Raspberry Pi 3 B as VPN Hotspot - No Internet on Client Side - Two Wi-Fi Adapters

Question

Goal:

Home Network --> wlan0 --> VPN --> wlan1 --> Hotspot

Raspbian Jessie with Pixel:

Using inbuilt Wifi adapter to connect to my home network, while external one as hostpot. No ethernet. I have tried for over a week setting up my rpi 3 model b to use a VPN over hostpot using hostapd and many dhcp configs in vain.

Word of wisdom: Not a novice or an expert

I have borrowed my steps from many many online articles but there is no updated version to work with new rpi 3 b. I am gonna provide them as a reference here.

What works: wlan0 connected to home network VPN on Pi, with a static IP assigned to wlan1 Hostapd, isc-dhcp Driver for wlan1 installed IP address, subnet assigned to client.

What's not: Hotspot made out of VPN on client side (cellphone)

My suspect: iptables or network interfaces or dhcpcd.conf (located at etc/dhcpcd.conf)

Strange scenario: If "# iface default inet dhcp" gets added to interfaces, isc-dhcp fails! Even with hashed out I get this issue. Once removed, all worked!

Ref: https://bit.ly/2g2NKfI

---

Configuration Used:

DHCPD: /etc/dhcp/dhcpd.conf:

subnet 192.168.42.0 netmask 255.255.255.0 {
    range 192.168.42.10 192.168.42.50;
    option broadcast-address 192.168.42.255;
    option routers 192.168.42.1;
    default-lease-time 600;
    max-lease-time 7200;
    option domain-name "local";
    option domain-name-servers 8.8.8.8, 8.8.4.4;
}

ISC-DHCP-Server: /etc/default/isc-dhcp-server:

INTERFACES="wlan1"

Hostapd: /etc/hostapd/hostapd.conf: (custom version was used here)

interface=wlan1
driver=rtl871xdrv
ssid=Net
hw_mode=g
channel=6
macaddr_acl=0
auth_algs=1
ignore_broadcast_ssid=0
wpa=2
wpa_passphrase=Test123
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP
rsn_pairwise=CCMP

/etc/default/hostapd:

DAEMON_CONF="/etc/hostapd/hostapd.conf"

Network Interface: /etc/network/interfaces:

auto lo
iface lo inet loopback

iface eth0 inet manual

allow-hotplug wlan0
iface wlan0 inet manual
    wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

#allow-hotplug wlan1
iface wlan1 inet manual
#   wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

up iptables-restore < /etc/iptables.nat.vpn.secure

DHCPCD: /etc/dhcpcd.conf:

interface wlan1

static ip_address=192.168.42.1/24
static routers=192.168.42.1
static domain_name_servers=192.168.42.1

NAT: /etc/sysctl.conf:

net.ipv4.ip_forward=1

sh -c "echo 1 > /proc/sys/net/ipv4/ip_forward"

VPN:

iptables -A INPUT -i tun0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i tun0 -j DROP
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

sh -c "iptables-save > /etc/iptables.nat.vpn.secure"

Rules that renders no effect:

iptables -A FORWARD -i tun0 -o wlan1 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i wlan1 -o tun0 -j ACCEPT

Result:

VPN works on Pi. Hotspot works. No internet on client side. Client, basically a phone, gets assigned correct IP with subnet mask. Can't browse the Internet.

What's causing this failure?

Answer 1

Shouldn't your MASQUERADE rule be applied on your RPI's physical interface, instead of tun0? You want traffic from your VPN clients to be nat-ed to your RPI's IP, so that your home's router can reply to such traffic, through your RPI.

iptables --table nat --append POSTROUTING --src [network for your tun0] --out-interface wlan1 --jump MASQUERADE