Struggling to route client networks via OpenVPN tunnel

georgema

Hi,

I have been testing with OpenVPN all day and have run into an issue. I will try to explain as clearly as I can.

I have the following setup:

Client PCs -----------> Gateway (2 interfaces) -------> Router ------> WWW -----> OpenVPN server ----> Server
192.168.111.0/24        192.168.111.1 (eth0)        192.168.100.254               3.2.4.11/26         3.2.4.3
                        192.168.100.127 (wlan0)

The gateway machine is effectively the Openvpn client. I have a tunnel configured and working between the gateway and the openvpn server, and am able to ping across it. I can see traffic coming out of the tunnel at the far end and routing to the destination server.

I have dhcpd set up on the gateway machine to supply addresses to the client PCs, this is also working. I can ping from the client PCs to the Internet.

So far the problem I have had, is that I have been unable to get the gateway to send any client PC traffic over the tunnel. I have been using tcpdump to monitor the tun interface on the Openvpn server and I only see traffic when it originates from the gateway - client PC traffic never arrives.

Here is some extra info.

Routing table from gateway (tunnel up):

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.8.0.5        *               255.255.255.255 UH    0      0        0 tun0
3.2.4.11        192.168.100.254 255.255.255.255 UGH   0      0        0 wlan0
10.8.0.1        10.8.0.5        255.255.255.255 UGH   0      0        0 tun0
3.2.4.0         10.8.0.5        255.255.255.192 UG    0      0        0 tun0
192.168.100.0   *               255.255.255.0   U     2      0        0 wlan0
192.168.111.0   *               255.255.255.0   U     1      0        0 eth0
link-local      *               255.255.0.0     U     1000   0        0 wlan0
default         10.8.0.5        128.0.0.0       UG    0      0        0 tun0
128.0.0.0       10.8.0.5        128.0.0.0       UG    0      0        0 tun0
default         192.168.100.254 0.0.0.0         UG    0      0        0 wlan0

Gateway Openvpn config:

client 
remote 3.2.4.11 1194 
dev tun0 
proto tcp 
resolv-retry infinite 
nobind 
persist-key 
persist-tun 
ca ca.crt
cert client.crt 
key client.key 
#tls-auth ta.key 1 
verb 4 
comp-lzo

Openvpn server config:

port 1194
proto tcp
dev tun 

#certificates and encryption
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh1024.pem
#tls-auth ta.key 0 # This file is secret

server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt 

keepalive 10 120 
comp-lzo 
user nobody 
group nogroup
persist-key 
persist-tun 
status /var/log/openvpn-status.log 
verb 3 

log-append /var/log/openvpn 
status /tmp/vpn.status 10 

push "dhcp-option DNS 3.2.4.40" 
push "redirect-gateway def1"
push "route 3.2.4.0 255.255.255.192"

Any help would be very gratefully received, I feel like I'm very close to getting this working but can't find the last piece of the puzzle.

Many thanks in advance

George

maikcat

from the openvpn client itself can you:

ping the vpn server (10.8.0.1)?
ping the 3.2.4.11 & 3.2.4.3?

Michael.

georgema

Worked out the issue after much head scratching. There were a couple of directives missing from my server config file.

I added a route statement to define the private subnet behind the gateway machine, I created a /etc/openvpn/ccd (as explained in the example config here: http://openvpn.net/index.php/open-source/documentation/howto.html#examples) and in that file added an iroute statement with the same subnet.

I also had to add a NAT statement on the VPN server to NAT traffic from the network behind the gateway using iptables like so

iptables -t nat -A POSTROUTING -s 192.168.111.0/24 -o eth0 -j MASQUERADE

So now the iptables NAT table on OpenVPN server looks like this:

root@thn-vpn:/etc/openvpn# iptables -L -v -t nat
Chain PREROUTING (policy ACCEPT 1862 packets, 118K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 1386 packets, 83953 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    5   372 MASQUERADE  all  --  any    eth0    10.8.0.0/24          anywhere            
  215 14096 MASQUERADE  all  --  any    eth0    192.168.111.0/24     anywhere            

Chain OUTPUT (policy ACCEPT 63 packets, 4530 bytes)
 pkts bytes target     prot opt in     out     source               destination

And my OpenVPN server config file (the right hand side of the network as shown in my net diagram above) looks like this:

port 1194
proto tcp
dev tun 
client-config-dir ccd
route 192.168.111.0 255.255.255.0

#certificates and encryption
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh1024.pem
#tls-auth ta.key 0 # This file is secret

server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt 

keepalive 10 120 
comp-lzo 
user nobody 
group nogroup
persist-key 
persist-tun 
status /var/log/openvpn-status.log 
verb 3 

log-append /var/log/openvpn 
status /tmp/vpn.status 10 

push "dhcp-option DNS 3.2.4.40" 
push "redirect-gateway def1"
push "route 3.2.4.0 255.255.255.192"

This all works, although I feel that maybe I should be NAT'ing the 192.168.111.0 traffic on the gateway machine rather than the OpenVPN server. But it's progress!

georgema

maikcat wrotefrom the openvpn client itself can you:

ping the vpn server (10.8.0.1)?
ping the 3.2.4.11 & 3.2.4.3?

Michael.

Hi Michael
Yes and yes. Please see my next post (edit: previous post), it has more info. I have managed to get it working in a fashion, although I feel it can still be improved.

Thanks

George