Client as a gateway for some of the traffic, CCD ignored

Wussie

Hi!
I have 2 multi-purpose Linux machines, both running Openvpn 2.0.9. I use both of them as gateways for 2 separate LANs, both using 192.168.0.0/24 for the NAT-ed Windows machines behind them. One of the Linux machines acts as an Openvpn multiclient server, which has been working just fine with several remote clients over the last few years.
Recently I have been trying to connect the second Linux machine as a client to the existing Openvpn server, the goal being to provide an alternate route to certain public subnets for the Windows machines behind the server.

Windows machines - 192.168.0.0/24 - VPN server .......ISP1.......VPN client ns1 ...... ISP2......target public subnets

As you can see, the server is connected to the internet via ISP1, whereas the client has 2 internet connections, via ISP1 and ISP2. The goal is to provide a route for the Windows machines to certain target subnets via ISP2.
The fact that the client has its own NAT-ed machines behind it using the same 192.168.0.0/24 address space is irrelevant, because I don't need them to have access to the server's private LAN.

server.conf:

port 1200
proto udp
dev tun
ca ./keys/ca.crt
cert ./keys/server.crt
key ./keys/server.key
dh ./keys/dh1024.pem

server 10.55.99.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ccd
route 78.128.63.0 255.255.255.224
route 83.149.86.128 255.255.255.224
route 10.55.98.0 255.255.255.252

keepalive 10 60
ping-timer-rem
comp-lzo
max-clients 4
user nobody
group nobody
daemon
persist-key
persist-tun
status openvpn-status.log
verb 4
replay-window 128 40

./ccd/ns1:

ifconfig-push 10.55.98.1 10.55.99.1
iroute 78.128.63.0 255.255.255.224
iroute 83.149.86.128 255.255.255.224

client.conf:

client
dev tun
proto udp
remote vpnserver.com 1200
resolv-retry infinite
nobind
user nobody
group nobody
persist-key
persist-tun
ca ./keys/ca.crt
cert ./keys/ns1.crt
key ./keys/ns1.key
ns-cert-type server
comp-lzo
log openvpn.log
verb 4
mute 20
keepalive 10 60
ping-timer-rem

The client connects to the server, but ignores the /etc/openvpn/ccd/ns1 file and takes an IP address like 10.55.99.6 instead of the fixed IP I wanted, and more importantly, it does not pull the 2 extra routes to the target subnets, as I could see in the log. The client and server ping each other, but the server can't ping those target subnets via the tunnel.

I realize that more routes and iptables rules are needed on both Linux machines, but for now I wish to find out why the client seems to ignore my ccd config. I can post logs if needed. Can anyone please help me?

maikcat

hi there,

the ccd filename must match the CN of the cert you are using,
to check this out :
openssl x509 -subject -noout -in ns1.crt

check that the canonical name CN is ns1

also give full path where your ccd files are located into server config.

Michael

Wussie

Thanks for reply!
Yes, I get the CN=ns1 response to the line of code you gave me. I know now about the proper full path to the ccd/ns1 file, as should have really been stated in the openvpn documentation. I figured it out the hard way, a few days ago.
Now the client gets the desired 10.55.98.1 IP, but I can't see any refference in the log about pulling the iroute commands from the server. I use verb 4. Should there be any sign of those 2 extra routes somewhere?
I did some further testing and I was able to ping the target subnets from the server machine, verified that traceroute finds it's way to them via 10.55.98.1 but any http connection to the target IPs fails.
On the server I have only the main routing table:

root@server:~# ip r list
10.0.0.1 dev ppp0  proto kernel  scope link  src 188.26.x.y
10.55.99.2 dev tun0  proto kernel  scope link  src 10.55.99.1
10.55.98.0/30 via 10.55.99.2 dev tun0
78.128.63.0/27 via 10.55.99.2 dev tun0
83.149.86.128/27 via 10.55.99.2 dev tun0
10.55.99.0/24 via 10.55.99.2 dev tun0
192.168.0.0/24 dev eth0  proto kernel  scope link  src 192.168.0.1
127.0.0.0/8 dev lo  scope link
default dev ppp0  scope link

The server has a static IP of 188.26.x.y and the firewall contains:

iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o tun0 -j SNAT --to-source 10.55.99.1

The client has the main routing table like this:

root@client:/# ip r list
10.0.0.1 dev ppp0  proto kernel  scope link  src 188.26.z.w
10.55.99.1 dev tun0  proto kernel  scope link  src 10.55.98.1
i.s.p.2/24 dev eth2  proto kernel  scope link  src i.s.p.2
192.168.0.0/24 dev eth0  proto kernel  scope link  src 192.168.0.1
127.0.0.0/8 dev lo  scope link
default dev ppp0  scope link

and a second table BTC:

root@client:/# ip r list table BTC
10.0.0.1 dev ppp0  proto kernel  scope link  src 188.26.z.w
10.55.99.1 dev tun0  proto kernel  scope link  src 10.55.98.1
i.s.p.2gw/24 dev eth2  proto kernel  scope link  src i.s.p.2
192.168.0.0/24 dev eth0  proto kernel  scope link  src 192.168.0.1
127.0.0.0/8 dev lo  scope link
default via i.s.p.2gw dev eth2  src i.s.p.2

The client has the folowing routing rules:

root@retea:/# ip ru list
0:      from all lookup local
32760:  from i.s.p.2 lookup BTC
32762:  from all to 83.149.86.128/27 lookup BTC
32763:  from all to 78.128.63.0/27 lookup BTC
32766:  from all lookup main
32767:  from all lookup default

It has a static IP of 188.26.z.w and it's firewall contains:

iptables -A INPUT -i tun0 -j ACCEPT
iptables -A FORWARD -p ALL -i tun0 -s 10.55.98.0/23 -j ACCEPT
iptables -A FORWARD -i tun+ -j ACCEPT
iptables -A OUTPUT -o tun0 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.55.98.0/23 -o eth2 -j SNAT --to-source i.s.p.2

Where did I go wrong? :roll:

maikcat

hi there,

quite complicated setup... :shock:

but I can't see any refference in the log about pulling the iroute commands from the server. I use verb 4. Should there be any sign of those 2 extra routes somewhere?

no 8-)

verified that traceroute finds it's way to them via 10.55.98.1 but any http connection to the target IPs fails.

http logs from the target pc show something usefull?

Michael.

Wussie

maikcat wrotequite complicated setup... :shock:

Wouldn't have bothered you for anything too simple :mrgreen:
Unfortunately I have no access to the target site's logs, because it's a public website and it's not mine (www.vplay.ro). I did try adding some other website's IP to the whole setup though, with the same result: ping works from the server, but a command like "lynx www.othersite.com" stalls with the message "Making HTTP connection to www.othersite.com ..."
Any other ideas?