Hello!
I have a little problem with my openvpn.
I want to ping my gateway but i can't.
On my fist server (openvpn server) :
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet adr:10.8.0.1 P-t-P:10.8.0.2 Masque:255.255.255.255
My second server is well connected (openvpn client):
client.conf :
client
remote NAME_SERVER_OPENVPN 1194
dev tun
proto udp
resolv-retry infinite
nobind
user nobody
group nobody
persist-key
persist-tun
ca ca-cert.pem
cert client-franck-cert.pem
key client-franck-key.pem
ns-cert-type server
comp-lzo
verb 3
auth-user-pass
Wed Oct 17 11:08:54 2012 WARNING: using --pull/--client and --ifconfig together is probably not what you want
Wed Oct 17 11:08:54 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Oct 17 11:08:54 2012 WARNING: file 'client-franck-key.pem' is group or others accessible
Wed Oct 17 11:08:54 2012 LZO compression initialized
Wed Oct 17 11:08:54 2012 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Oct 17 11:08:55 2012 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Oct 17 11:08:55 2012 Local Options hash (VER=V4): '41690919'
Wed Oct 17 11:08:55 2012 Expected Remote Options hash (VER=V4): '530fdded'
Wed Oct 17 11:08:55 2012 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Wed Oct 17 11:08:55 2012 Socket Buffers: R=[112640->131072] S=[112640->131072]
Wed Oct 17 11:08:55 2012 UDPv4 link local: [undef]
Wed Oct 17 11:08:55 2012 UDPv4 link remote: @IP_PUB_SERVER_OPENVPN:1194
Wed Oct 17 11:08:55 2012 TLS: Initial packet from @IP_PUB_SERVER_OPENVPN:1194, sid=dbb22264 a5fbff65
Wed Oct 17 11:08:55 2012 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Wed Oct 17 11:08:55 2012 VERIFY OK: nsCertType=SERVER
Wed Oct 17 11:08:55 2012 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Oct 17 11:08:55 2012 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Oct 17 11:08:55 2012 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Oct 17 11:08:55 2012 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Oct 17 11:08:55 2012 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Oct 17 11:08:55 2012 [server-openvpn] Peer Connection Initiated with @IP_PUB_SERVER_OPENVPN:1194
Wed Oct 17 11:08:58 2012 SENT CONTROL [server-name-openvpn]: 'PUSH_REQUEST' (status=1)
Wed Oct 17 11:08:58 2012 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 8.8.8.8,dhcp-option WINS @IP_PUB_SERVER_OPENVPN,dhcp-option DOMAIN domain-name-server-openvpn,route @IP_PUB_SERVER_OPENVPN 255.255.255.255,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Wed Oct 17 11:08:58 2012 OPTIONS IMPORT: timers and/or timeouts modified
Wed Oct 17 11:08:58 2012 OPTIONS IMPORT: --ifconfig/up options modified
Wed Oct 17 11:08:58 2012 OPTIONS IMPORT: route options modified
Wed Oct 17 11:08:58 2012 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Oct 17 11:08:58 2012 ROUTE default_gateway=@IP__PUB2_GW
Wed Oct 17 11:08:58 2012 TUN/TAP device tun0 opened
Wed Oct 17 11:08:58 2012 TUN/TAP TX queue length set to 100
Wed Oct 17 11:08:58 2012 /sbin/ip link set dev tun0 up mtu 1500
Wed Oct 17 11:08:58 2012 /sbin/ip addr add dev tun0 local 10.8.0.6 peer 10.8.0.5
Wed Oct 17 11:08:58 2012 /sbin/ip route add @IP_PUB_SERVER_OPENVPN/32 via 10.8.0.5
Wed Oct 17 11:08:58 2012 /sbin/ip route add 10.8.0.1/32 via 10.8.0.5
Wed Oct 17 11:08:58 2012 GID set to nobody
Wed Oct 17 11:08:58 2012 UID set to nobody
Wed Oct 17 11:08:58 2012 Initialization Sequence Completed
and i have this tun0 :
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet adr:10.8.0.6 P-t-P:10.8.0.5 Masque:255.255.255.255
On my client, I try to ping 10.8.0.5 but no response...
I try also 10.8.0.1 but no response...
Ping 10.8.0.6 is good...
I tried this iptables rules :
iptables -A INPUT -i tun0 -j ACCEPT
iptables -A FORWARD -i tun0 -j ACCEPT
iptables -A FORWARD -o tun0 -j ACCEPT
iptables -A OUTPUT -o tun0 -j ACCEPT
When I try to ping 10.8.0.5, I have these output with a tcpdump :
# tcpdump -i eth1 | grep 10.8.0.5
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes
12:05:39.195852 IP @IP_PUB > 10.8.0.5: ICMP echo request, id 28693, seq 9, length 64
12:05:40.195810 IP @IP_PUB > 10.8.0.5: ICMP echo request, id 28693, seq 10, length 64
12:05:41.195783 IP @IP_PUB > 10.8.0.5: ICMP echo request, id 28693, seq 11, length 64
# tcpdump -i tun0 : NOTHING
# tcpdump -i eth2 : NOTHING
this is my routes :
#/sbin/ip route
10.8.0.5 dev tun0 proto kernel scope link src 10.8.0.6
10.8.0.1 via 10.8.0.5 dev tun0
@IP_PUB_OPENVPN_SERVER via 10.8.0.5 dev tun0
192.168.1.0/24 dev eth1 proto kernel scope link src 192.168.1.11 (I have an other @IP_PUB in front of this network)
10.9.9.0/24 dev eth0 proto kernel scope link src 10.9.9.254
default via @IP_PUB2 dev eth2
Destination Passerelle Genmask Indic Metric Ref Use Iface
10.8.0.5 * 255.255.255.255 UH 0 0 0 tun0
10.8.0.1 10.8.0.5 255.255.255.255 UGH 0 0 0 tun0
NAME_OPENVPN_SERVER 10.8.0.5 255.255.255.255 UGH 0 0 0 tun0
192.168.1.0 * 255.255.255.0 U 0 0 0 eth1 (In front of this network, an other @IP_PUB)
NETWORK_@IP_PUB2 * 255.255.255.0 U 0 0 0 eth2
10.9.9.0 * 255.255.255.0 U 0 0 0 eth0
default @IP_PUB2 0.0.0.0 UG 0 0 0 eth2
Do you have any ideas to have this ping working well?
I think it's my firewall but I'm not sure.
I don't know what rule I have to put in iptables to have this ping...
In my Initialization sequence, i'm confused about this line :
Wed Oct 17 11:08:58 2012 ROUTE default_gateway=@IP__PUB2_GW
because all my ping packets are going throw eth1 and this is the GW of my @IP of eth2
how can i do to throw all packets for openvpn by tun0 or eth2?
Thanks for your replies
