Unable to reach network behind vpn server (again)

fraserat

Hello everybody!

I read lots of post before about ip forwarding, iptables rules, vpn routes.
But I wasn't able to solve my problem.
I can successfully ping the other hosts in the servers network from the server itself.
So it might not be a firewall problem.
But not from my vpn client. I am not able to reach any other host in the vpn servers network.

Maybe someone can kindly figure out what went wrong in my configuration.
So here it is (Debian Wheezy):

server.conf

push "route 192.168.1.0 255.255.255.0"
push "route 10.8.0.0 255.255.255.0"
port 443
proto tcp
dev tun
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh4096.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log-append openvpn.log
verb 3

client.conf

client
  dev tun
  proto tcp
  remote 192.168.1.60 443
  resolv-retry infinite
  nobind
  user nobody
  group nogroup
  persist-key
  ca ca.crt
  cert client1.crt
  key client1.key
  ns-cert-type server
  tls-auth ta.key 1
  comp-lzo
  verb 3

# route -n

0.0.0.0         192.168.1.1  0.0.0.0         UG    0      0        0 eth0
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.8.0.2        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
192.168.1.0   0.0.0.0         255.255.255.0   U     0      0        0 eth0

# iptables -S

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT

cat /proc/sys/net/ipv4/ip_forward

Thanks for your support
fraser

chrome46

I am experiencing the same problem, and have almost identical conf files and table results, and look forward to a reply.

One thing I saw; in the route -n output, is the last entry is

192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0

should it be

192.168.1.0 10.8.0.1 ...

?

janjust

@fraser:

in your setup your VPN client will have an address in the range 10.8.0.x (first client should be 10.8.0.6) ; when this client pings a machine on the server side LAN, does this machine know that packets with a source address of 10.8.0.x need to go back to the VPN server? is the appropriate return route available on the server-side GW?

Alternatively you can use

iptables -t nat -O POSTROUTING -o eth0 -j MASQUERADE

to make all traffic to appear as if it is coming from the VPN server.

fraserat

@janjust

I got an error with your command
iptables v1.4.13: unknown option "-0"

Is syntax not correct?

chrome46

I'm not at the office to try this out on my own setup, but assuming that you've routed the client destined traffic to the vpn server in the gateway, could the first commented out line in the (example) server.conf file ";local a.b.c.d" be the problem?

if that where set to the OpenVPN server's local IP (192.168.1.x), I wonder if you would then be able to ping the devices on the server side lan.

janjust

@fraserat: sorry , typo in my posting. it should be

iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE

chrome46

I solved my similar issue by:

route add 192.168.75.0 mask 255.255.255.0 10.8.0.5 if 4

192.168.75.0 - server side LAN
10.8.0.1 - server VPN IP address
1192.168.0.1 - client side LAN
10.8.0.6 - client VPN IP address (tap win32)
0x4 - TAP-Win_32 adapter

I had also neglected to ipforward on the server, as well as put the servernnic in promiscuous mode.

I can successfully ping IP's on the server-side LAN.

fraserat

@janjust

Thank you very much. The new command did finally work.
Sorry for posting so late. Just arrived from vacation.