Hello!
I have some issues with my openvpn client (I hope this is the correct place for this).
I have OpenBSD firewall/gateway protecting a network of mainly Win 7 clients, the OpenBSD machine also runs as a webserver/mailserver/nameserver i need to connect the OpenBSD to a VPN and route all traffic from the Win 7 clients through the VPN but maintain the original connection so people still has access to the webserver and so on.
Internet
/
Win 7 clients --------------- OpenBSD /
( firewall/gateway ) /
( webserver/mailserver/nameserver)
OpenVPN client
\ Internet
\ /
\ /
OpenVPN service
I have no problem connecting to the VPN from openbsd, but the when i do I cant reach my original IP from the internet and i can´t access the internet from the Win 7 clients.
I guess it´s some kind of routing issue or perhaps a PF issue. Any help would be much appriciated.
Here is my my openvpn client.conf
float
client
nobind
dev tun0
proto udp
; Cert
ca keys/ca.crt
ns-cert-type server
cipher BF-CBC
;Host
remote-random
remote anna.vpntunnel.se 1194
remote anna.vpntunnel.se 10010
remote anna.vpntunnel.se 10020
resolv-retry infinite
;auth
auth-user-pass
persist-key
persist-tun
comp-lzo
verb 2
Here is netstat output when not connected to the VPN
# netstat -rn
Routing tables
Internet:
Destination Gateway Flags Refs Use Mtu Prio Iface
default 83.250.128.1 UGS 8 27655311 - 8 em0
10.99.1.185 10.99.1.186 H 0 0 - 4 tun0
83.250.128/20 link#1 UC 2 0 - 4 em0
83.250.128.1 88:43:e1:6c:a7:db UHLc 1 0 - 4 em0
83.250.136.126 127.0.0.1 UGHS 0 11 33152 8 lo0
83.250.143.255 link#1 UHLc 1 1135 - 4 em0
127/8 127.0.0.1 UGRS 0 0 33152 8 lo0
127.0.0.1 127.0.0.1 UH 4 10403 33152 4 lo0
192.168.1/24 link#2 UC 3 0 - 4 em1
192.168.1.4 00:25:11:51:c6:a7 UHLc 3 87538507 - 4 em1
192.168.1.10 cc:08:e0:ab:5e:28 UHLc 2 14856 - 4 em1
192.168.1.255 link#2 UHLc 2 1135 - 4 em1
224/4 127.0.0.1 URS 0 0 33152 8 lo0
Here is the ifconfig output when not connected
# ifconfig
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 33152
priority: 0
groups: lo
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x5
inet 127.0.0.1 netmask 0xff000000
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
lladdr 00:1b:21:a1:a8:ad
priority: 0
groups: egress
media: Ethernet autoselect (1000baseT full-duplex,rxpause,txpause)
status: active
inet6 fe80::21b:21ff:fea1:a8ad%em0 prefixlen 64 scopeid 0x1
inet 83.250.136.126 netmask 0xfffff000 broadcast 83.250.143.255
em1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
lladdr 00:1b:21:a1:ac:07
priority: 0
media: Ethernet autoselect (1000baseT full-duplex,rxpause,txpause)
status: active
inet 192.168.1.1 netmask 0xffffff00 broadcast 192.168.1.255
inet6 fe80::21b:21ff:fea1:ac07%em1 prefixlen 64 scopeid 0x2
enc0: flags=0<>
priority: 0
groups: enc
status: active
pflog0: flags=141<UP,RUNNING,PROMISC> mtu 33152
priority: 0
groups: pflog
tun0: flags=8011<UP,POINTOPOINT,MULTICAST> mtu 1500
priority: 0
groups: tun
status: down
inet 10.99.2.34 --> 10.99.2.33 netmask 0xffffffff
Here is the openVPN output
# openvpn --config /etc/openvpn/client.conf
Tue Jul 24 13:15:24 2012 OpenVPN 2.1.4 x86_64-unknown-openbsd5.0 [SSL] [LZO2] built on Aug 4 2011
Enter Auth Username: ***
Enter Auth Password: ***
Tue Jul 24 13:15:30 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Jul 24 13:15:30 2012 LZO compression initialized
Tue Jul 24 13:15:30 2012 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Jul 24 13:15:30 2012 RESOLVE: NOTE: anna.vpntunnel.se resolves to 4 addresses
Tue Jul 24 13:15:30 2012 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Jul 24 13:15:30 2012 Local Options hash (VER=V4): '41690919'
Tue Jul 24 13:15:30 2012 Expected Remote Options hash (VER=V4): '530fdded'
Tue Jul 24 13:15:30 2012 UDPv4 link local: [undef]
Tue Jul 24 13:15:30 2012 UDPv4 link remote: 178.73.212.236:10020
Tue Jul 24 13:15:30 2012 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Jul 24 13:15:30 2012 VERIFY OK: depth=1, /C=SE/ST=CA/L=SanFrancisco/O=Fort-Funston/CN=Fort-Funston_CA/emailAddress=me@myhost.mydomain
Tue Jul 24 13:15:30 2012 VERIFY OK: nsCertType=SERVER
Tue Jul 24 13:15:30 2012 VERIFY OK: depth=0, /C=SE/ST=CA/L=SanFrancisco/O=Fort-Funston/CN=server/emailAddress=me@myhost.mydomain
Tue Jul 24 13:15:30 2012 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Jul 24 13:15:30 2012 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jul 24 13:15:30 2012 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Jul 24 13:15:30 2012 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jul 24 13:15:30 2012 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Jul 24 13:15:30 2012 [server] Peer Connection Initiated with 178.73.212.236:10020
Tue Jul 24 13:15:32 2012 /sbin/ifconfig tun0 destroy
Tue Jul 24 13:15:32 2012 /sbin/ifconfig tun0 create
Tue Jul 24 13:15:32 2012 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
Tue Jul 24 13:15:32 2012 /sbin/ifconfig tun0 10.99.2.34 10.99.2.33 mtu 1500 netmask 255.255.255.255 up
Tue Jul 24 13:15:32 2012 TUN/TAP device /dev/tun0 opened
add net 178.73.212.236: gateway 83.250.128.1
add net 0.0.0.0: gateway 10.99.2.33
add net 128.0.0.0: gateway 10.99.2.33
add net 10.99.2.1: gateway 10.99.2.33
Tue Jul 24 13:15:32 2012 Initialization Sequence Completed
Here is netstat output when connected to VPN
# netstat -rn
Routing tables
Internet:
Destination Gateway Flags Refs Use Mtu Prio Iface
0/1 10.99.2.33 UGS 0 2 - 8 tun0
default 83.250.128.1 UGS 9 27698401 - 8 em0
10.99.2.1/32 10.99.2.33 UGS 0 0 - 8 tun0
10.99.2.33 10.99.2.34 UH 3 0 - 4 tun0
83.250.128/20 link#1 UC 2 0 - 4 em0
83.250.128.1 88:43:e1:6c:a7:db UHLc 2 0 - 4 em0
83.250.136.126 127.0.0.1 UGHS 0 11 33152 8 lo0
83.250.143.255 link#1 UHLc 1 1138 - 4 em0
127/8 127.0.0.1 UGRS 0 0 33152 8 lo0
127.0.0.1 127.0.0.1 UH 3 10403 33152 4 lo0
128/1 10.99.2.33 UGS 0 4 - 8 tun0
178.73.212.236/32 83.250.128.1 UGS 0 0 - 8 em0
192.168.1/24 link#2 UC 3 0 - 4 em1
192.168.1.4 00:25:11:51:c6:a7 UHLc 6 87580984 - 4 em1
192.168.1.10 cc:08:e0:ab:5e:28 UHLc 2 14856 - 4 em1
192.168.1.255 link#2 UHLc 2 1138 - 4 em1
224/4 127.0.0.1 URS 0 0 33152 8 lo0
Here is the ifconfig output when connected to the VPN
# ifconfig
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 33152
priority: 0
groups: lo
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x5
inet 127.0.0.1 netmask 0xff000000
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
lladdr 00:1b:21:a1:a8:ad
priority: 0
groups: egress
media: Ethernet autoselect (1000baseT full-duplex,rxpause,txpause)
status: active
inet6 fe80::21b:21ff:fea1:a8ad%em0 prefixlen 64 scopeid 0x1
inet 83.250.136.126 netmask 0xfffff000 broadcast 83.250.143.255
em1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
lladdr 00:1b:21:a1:ac:07
priority: 0
media: Ethernet autoselect (1000baseT full-duplex,rxpause,txpause)
status: active
inet 192.168.1.1 netmask 0xffffff00 broadcast 192.168.1.255
inet6 fe80::21b:21ff:fea1:ac07%em1 prefixlen 64 scopeid 0x2
enc0: flags=0<>
priority: 0
groups: enc
status: active
pflog0: flags=141<UP,RUNNING,PROMISC> mtu 33152
priority: 0
groups: pflog
tun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1500
priority: 0
groups: tun
status: active
inet 10.99.0.250 --> 10.99.0.249 netmask 0xffffffff
And finally the pf.conf
ext_if ="em0"
int_if ="em1"
vpn_if ="tun0"
zoidberg ="192.168.1.4"
fry ="192.168.1.5"
squid ="192.168.1.2"
tcp_state ="flags S/SA modulate state"
udp_state ="keep state"
ftp_port ="21"
ssh_port ="22"
smtp_port ="25"
dns_port ="53"
http_port ="80"
https_port ="443"
pop3_port ="110"
ident_port ="113"
imap_port ="143"
smtp_submission_port ="587"
imaps_port ="993"
pop3s_port ="995"
table <bruteforce> counters
set skip on lo
set debug urgent
set reassemble yes
set block-policy drop
set loginterface $ext_if
set state-policy if-bound
set fingerprints "/etc/pf.os"
set ruleset-optimization none
set optimization normal
set timeout { tcp.established 360, tcp.closing 60 }
antispoof log quick for { $int_if ($ext_if) }
block quick inet6
block in log quick on $ext_if inet proto tcp from <bruteforce> to any
block in log quick on $ext_if inet proto udp from <bruteforce> to any
block in log quick on $ext_if inet from any to 255.255.255.255
block in log quick on $ext_if inet from urpf-failed to any
block in log quick on $ext_if inet from no-route to any
block in log on $ext_if
match out on egress inet from !(egress) to any nat-to (egress:0)
anchor "ftp-proxy/*"
pass in log on $ext_if inet proto tcp from !($ext_if) to ($ext_if) port $ssh_port $tcp_state (max-src-conn 5, max-src-conn-rate 4/60, overload <bruteforce> flush)
pass in log on $ext_if inet proto tcp from !($ext_if) to ($ext_if) port $smtp_port $tcp_state (max-src-conn 200, max-src-conn-rate 30/10, overload <bruteforce> flush)
pass in log on $ext_if inet proto tcp from !($ext_if) to ($ext_if) port $dns_port $tcp_state
pass in log on $ext_if inet proto udp from !($ext_if) to ($ext_if) port $dns_port $udp_state
pass in log on $ext_if inet proto tcp from !($ext_if) to ($ext_if) port $http_port $tcp_state (max-src-conn 500, max-src-conn-rate 30/10, overload <bruteforce> flush)
pass in log on $ext_if inet proto tcp from !($ext_if) to ($ext_if) port $https_port $tcp_state (max-src-conn 500, max-src-conn-rate 30/10, overload <bruteforce> flush)
pass in log on $ext_if inet proto tcp from !($ext_if) to ($ext_if) port $pop3_port $tcp_state (max-src-conn 200, max-src-conn-rate 30/10, overload <bruteforce> flush)
pass in log on $ext_if inet proto tcp from !($ext_if) to ($ext_if) port $ident_port $tcp_state
pass in log on $ext_if inet proto tcp from !($ext_if) to ($ext_if) port $imap_port $tcp_state (max-src-conn 200, max-src-conn-rate 30/10, overload <bruteforce> flush)
pass in log on $ext_if inet proto tcp from !($ext_if) to ($ext_if) port $smtp_submission_port $tcp_state (max-src-conn 200, max-src-conn-rate 30/10, overload <bruteforce> flush)
pass in log on $ext_if inet proto tcp from !($ext_if) to ($ext_if) port $imaps_port $tcp_state (max-src-conn 200, max-src-conn-rate 30/10, overload <bruteforce> flush)
pass in log on $ext_if inet proto tcp from !($ext_if) to ($ext_if) port $pop3s_port $tcp_state (max-src-conn 200, max-src-conn-rate 30/10, overload <bruteforce> flush)
pass in log on $ext_if inet proto tcp from !($ext_if) to ($ext_if) port $ftp_port
pass out quick
pass in quick on $int_if inet proto tcp to any port ftp divert-to 127.0.0.1 port 8021
pass quick on $vpn_if
Thanks
