Pivpn: Cannot reach my local network computers

[Hesi-Re]

In raising this issue, I confirm the following:

{please fill the checkboxes, e.g: [X]}

• [x] I have read and understood the contributors guide.
• [X] The issue I am reporting can be replicated.
• [X] The issue I am reporting can be is directly related to the pivpn installer script.
• [X] The issue I am reporting isn't a duplicate (see FAQs, closed issues, and open issues).

I just installed PiVPN on a fresh Raspbian lite. I can enable VPN and connect remotely to my Raspberry Pi (VPN server), but I can't connect to my remote LAN devices. I tried different settings and with Wireguard and OpenVPN, but no success. I don't know how to reach those computers. I think there must be something with DNS and IP, but I don't know enough about it.

I just want to connect to Windows 10 PC (192.168.1.64) on my remote LAN with Microsoft Remote Desktop through VPN tunnel. I tried different settings but I'm totally lost. I need some help, please!

Have you searched for similar issues and solutions?

(yes/no / which issues?)

yes

Console output of curl -L install.pivpn.dev | bash

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   162  100   162    0     0    593      0 --:--:-- --:--:-- --:--:--   595
100 81925  100 81925    0     0   150k      0 --:--:-- --:--:-- --:--:-- 1348k
:::
::: sudo will be used for the install.
::: Hostname length OK
::: Verifying free disk space...
:::
::: Checking apt-get for upgraded packages.... done!
:::
::: Your system is up to date! Continuing with PiVPN installation...
update-alternatives: using /usr/sbin/iptables-legacy to provide /usr/sbin/iptables (iptables) in manual mode
update-alternatives: using /usr/sbin/ip6tables-legacy to provide /usr/sbin/ip6tables (ip6tables) in manual mode
:::    Checking for git... not installed!
:::    Checking for tar... already installed!
:::    Checking for wget... already installed!
:::    Checking for curl... already installed!
:::    Checking for grep... already installed!
:::    Checking for dnsutils... not installed!
:::    Checking for whiptail... already installed!
:::    Checking for net-tools... already installed!
:::    Checking for bsdmainutils... already installed!
:::    Checking for dhcpcd5... already installed!
:::    Checking for iptables-persistent... not installed!
:::    Package git successfully installed!
:::    Package dnsutils successfully installed!
:::    Package iptables-persistent successfully installed!
:::
::: Setting IP to 192.168.1.19/24.  You may need to restart after the install is complete.
:::
::: Using User: pi
:::
::: Checking for existing base files...
:::    Checking /etc/.pivpn is a repo...:::    Cloning https://github.com/pivpn/pivpn.git into /etc/.pivpn... done!
::: Using VPN: WireGuard
::: Installing WireGuard from Debian package... 
:::    Checking for dirmngr... already installed!
::: Adding repository keys...
Executing: /tmp/apt-key-gpghome.bOjyAKKNTz/gpg.1.sh --keyserver keyserver.ubuntu.com --recv-keys 0xe1cf20ddffe4b89e802658f1e0b11894f66aec98 0x80d15823b7fd1561f9f7bcdddc30d7c23cbbabee
gpg: key DC30D7C23CBBABEE: public key "Debian Archive Automatic Signing Key (10/buster) <[email protected]>" imported
gpg: key E0B11894F66AEC98: public key "Debian Archive Automatic Signing Key (9/stretch) <[email protected]>" imported
gpg: Total number processed: 2
gpg:               imported: 2
::: Adding Debian repository... 
::: Updating package cache...
:::    Checking for raspberrypi-kernel-headers... not installed!
:::    Checking for wireguard... not installed!
:::    Checking for wireguard-tools... not installed!
:::    Checking for wireguard-dkms... not installed!
:::    Checking for qrencode... not installed!
:::    Package raspberrypi-kernel-headers successfully installed!
:::    Package wireguard successfully installed!
:::    Package wireguard-tools successfully installed!
:::    Package wireguard-dkms successfully installed!
:::    Package qrencode successfully installed!
::: Using Google servers.
::: Backing up the wireguard folder to /etc/wireguard_2020-02-20-111114.tar.gz
::: Server Keys and Pre-Shared Key have been generated.
::: Server config generated.
::: Install Complete...
::: Restarting services...
:::    Checking for unattended-upgrades... not installed!
:::    Package unattended-upgrades successfully installed!
:::
::: Installing scripts to /opt/pivpn...
 done.
::: Flushing writes to disk...
::: done.

Console output of pivpn add or pivpn add nopass

 Enter a Name for the Client: pefra
::: Client Keys generated
::: Client config generated
::: Updated server config
::: WireGuard restarted
======================================================================
::: Done! pefra.conf successfully created!
::: pefra.conf was copied to /home/pi/configs for easy transfer.
::: Please use this profile only on one device and create additional
::: profiles for other devices. You can also use pivpn -qr
::: to generate a QR Code you can scan with the mobile app.

Console output of pivpn debug

   Update LatestUpdate.md
=============================================
::::        Installation settings        ::::
PLAT=Raspbian
OSCN=buster
USING_UFW=0
IPv4dev=eth0
IPv4addr=192.168.1.19/24
IPv4gw=192.168.1.1
install_user=pi
install_home=/home/pi
pivpnPROTO=udp
VPN=wireguard
pivpnDEV=wg0
pivpnNET=10.6.0.0
subnetClass=24
pivpnPORT=51820
pivpnDNS1=8.8.8.8
pivpnDNS2=8.8.4.4
pivpnHOST=REDACTED
INPUT_CHAIN_EDITED=0
FORWARD_CHAIN_EDITED=0
UNATTUPG=1
INSTALLED_PACKAGES=(git dnsutils iptables-persistent raspberrypi-kernel-headers wireguard wireguard-tools wireguard-dkms qrencode unattended-upgrades)
=============================================
::::  Server configuration shown below   ::::
[Interface]
PrivateKey = server_priv
Address = 10.6.0.1/24
ListenPort = 51820
# begin pefra
[Peer]
PublicKey = pefra_pub
PresharedKey = psk
AllowedIPs = 10.6.0.2/32
# end pefra
=============================================
::::  Client configuration shown below   ::::
[Interface]
PrivateKey = pefra_priv
Address = 10.6.0.2/24
DNS = 8.8.8.8, 8.8.4.4

[Peer]
PublicKey = server_pub
PresharedKey = psk
Endpoint = REDACTED:51820
AllowedIPs = 0.0.0.0/0
=============================================
::::    Recursive list of files in   ::::
::::    [4m/etc/wireguard shown below    ::::
/etc/wireguard:
configs  keys  wg0.conf

/etc/wireguard/configs:
clients.txt  pefra.conf

/etc/wireguard/keys:
pefra_priv  pefra_pub  psk  server_priv  server_pub
=============================================
::::        Self check       ::::
:: [OK] IP forwarding is enabled
:: [OK] Iptables MASQUERADE rule set
:: [OK] WireGuard is running
:: [OK] WireGuard is enabled (it will automatically start on reboot)
:: [OK] WireGuard is listening on port 51820/udp
=============================================
:::: Having trouble connecting? Take a look at the FAQ:
:::: https://github.com/pivpn/pivpn/wiki/FAQ
=============================================
:::: WARNING: This script should have automatically masked sensitive       ::::
:::: information, however, still make sure that PrivateKey, PublicKey      ::::
:::: and PresharedKey are masked before reporting an issue. An example key ::::
:::: that you should NOT see in this log looks like this:                  ::::
:::: YIAoJVsdIeyvXfGGDDadHh6AxsMRymZTnnzZoAb9cxRe                          ::::
=============================================
::::        Debug complete       ::::

Have you taken any steps towards solving your issue?

```
I have DynDNS and port forwarding enabled for the VPN server.

I tried different DNS settings but not succeed```

[orazioedoardo]

What's the LAN of the CLIENT your are connecting from?

[Hesi-Re]

I don't know exactly what you mean. My local LAN IP is 192.168.1.12. My remote LAN IP is 192.168.1.64. My client's virtual ip is 10.6.0.2.

[orazioedoardo]

I don't know exactly what you mean. My local LAN IP is 192.168.1.12. My remote LAN IP is 192.168.1.64

That's the problem, when your VPN clients tries to reach your Windows 10 PC on 192.168.1.64, he doesn't know if 192.168.1.64 is on the remote or local LAN. In your case it probably thinks you want 192.168.1.64 from the local LAN which may not exist.

This is not a PiVPN problem neither an OpenVPN problem or WIreGuard problem, you need to change your local or remote LAN to something less common, for example 192.168.66.0/24 (best to change the remote LAN, where the raspberry pi is located).

[Hesi-Re]

I don't know exactly what you mean. My local LAN IP is 192.168.1.12. My remote LAN IP is 192.168.1.64

That's the problem, when your VPN clients tries to reach your Windows 10 PC on 192.168.1.64, he doesn't know if 192.168.1.64 is on the remote or local LAN. In your case it probably thinks you want 192.168.1.64 from the local LAN which may not exist.

This is not a PiVPN problem neither an OpenVPN problem or WIreGuard problem, you need to change your local or remote LAN to something less common, for example 192.168.66.0/24 (best to change the remote LAN, where the raspberry pi is located).

Changing remote LAN to 192.168.66.0/24 solved my problem! Thank you so much! I lost almost 1 week trying to configure my VPN settings without success. I have tried remote LAN with 192.168.1.60/40 and local LAN with 192.168.1.1/60, but no luck!

Thanks for your great support and for developing PiVPN! It's fantastic!