The connection does not work

[DEPSTRCZ]

I had PiVpn running once. I tried and it worked (OpenVPN) Yesterday i have noticed that something is wrong. I can init it the connection and handshake happends correctly. There are bytes sent forward and back and even tcpdump shows traffic. Yet it still does not work. I have also tried reconfiguring to Wireguard. But no luck. I have also followed all the diagnostics steps / faq yet no luck.

• No Firewall
• Using NetworkManager
• Ports forwarded correctly
• OS: Ubuntu 23.10 (GNU/Linux 6.5.0-1008-raspi aarch64)

[coolapso]

Are you trying to connect to the VPN Within the same network? That often causes issues similar to what you see, try connecting from an external network, eg. Mobile network.
if that doesn't work, next logical thing to check is if you are behind a CGNAT ... I know you see traffic going back and forth ... but its hard from me on my side to judge how accurate that is.

double check what whatsmyip.org reports as being your IP and what the router says its WAN IP is ...

[DEPSTRCZ]

I have a static IP. I have a bit of an expirience in this. Been self hosting stuff on my own for a couple years. This setup has worked with Pivpn in the past. But does not work on the pi for some reason. Other Port forwards work without issue.

…

On Thu, Jan 4, 2024, 20:42 4s3ti ***@***.***> wrote: next logical thing to check is if you are behind a CGNAT ... I know you see traffic going back and forth ... but its hard from me on my side to judge how accurate that is. double check what whatsmyip.org reports as being your IP and what the router says its WAN IP is ... — Reply to this email directly, view it on GitHub <#1801 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ASNQXCTFFWYZ4HYGMPABUW3YM4A2NAVCNFSM6AAAAABBNMC42WVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4DAMJWGUYTG> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[coolapso]

add here the output of pivpn -d , the Iptables rules are useful as well ..
iptables -S and iptables -t nat -S if I'm not around to answer and help will give at least more info for someone to help you.

[DEPSTRCZ]

The GH codeblock cant handle it. Here is a paste of all https://pastebin.com/B9L4xC6u

[coolapso]

what pivpn -d says now?

[TinCanTech]

I find iptables-save to be easier to grok.

[coolapso]

I suspect there's something else going on ... I'm tempted to suggest a clean setup, at this point I cannot trust the current state of the system.

[DEPSTRCZ]

pivpn -d says all OK... I am not happy with performing a clean install. I will try it in a VM and if that does not shine some light we will see..

[DEPSTRCZ]

Oh,,, I was met with an exit with a message: Exiting due to untest OS.. Its the same Os except it is not the Arch version as my pi tho...
Note: I am using NetwrokManager on my Pi.. But that should not make problems

[DEPSTRCZ]

So? How i was able to install it on an unsupported system? Is that a bug or?

[coolapso]

its not a bug its intended, there are 3 conditions: https://github.com/pivpn/pivpn/blob/master/auto_install/install.sh#L338-L392

1 - Your OS is supported

2 -Your OS is, maybe supported, this means that you might be on a distribution or version that is not directly supported but it still might work, for example your case, Ubuntu Mantic, its still not a tested version however its Ubuntu and it most likely works. In this stage, the information is quite clear, so maybe you should have read it with a bit more attention.

https://github.com/pivpn/pivpn/blob/master/auto_install/install.sh#L413C1-L418C5

3 - its not supported and the installer will not continue.

When your OS is supported or maybe supported, if its not on a raspberry pi, then you also get another warning about the IP address configuration not being possible, this is to account for VMS / VPS where IP Settings are typically handled elsewhere.

[DEPSTRCZ]

Well the installer tells me that i my version is not supported and i cant continue.. But on the same version but on Arch i am able to install with the warning..

[DEPSTRCZ]

In the WG logs i have found that the when a client connects those logs show up.

[Sat Jan 13 21:48:21 2024] wireguard: wg0: Receiving handshake initiation from peer 1 (<ip>:1367)
[Sat Jan 13 21:48:21 2024] wireguard: wg0: Sending handshake response to peer 1 (<ip>:1367)
[Sat Jan 13 21:48:21 2024] wireguard: wg0: Keypair 2 created for peer 1
[Sat Jan 13 21:48:21 2024] wireguard: wg0: Packet has unallowed src IP (fe80::619e:a2a4:23b4:e05b) from peer 1 (<ip>:1367)
[Sat Jan 13 21:48:22 2024] wireguard: wg0: Packet has unallowed src IP (fe80::619e:a2a4:23b4:e05b) from peer 1 (<ip>:1367)
[Sat Jan 13 21:48:22 2024] wireguard: wg0: Packet has unallowed src IP (100.116.154.235) from peer 1 (<ip>:1367)
[Sat Jan 13 21:48:24 2024] wireguard: wg0: Packet has unallowed src IP (100.116.154.235) from peer 1 (<ip>:1367)
[Sat Jan 13 21:48:25 2024] wireguard: wg0: Packet has unallowed src IP (fe80::619e:a2a4:23b4:e05b) from peer 1 (<ip>:1367)
[Sat Jan 13 21:48:26 2024] wireguard: wg0: Packet has unallowed src IP (100.116.154.235) from peer 1 (<ip>:1367)
[Sat Jan 13 21:48:28 2024] wireguard: wg0: Packet has unallowed src IP (100.116.154.235) from peer 1 (<ip>:1367)
[Sat Jan 13 21:48:33 2024] wireguard: wg0: Packet has unallowed src IP (fe80::619e:a2a4:23b4:e05b) from peer 1 (<ip>:1367)
[Sat Jan 13 21:48:36 2024] wireguard: wg0: Packet has unallowed src IP (100.116.154.235) from peer 1 (<ip>:1367)
[Sat Jan 13 21:48:40 2024] wireguard: wg0: Sending keepalive packet to peer 1 (<ip>:1367)
[Sat Jan 13 21:48:49 2024] wireguard: wg0: Packet has unallowed src IP (fe80::619e:a2a4:23b4:e05b) from peer 1 (<ip>:1367)
[Sat Jan 13 21:48:52 2024] wireguard: wg0: Sending keepalive packet to peer 1 (<ip>:1367)
[Sat Jan 13 21:48:53 2024] wireguard: wg0: Packet has unallowed src IP (100.116.154.235) from peer 1 (<ip>:1367)

[DEPSTRCZ]

I have tried couple mroe things. How ever sitll no luck.