it could be related. What I am a little confused about is on my DDWRT router with Open VPN (didnt really use it much as it was to slow) - I was able to get the sip softphone software working fine on Wifi or VPN.

Is a possible solution to allow the tunnel network to be on the same subnet? Maybe change the range from 192.168.5.x/24 to 192.168.5.x/25 & give 192.168.5.x/25 to the local network & put the VPN on 192.168.6.x/25 to keep it all on the same network?

richtj99

Do you think you could post part of your config settings on adding that second tunnel network to Freepbx?

johnpoz

your dd-wrt was prob setup as tap vs tunnel so your vpn clients were getting IPs that were on your lan network.

The solution provided by divsys seems logical and appropriate…

divsys

In FreePBX the change is part of the Extension's config, go to "Applications->Extensions-><extension you="" want="" to="" allow="">"

Then under "- Device Options" find "permit"

The entry is a "&" separated list of networks to be allowed for the extension to connect , you can have more than 2 ;)

Screen-FreePBX_Note.jpg_thumb </extension>

richtj99

Thank for pointing me in the right direction. I am still having problems though.

I went to the extension I am using which works fine on wifi (same app). I connect to the VPN & nothing happens.

I put this:

192.168.168.0/255.255.255.0&192.168.167.0/255.255.255.0

192.168.168.0 is my main network, 192.168.167.x is my tunnel network.

Interestingly enough I did get this:


Hi,

The IP 100.99.139.197 has just been banned by Fail2Ban after
8 attempts against SIP on localhost.

Regards,
Fail2Ban

I am assuming that is my VPN connection coming in somehow on another IP scheme - since the only way in is through the VPN (I think).

Any ideas what I may be doing wrong?

Thanks,
Rich

vpn-pbx.JPG_thumb

divsys

~~Yeah, Fail2Ban has found the Tunnel address the VPN'd phone is coming in on.~~

Wait a minute 100.99.139.197 is an outside address, how did that get reported to FreePBX?
(Does that happen to be your current WAN address by any chance?)

Are you connecting your phone's VPN over your home WiFi or from outside (via cell data, neighbour's WiFi,etc.)?
You don't have any port forwarding setup do you?

What Voip app are you trying to connect in with?

richtj99

My cablemodem IP is: 24.190.x.x
My phone IP (verizon) is: really wierd looking - see the screenshot. Maybe that is my issue?

When I left wifi (which was connected using Media5) to LTE, my phone sent another fail2ban message - within 2 minutes of turning off wifi.

I suspect that is my phone.

This is strange - my verizon LTE tablet is also giving some strange looking IP. Similar to the attached.

My cell phone is a Nexus6p, my tablet is a samsung galaxy 10 note.

![2016-05-24 21.03.52.png](/public/imported_attachments/1/2016-05-24 21.03.52.png)
![2016-05-24 21.03.52.png_thumb](/public/imported_attachments/1/2016-05-24 21.03.52.png_thumb)

divsys

That IP address is IPv6, there should be a different IPv4 address as well.
You may (should) be able to turn off IPv6 addressing for initial testing purposes - just to eliminate variables.

Is the Voip app built into the phone or is it something you've added?

richtj99

I didnt realize that Verizon went with IPv6. I am not sure how to turn it on or off on my devices. I will have to check it out though.

I am using Media 5 for my softphone:

https://play.google.com/store/apps/details?id=com.media5corp.m5f.Media5fone&hl=en

divsys

Haven't used that particular Voip app before.

Perhaps you could try Zoiper (its free and the one I use regularly) just to see if another app responds the same way.

richtj99

Perfect - you fixed the PBX issue for me! Zoiper works well!

Only two other issues for me seem to be related to external web traffic.

If I am browsing facebook or reddit it works fine on: Wifi or cell service. If I log into the VPN, the web isnt loading anymore.

It seems like I am good for internal things on my network (for the most part) Root Explorer on Android is having a hard time browsing SMB folders on my freenas box over VPN but works fine on wifi.