0

I'm trying to set up a NordVPN hotspot on my Raspberry Pi 3B+ so I can connect it to my smart tv and get rid of Netflix region restrictions.

I have everything set up properly but still dnsmasq DHCP is refusing to give any IP address to devices that try to connect through Wifi.

I have set up static ip address on wlan0 in /etc/dhcpd.conf:

interface wlan0
static ip_address=192.168.1.1/24

here is how my /etc/dnsmasq.conf looks like:

interface=wlan0
dhcp-range=192.168.1.2,192.168.1.10,24h
dhcp-option=3,192.168.1.1 #Gateway

my /etc/hostapd/hostapd.conf looks like this:

interface=wlan0
ssid=SSID
hw_mode=g
channel=7
wmm_enabled=0
macaddr_acl=0
auth_algs=1
ignore_broadcast_ssid=0
wpa=2
wpa_passphrase=Password
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP
rsn_pairwise=CCMP

and i have done my iptables accordingly:

iptables -t nat -A  POSTROUTING -o tun0 -j MASQUERADE
iptables -A FORWARD -i tun0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i wlan0 -o tun0 -j ACCEPT

and here is the output of iptables --list :

Chain INPUT (policy DROP)
target     prot opt source                  destination

Chain FORWARD (policy ACCEPT)
target     prot opt source                  destination
ACCEPT     all  --  anywhere                anywhere             state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere                anywhere

Chain OUTPUT (policy DROP)
target     prot opt source                  destination

Now I connect to NordVPN using:

nordvpn connect UK

and after connection is established and I can see tun0 connected in ifconfig and confirm that the VPN is active with traceroute , I take my phone and attempt to connect to the WiFi hotspot that was just created but it is stuck on "Obtaining IP Address" and never succeeds. I have tried a Windows Laptop and my smart TV as well and both fail to obtain IP address.

Does anyone know what the issue here is? Any help would be really appreciated.

Alen
  • 1
  • I don't understand ... why you use dhcpd and dnsmasq in same time for dhcp server ? `sudo netstat -laputen |grep :67` what is the pid name of your dhcp server ? – Ephemeral Sep 05 '19 at 18:17
  • @Ephemeral I'm just following the NAT part of this [guide](https://www.raspberrypi.org/documentation/configuration/wireless/access-point.md) on the raspberry pi website and changed the iptables to tun0 instead of eth0 and added the two extra iptables commands according to [this](https://calap.co/blog/how-to-use-raspberry-pi-as-a-vpn-access-point--2018-10-27.html) for some reason after a reboot I could no longer even ping the rPi or SSH to it so I had to wipe and reflash Raspbian. but this has happened a lot of times before – Alen Sep 05 '19 at 18:18
  • Okay, I'll watch – Ephemeral Sep 05 '19 at 18:20
  • @Ephemeral Also one thing that I observed, If I use `sudo openvpn /pathtoconfig/` to connect to a openvpn server using a config file this issue with dhcp doesn't exist. I can have a openvpn hotspot without a problem. But Netflix can detect openvpn and doesn't let me watch.so I need to be able to use the `nordvpn` linux app but when that is active as tun0, for some reason the hotspot refuses to issue IP addresses. – Alen Sep 05 '19 at 18:23
  • have you check `sudo dmesg` or `sudo cat /var/log/syslog` ? – Ephemeral Sep 05 '19 at 18:25
  • Have you put this line in the dhcpd conf : `nohook wpa_supplicant` ? – Ephemeral Sep 05 '19 at 18:27
  • @Ephemeral yes, exactly like the guide I had `nohook wpa_supplicant` too. I am currently re configuring the whole thing from scratch to run the commands you told me `sudo dmesg` and `sudo cat /var/log/syslog`. – Alen Sep 05 '19 at 18:37
  • 2
    You mean `dhcpcd` and not `dhcpd`, isn't it? If you start from scratch you may consider to use built-in functionality without fiddling with dnsmasq, hostapd and dhcpcd. This could simplify things: [Setting up a Raspberry Pi as an access point - the easy way](https://raspberrypi.stackexchange.com/a/88234/79866). – Ingo Sep 05 '19 at 20:50
  • oh ! well seen Ingo !... I have also miss the 'c' ... everything now makes sense – Ephemeral Sep 05 '19 at 21:55

1 Answers1

1

Your input and output chain has a policy to drop, and you have no rules to accept, so all incoming packets are dropped, as are out going. Something like this will completely open the firewall and allow NAT.
iptables -P INPUT ACCEPT
iptables -F INPUT
iptables -P OUTPUT ACCEPT
iptables -F OUTPUT
iptables -P FORWARD ACCEPT
iptables -F FORWARD
iptables -F -t nat
iptables -F

rickyrockrat
  • 11
  • 1