I can connect to OctoPrint when I'm on Wifi, but I can't connect to it over VPN

When on Wifi, I'm on the same subnet as OP. However when using the VPN, I have an IP on a different subnet. Is there any setting in OP that might be blocking other subnets?

Just to add, I'm running home assistant on the same machine as OP and I can connect to that over the VPN, so I'm like 99% sure that it's OP that is blocking me.

I guess this is the setting you're searching for: :slight_smile:
https://docs.octoprint.org/en/master/configuration/config_yaml.html?highlight=subnet

# additional non-local subnets to consider trusted, in CIDR notation, e.g. "192.168.1.0/24"
trustedSubnets: []

Please provide some details about your network including where the VPN server is located. Don't be afraid to provide actual IP addresses as I'm pretty sure all of them will be private.

OctoPi will accept packets from any IP address and will attempt to reply using its routing table (the command route will print this out). Same subnet will be sent directly, different subnet will be sent to the default gateway unless other entries exist.

So to answer your question, there's nothing in OP "blocking" other subnets. Without instructions on where to send replies, communications can't happen.

1 Like

Hello, I have exaclty the same probem...I want to connect to Ocoprintserver through VPN of my fritz.box. I used my iPhone with mobile data - 4G But the Webpage will not open. No error message is coming. Instead If I open the same address "192.168.178.128:5000" on my iPhone when I'm connected directly in my network everthing works...

When I'm connected through VPN I'm also able to PING the servers IP... and other Servers in my network can be reached without problems...
I have already asked support from AVM (supplier of fritz.box) but they say everything is ok with my VPN setup....

I'm only a basic user... so I don't know if I should change something in the config_yaml or not... Or how do I find out if everything is correct with my subnet mask...

I would be happy if I could get help here...

Greetings Justin

My reply from a year ago is still valid. Without details about your configuration (i.e. diagrams, route information, IP address assignments, etc. we can do nothing more that sympathize with you.

1 Like

Sure... but can you be more specific, where or how I do collect the information you'll need? Here I attached my Sysinfo from Octoprint... If this helps in any way...
octoprint-systeminfo-20220924125836.zip (48.3 KB)

And then I tried the command "route" from the shell: The result is this:

Kernel-IP-Routentabelle
Ziel            Router          Genmask         Flags Metric Ref    Use Iface
default         fritz.box       0.0.0.0         UG    303    0        0 wlan0
192.168.178.0   0.0.0.0         255.255.255.0   U     303    0        0 wlan0

Any other commands I can execute to get more information?

I'm not a network specalist... It's just a normal small mesh private home network: I have a router "frizbox" and this is connected to WAN by a modem from Vodafone. In the mesh is a WLAN repeater for better WLAN singnal in the basement, and a pair of powerline adapter for better (W)LAN connection in the upper rooom of my house. The mesh is completly managed by fritzbox and does not have any problems. (The Octopi server is normally placed in the cellar, so the connection is over the WLAN repeter, but if I place it next to the router it uses direct WLAN connection to it. (but my described problem is there also the same).
Router "fritzbox" has IP address 192.168.178.1 to get to the configuration. it has a DHCP running, but the Octoprint server has a fixed IP that is 192.168.178.128. The octoprint server is connected by WLAN... (The same with my iPhone if I'm in my WLAN, If i'm using VPN through the fritxbox it assigns 198.168.178.200 to the iPhone, and with direct connection it is 192.168.178.101)

  1. While on the system connected through the VPN, type traceroute <IP of OctoPi> and ifconfig.
  2. While SSHed into the OctoPi system, type traceroute <IP of system connected through the VPN> and route.

Post the results here (remember to use the </> icon above when posting).

Note: If the system connected through the VPN is a Windows system, Substitute tracert and ipconfig for the commands.

BTW, try changing the OctoPrint server to DHCP but with a fixed lease. This would be done on the fritzbox. You will have to figure out how to do it as I don't have a fritzbox.

So, OK thanks for commands... It is a bit complicated, since the system connected through VPN is my iPhone, and I don't think there is access to command line, as far as I know... But I searched for some apps that might help me here therefore only screenshots...

  1. So while on the iPhone connected through the VPN a traceoroute app output is the following:

ifconfig or ipconfig is also not available, but a networking app shows me the following, maybe that helps:

(see my next posts, since i'm not allowed to post more than one media... ?!? :zipper_mouth_face:

  1. While SSHed into the OctoPi system traceroute shows the following:
traceroute to 192.168.178.200 (192.168.178.200), 30 hops max, 60 byte packets
 1  fritz.box (192.168.178.1)  6.296 ms  6.959 ms  6.600 ms
 2  192.168.178.200 (192.168.178.200)  44.374 ms  51.374 ms  39.340 ms

and for route the result is:

Kernel-IP-Routentabelle
Ziel            Router          Genmask         Flags Metric Ref    Use Iface
default         fritz.box       0.0.0.0         UG    303    0        0 wlan0
192.168.178.0   0.0.0.0         255.255.255.0   U     303    0        0 wlan0

i also did ifconfig of the OctoPrint server (if this helps):

eth0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        ether 00:19:db:eb:f4:e2  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Lokale Schleife)
        RX packets 514  bytes 6596767 (6.2 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 514  bytes 6596767 (6.2 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlan0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.178.128  netmask 255.255.255.0  broadcast 192.168.178.255
        inet6 fe80::b4c1:f695:a8ee:5965  prefixlen 64  scopeid 0x20<link>
        inet6 fd0d:6623:5644:4070:1929:c7de:afed:b505  prefixlen 64  scopeid 0x0<global>
        ether 00:19:db:9c:ac:80  txqueuelen 1000  (Ethernet)
        RX packets 23789  bytes 5494851 (5.2 MiB)
        RX errors 0  dropped 1  overruns 0  frame 0
        TX packets 3030  bytes 535850 (523.2 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Surprisingly I found out, that if I want to log in with SSH from my iPhone connected with VPN is is unbelievable slow... it tooks around 2min ?!? only for the login... (and again if the iPhone is directly within my WLAN the SSH login is there in in second...)

Regarding the change of Octopint server to DHCP with fixed lease: I'm not sure how to setup this, because fritzbox is only userfriendly for non IT-persons... so in the config I have only a simple option to mark Octoprint Server IP and then I can add the option called "Assign always the same IPv4-address to this network device", which I did... I can only unmark this option and change the time after new DHCP addresses will be given (from default 10 days) to 1 day to get the the possibility to get a new IP address for the OctoprintServer... choosen by fritzbox DHCP...

here the missing pictures:

I think I see the problem. A system connected via the VPN should be in a different netblock than the LAN that the OctoPrint server is on. If it is in the same netblock, then it is assumed to be reachable without routing through the VPN, i.e. its on the same LAN so direct system to system communication is attempted (and fails).