Hello,
short description/my target
building site2site vpn with more than 2 sites. using routers as internetgateway/vpn-gateway.
it should be possible to send packets from A to C without attach B or send from B to A without attach C etc.
in the future i like to add more sites, if it is required.
problem:
iptables/routing configuration: its exasperating. i turning on the same position since month and can't proceed. when i logged into router A, I can ping router B and ping (logged into B) from B to A. But the network behind the routers are unreachable. for my roadwarrior vpn configuration i need iptables and it worked. but this rules logical not applied for site2site vpn.
overview:
site C ist disabled at this time!
site A configuration:
port xxx
proto tcp
dev tun
ca ca.crt
cert xxx.crt
key xxx.key
dh dh1024.pem
management 127.0.0.1 44001
server 10.8.1.0 255.255.255.0
ifconfig-pool-persist ipp.txt
route 10.150.2.0 255.255.255.0
route 10.150.3.0 255.255.255.0
client-config-dir /etc/openvpn/network/ccd/ # cc's applied(iroute...)
keepalive 10 120
auth SHA1
cipher AES-256-CBC
verb 3
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.8.1.2 * 255.255.255.255 UH 0 0 0 tun1
10.150.1.0 * 255.255.255.0 U 0 0 0 br-lan
10.150.2.0 10.8.1.2 255.255.255.0 UG 0 0 0 tun1
10.8.1.0 10.8.1.2 255.255.255.0 UG 0 0 0 tun1
xx.xx.xx.x * 255.255.252.0 U 0 0 0 eth0.1
default xx-xx-xx-xxx-xxx 0.0.0.0 UG 0 0 0 eth0.1
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
syn_flood tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,ACK/SYN
input_rule all -- anywhere anywhere
input all -- anywhere anywhere
Chain FORWARD (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
forwarding_rule all -- anywhere anywhere
forward all -- anywhere anywhere
reject all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
output_rule all -- anywhere anywhere
output all -- anywhere anywhere
Chain forward (1 references)
target prot opt source destination
zone_lan_forward all -- anywhere anywhere
zone_wan_forward all -- anywhere anywhere
Chain forwarding_lan (1 references)
target prot opt source destination
Chain forwarding_rule (1 references)
target prot opt source destination
ACCEPT all -- anywhere 10.150.1.0/24
ACCEPT all -- anywhere 10.150.2.0/24
nat_reflection_fwd all -- anywhere anywhere
Chain forwarding_wan (1 references)
target prot opt source destination
Chain input (1 references)
target prot opt source destination
zone_lan all -- anywhere anywhere
zone_wan all -- anywhere anywhere
Chain input_lan (1 references)
target prot opt source destination
Chain input_rule (1 references)
target prot opt source destination
Chain input_wan (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpt:xxx
ACCEPT tcp -- anywhere anywhere tcp dpt:xxx
Chain nat_reflection_fwd (1 references)
target prot opt source destination
Chain output (1 references)
target prot opt source destination
zone_lan_ACCEPT all -- anywhere anywhere
zone_wan_ACCEPT all -- anywhere anywhere
Chain output_rule (1 references)
target prot opt source destination
Chain reject (5 references)
target prot opt source destination
REJECT tcp -- anywhere anywhere reject-with tcp-reset
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
Chain syn_flood (1 references)
target prot opt source destination
RETURN tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,ACK/SYN limit: avg 25/sec burst 50
DROP all -- anywhere anywhere
Chain zone_lan (1 references)
target prot opt source destination
input_lan all -- anywhere anywhere
zone_lan_ACCEPT all -- anywhere anywhere
Chain zone_lan_ACCEPT (2 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain zone_lan_DROP (0 references)
target prot opt source destination
DROP all -- anywhere anywhere
DROP all -- anywhere anywhere
Chain zone_lan_REJECT (1 references)
target prot opt source destination
reject all -- anywhere anywhere
reject all -- anywhere anywhere
Chain zone_lan_forward (1 references)
target prot opt source destination
zone_wan_ACCEPT all -- anywhere anywhere
forwarding_lan all -- anywhere anywhere
zone_lan_REJECT all -- anywhere anywhere
Chain zone_wan (1 references)
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp dpt:bootpc
ACCEPT icmp -- anywhere anywhere icmp echo-request
ACCEPT tcp -- anywhere anywhere tcp dpt:xxx
ACCEPT tcp -- anywhere anywhere tcp dpt:xxx
input_wan all -- anywhere anywhere
zone_wan_REJECT all -- anywhere anywhere
Chain zone_wan_ACCEPT (2 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain zone_wan_DROP (0 references)
target prot opt source destination
DROP all -- anywhere anywhere
DROP all -- anywhere anywhere
Chain zone_wan_REJECT (2 references)
target prot opt source destination
reject all -- anywhere anywhere
reject all -- anywhere anywhere
Chain zone_wan_forward (1 references)
target prot opt source destination
forwarding_wan all -- anywhere anywhere
zone_wan_REJECT all -- anywhere anywhere
site B configuration:
client
dev tun
proto tcp
remote xxx
port xxx
ca ca.crt
cert xxx.crt
key xxx.key
auth SHA1
cipher AES-256-CBC
verb 3
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
...
10.150.1.0 10.8.1.5 255.255.255.0 UG 0 0 0 tun1
...
thank you very much for your help!
