Hello alltogether,
I'v got quite strange Problems with my new openvpn-setup (3 tunnels, tun):
From the Openvpn-Server pinging all clients and networks behind them works totally fine. Also I'm able to ping into my local LAN A from the remote LANs B,C and D.
What isn't working, is pinging fron Network A into Network B: the packtes show up on the eth0 of the OpenVPN-Server and they disappear and do not show up on tun0, what I expect them to do:
root@raspbian:~# tcpdump -nnel -i eth0 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
09:49:23.154167 bc:05:43:8e:7e:9b > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 74: 192.168.180.33 > 192.168.183.42: ICMP echo request, id 1, seq 11205, length 40
09:49:27.705598 bc:05:43:8e:7e:9b > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 74: 192.168.180.33 > 192.168.183.42: ICMP echo request, id 1, seq 11206, length 40
And nothing happens on tun0.
The Routing-Table on the openvpn-server is as follows:
root@raspbian:~# ip route
default via 192.168.180.1 dev eth0
10.8.1.0/24 via 10.8.1.2 dev tun0
10.8.1.2 dev tun0 proto kernel scope link src 10.8.1.1
169.254.0.0/16 dev eth0 scope link
192.168.2.0/24 via 10.8.1.2 dev tun0
192.168.180.0/24 dev eth0 proto kernel scope link src 192.168.180.27
192.168.183.0/24 via 10.8.1.2 dev tun0
root@raspbian:~#
The same problem occurs with network D: I don't even reach 10.8.1.18 from my local lan:
Pinging 10.8.1.18 from 192.168.180.25:
root@raspbian:~# tcpdump -nnel -i eth0 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
09:57:02.603538 bc:05:43:8e:7e:9b > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 98: 192.168.180.25 > 10.8.1.18: ICMP echo request, id 31007, seq 10, length 64
09:57:03.612621 bc:05:43:8e:7e:9b > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 98: 192.168.180.25 > 10.8.1.18: ICMP echo request, id 31007, seq 11, length 64
=> again nothing happens on tun0
The other way round everything is working fine:
tcpdum of eth0:
root@raspbian:~# tcpdump -nnel -i eth0 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
09:58:55.089880 b8:27:eb:2a:e8:b2 > 00:24:a5:a4:eb:1a, ethertype IPv4 (0x0800), length 98: 10.8.1.18 > 192.168.180.25: ICMP echo request, id 6203, seq 7, length 64
09:58:55.091735 bc:05:43:8e:7e:9b > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 98: 192.168.180.25 > 10.8.1.18: ICMP echo reply, id 6203, seq 7, length 64
09:58:56.097060 b8:27:eb:2a:e8:b2 > 00:24:a5:a4:eb:1a, ethertype IPv4 (0x0800), length 98: 10.8.1.18 > 192.168.180.25: ICMP echo request, id 6203, seq 8, length 64
09:58:56.098935 bc:05:43:8e:7e:9b > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 98: 192.168.180.25 > 10.8.1.18: ICMP echo reply, id 6203, seq 8, length 6
tcpdump of tun0 - here I see the packets only one-way.
root@raspbian:~# tcpdump -nnel -i tun0 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 65535 bytes
09:59:28.355897 ip: 10.8.1.18 > 192.168.180.25: ICMP echo request, id 6203, seq 40, length 64
09:59:29.364622 ip: 10.8.1.18 > 192.168.180.25: ICMP echo request, id 6203, seq 41, length 64
09:59:30.373355 ip: 10.8.1.18 > 192.168.180.25: ICMP echo request, id 6203, seq 42, length 64
So - that's my problem. It might be some Routing-Bug on the server (for sure it is), but I don't see what to change: packets get to the server and are not inserted in the tunnel.
Any ideas? I'm totally clueless and apreciate your help.
Best regards,
danny
Server.conf:
port 1199
proto udp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key # This file should be kept secret
dh /etc/openvpn/keys/dh1024.pem
server 10.8.1.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.180.0 255.255.255.0"
client-config-dir ccd
route 192.168.183.0 255.255.255.0
route 192.168.2.0 255.255.255.0
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 5
Client.conf (nearly identical on all 3 clients, only the SSL-things are changed)
client
dev tun
proto udp
remote vpn.dyn.shinewelt.de 1199
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert acars.crt
key acars.key
ns-cert-type server
comp-lzo
verb 3
CCD for Nework B
root@raspbian:/etc/openvpn/ccd# cat meteohub.dyn.shinewelt.de
iroute 192.168.183.0 255.255.255.0
root@raspbian:/etc/openvpn/ccd#
CCD for Network D
root@raspbian:/etc/openvpn/ccd# cat acars
iroute 192.168.2.50 255.255.255.255
CCD for Network B
root@raspbian:/etc/openvpn/ccd# cat freenas.dyn.shinewelt.de
iroute 192.168.2.200 255.255.255.255
One Example, where everything is working right: tracing the Host 192.168.2.200 (Network C) from Local LAN:
root@buffalo:~# traceroute 192.168.2.200
traceroute to 192.168.2.200 (192.168.2.200), 30 hops max, 38 byte packets
1 fritz.box (192.168.180.1) 1.822 ms 1.825 ms 1.514 ms
2 raspbian.fritz.box (192.168.180.27) 3.347 ms 2.787 ms 1.817 ms
3 localhost (192.168.2.200) 81.753 ms 83.723 ms 112.813 ms
root@buffalo:~#
=> Packets arrive on eth0 and get forwarded to tun0
The same with Host 192.168.2.50 (Network C)
traceroute to 192.168.2.50 (192.168.2.50), 30 hops max, 38 byte packets
1 fritz.box (192.168.180.1) 1.678 ms 1.981 ms 1.470 ms
2 * * *
3 *^C
=> Packets arrive on eth0 and - I don't know.
Additionally, there is no firewall active on the openvpn-server:
iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
