Hello everyone, I recently configured a TAP OpenVPN network and everything seems to be pretty smooth except for a small issue. This is the NMAP result on the 10.0.5.0/24 network. [code] Starting Nmap 5.00 ( http://nmap.org ) at 2012-03-20 14:29 CET Host 10.0.5.1 is up. Host 10.0.5.4 is up (0.076s latency). MAC Address: 00:FF:0A:C8:8A:73 (Unknown) Host 10.0.5.5 is up (0.17s latency). MAC Address: FA:B9:2B:5F:C0:01 (Unknown) Host 10.0.5.6 is up (0.016s latency). MAC Address: 82:E0:50:96:77:A4 (Unknown) Host 10.0.5.8 is up (0.079s latency). MAC Address: 00:FF:07:0A:66:00 (Unknown) Nmap done: 256 IP addresses (5 hosts up) scanned in 4.38 seconds[/code] 10.0.5.1 is the server hosting the OpenVPN server and the CA (a Debian Squeeze) and is the only one to have a strange issue. I am unable to reach/ping most machine in the VPN network while all the other machine can reach each other (incl the server) without any issue. something like 10.0.5.5->10.0.5.1 ping works 10.0.5.1->10.0.5.5 ping doesn't work (timeout) but 10.0.5.4->10.0.5.5 ping works while 10.0.5.1->10.0.5.4 ping works 10.0.5.4->10.0.5.1 ping works This is the routing table for 10.0.5.1 (removed the IP in the default route from the log) : [code]Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 10.0.5.0 * 255.255.255.0 U 0 0 0 tap0 localnet * 255.255.255.0 U 0 0 0 eth0 default ?-?-?-?.?? 0.0.0.0 UG 0 0 0 eth0 [/code] and the IPTables (10.0.5.1) : [code]Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT tcp -- localhost anywhere tcp dpt:mysql ACCEPT tcp -- 10.0.5.0/24 anywhere tcp dpt:mysql DROP tcp -- anywhere anywhere tcp dpt:mysql ACCEPT udp -- 10.0.5.0/24 anywhere udp dpts:snmp:snmp-trap ACCEPT udp -- localhost anywhere udp dpts:snmp:snmp-trap DROP udp -- anywhere anywhere udp dpts:snmp:snmp-trap Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination [/code] and the IPTables (10.0.5.5) : [code] Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination [/code] I really don't know how to fix this as I need it to integrate everything with Nagios...any clues? Regards, feal87

[SOLVED] Strange issue with ping

feal87

Hello everyone,
I recently configured a TAP OpenVPN network and everything seems to be pretty smooth except for a small issue.

This is the NMAP result on the 10.0.5.0/24 network.

Starting Nmap 5.00 ( http://nmap.org ) at 2012-03-20 14:29 CET
Host 10.0.5.1 is up.
Host 10.0.5.4 is up (0.076s latency).
MAC Address: 00:FF:0A:C8:8A:73 (Unknown)
Host 10.0.5.5 is up (0.17s latency).
MAC Address: FA:B9:2B:5F:C0:01 (Unknown)
Host 10.0.5.6 is up (0.016s latency).
MAC Address: 82:E0:50:96:77:A4 (Unknown)
Host 10.0.5.8 is up (0.079s latency).
MAC Address: 00:FF:07:0A:66:00 (Unknown)
Nmap done: 256 IP addresses (5 hosts up) scanned in 4.38 seconds

10.0.5.1 is the server hosting the OpenVPN server and the CA (a Debian Squeeze) and is the only one to have a strange issue.
I am unable to reach/ping most machine in the VPN network while all the other machine can reach each other (incl the server) without any issue.

something like

10.0.5.5->10.0.5.1 ping works
10.0.5.1->10.0.5.5 ping doesn't work (timeout)
but
10.0.5.4->10.0.5.5 ping works

while

10.0.5.1->10.0.5.4 ping works
10.0.5.4->10.0.5.1 ping works

This is the routing table for 10.0.5.1 (removed the IP in the default route from the log) :

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.0.5.0        *               255.255.255.0   U     0      0        0 tap0
localnet        *               255.255.255.0   U     0      0        0 eth0
default         ?-?-?-?.?? 0.0.0.0         UG    0      0        0 eth0

and the IPTables (10.0.5.1) :

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --  localhost            anywhere            tcp dpt:mysql
ACCEPT     tcp  --  10.0.5.0/24          anywhere            tcp dpt:mysql
DROP       tcp  --  anywhere             anywhere            tcp dpt:mysql
ACCEPT     udp  --  10.0.5.0/24          anywhere            udp dpts:snmp:snmp-trap
ACCEPT     udp  --  localhost            anywhere            udp dpts:snmp:snmp-trap
DROP       udp  --  anywhere             anywhere            udp dpts:snmp:snmp-trap

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

and the IPTables (10.0.5.5) :

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

I really don't know how to fix this as I need it to integrate everything with Nagios...any clues?

Regards,
feal87

janjust

10.0.5.5->10.0.5.1 ping works
10.0.5.1->10.0.5.5 ping doesn't work (timeout)

if ping works one way and not the other then it's almost always a firewall issue on the receiving end; check the firewall on 10.0.5.5

feal87

[quote]
2012-03-20 17:28:09 DROP UDP *.*.*.1*10.0.5.255 35338 137 78 - - - - - - - RECEIVE
2012-03-20 17:28:18 DROP ICMP *.*.*.* 10.0.5.3 - - 84 - - - - 8 0 - RECEIVE

Thanks, I checked in the firewall log and my firewall is filtering it because he is using an IP that is not 10.0.5.1, but his own EXTERNAL internet ip. Why would this happen?! 😐
Any clues?

feal87

Fixed! It was a wrong SNAT iptable rule in the server machine. Changed that and everything is back working!

Thanks for the time anyway! 🙂