acr
I´m looking and working for Days on this problem. I hope someone can help me here.
What I want: [/ b]
Start from my work PC a OVPN session to my server in order to access the Internet. Yes, I use tap without a bridge. Iff possibel i wat to route.
b] What is already working: [/ b]
Establishing a VPN connection, and when I adjust the routes, I can ping my Internet router. Ping to my computers in LAN does allso. I can reach all the computers within my LAN
What does not work: [/ b]
Ping from the client to the Internet (eg 8.8.8.8) will not go over VPN.
-------------------------------------------
So now my settings: [/ b]
VPN Server CentOS5 with openvpn-2.2.2-1.el5.rf
LAN IP of the server: 192.168.20.10/24 (eth0)
IP Gateway: 192.168.20.1/24
IP VPN server 10.0.0.1/24 (tap0)
net.ipv4.ip_forward=1
vpn Server config:
#------------------------------------------------------
port 5001
proto tcp-server
mode server
tls-server
dev tap0
ping-timer-rem
keepalive 20 180
persist-key
persist-tun
verb 4
mute 20
ifconfig 10.0.0.1 255.255.255.0
ifconfig-pool 10.0.0.10 10.0.0.31
ifconfig-pool-persist ipp.txt
client-to-client
#tun-mtu 1492
mssfix
ca keys/creutz.net/ca.crt
cert keys/creutz.net/srv.vpn.creutz.net.crt
key keys/creutz.net/srv.vpn.creutz.net.key
dh keys/creutz.net/dh2048.pem
crl-verify keys/creutz.net/crl.pem
cipher DES-CBC
user ovpn
group ovpn
status servers/vpn.creutz.net/logs/openvpn-status.log
log-append servers/vpn.creutz.net/logs/openvpn.log
management 127.0.0.1 5010
max-clients 30
auth SHA1
client-config-dir /etc/openvpn/servers/vpn.creutz.net/ccd
comp-lzo
ccd-exclusive
duplicate-cn
push "redirect-gateway def1"
push "dhcp-option DNS 192.168.20.10"
route 192.168.20.0 255.255.255.0
push "route 192.168.20.0 255.255.255.0"
#---------------------------------------------------------------
ifconfig from Server (ovpn started)
eth0 Link encap:Ethernet Hardware Adresse 00:02:A5:9B:5C:35
inet Adresse:192.168.20.10 Bcast:192.168.20.255 Maske:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1492 Metric:1
RX packets:164809 errors:0 dropped:0 overruns:0 frame:0
TX packets:152940 errors:0 dropped:0 overruns:0 carrier:0
Kollisionen:0 Sendewarteschlangenlänge:1000
RX bytes:23832674 (22.7 MiB) TX bytes:81744056 (77.9 MiB)
lo Link encap:Lokale Schleife
inet Adresse:127.0.0.1 Maske:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:1356 errors:0 dropped:0 overruns:0 frame:0
TX packets:1356 errors:0 dropped:0 overruns:0 carrier:0
Kollisionen:0 Sendewarteschlangenlänge:0
RX bytes:125246 (122.3 KiB) TX bytes:125246 (122.3 KiB)
tap0 Link encap:Ethernet Hardware Adresse 7E:C8:ED:9C:5A:0D
inet Adresse:10.0.0.1 Bcast:10.0.0.255 Maske:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:560 errors:0 dropped:0 overruns:0 frame:0
TX packets:374 errors:0 dropped:0 overruns:0 carrier:0
Kollisionen:0 Sendewarteschlangenlänge:100
RX bytes:69267 (67.6 KiB) TX bytes:66664 (65.1 KiB)
Routingtable from the Server, ovpn is started
route -nv
Kernel IP Routentabelle
Ziel Router Genmask Flags Metric Ref Use Iface
192.168.20.1 0.0.0.0 255.255.255.255 UH 0 0 0 eth0
192.168.20.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
10.0.0.0 0.0.0.0 255.255.255.0 U 0 0 0 tap0
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0
0.0.0.0 192.168.20.1 0.0.0.0 UG 0 0 0 eth0
====================================================
My client looks like:
the VPN Config:
#---------------------------------------------------------
client
auth-nocache
script-security 2
proto tcp-client
dev tap
ca ca.crt
dh dh2048.pem
cert jd.vpn.creutz.net.crt
key jd.vpn.creutz.net.key
remote my.server.dyndns.net 5000 # 🙂
cipher DES-CBC
user andre
group andre
verb 2
mute 20
#tun-mtu 1450
keepalive 10 120
comp-lzo
persist-key
#persist-tun
float
resolv-retry infinite
nobind
ifconfig fron the client (ovpn started)
eth0 Link encap:Ethernet Hardware Adresse 00:0c:29:77:03:50
inet Adresse:172.17.32.131 Bcast:172.17.32.255 Maske:255.255.255.0
inet6-Adresse: fe80::20c:29ff:fe77:350/64 Gültigkeitsbereich:Verbindung
UP BROADCAST RUNNING MULTICAST MTU:1500 Metrik:1
RX packets:94772 errors:4 dropped:7 overruns:0 frame:0
TX packets:6670 errors:0 dropped:0 overruns:0 carrier:0
Kollisionen:0 Sendewarteschlangenlänge:1000
RX-Bytes:21509334 (21.5 MB) TX-Bytes:1304500 (1.3 MB)
Interrupt:19 Basisadresse:0x2000
lo Link encap:Lokale Schleife
inet Adresse:127.0.0.1 Maske:255.0.0.0
inet6-Adresse: ::1/128 Gültigkeitsbereich:Maschine
UP LOOPBACK RUNNING MTU:16436 Metrik:1
RX packets:751 errors:0 dropped:0 overruns:0 frame:0
TX packets:751 errors:0 dropped:0 overruns:0 carrier:0
Kollisionen:0 Sendewarteschlangenlänge:0
RX-Bytes:72455 (72.4 KB) TX-Bytes:72455 (72.4 KB)
tap0 Link encap:Ethernet Hardware Adresse 06:5d:01:72:13:25
inet Adresse:10.0.0.10 Bcast:10.0.0.255 Maske:255.255.255.0
inet6-Adresse: fe80::45d:1ff:fe72:1325/64 Gültigkeitsbereich:Verbindung
UP BROADCAST RUNNING MULTICAST MTU:1500 Metrik:1
RX packets:220 errors:0 dropped:0 overruns:0 frame:0
TX packets:390 errors:0 dropped:0 overruns:0 carrier:0
Kollisionen:0 Sendewarteschlangenlänge:100
RX-Bytes:46037 (46.0 KB) TX-Bytes:41391 (41.3 KB)
The client routes without manual changes
route -nv
Kernel-IP-Routentabelle
Ziel Router Genmask Flags Metric Ref Use Iface
0.0.0.0 172.17.32.254 0.0.0.0 UG 100 0 0 eth0
10.0.0.0 0.0.0.0 255.255.255.0 U 0 0 0 tap0
169.254.0.0 0.0.0.0 255.255.0.0 U 1000 0 0 eth0
172.17.32.0 0.0.0.0 255.255.255.0 U 0 0 0 eth
ping from client to vpn server (ok):
ping 10.0.0.1
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_req=1 ttl=64 time=608 ms
64 bytes from 10.0.0.1: icmp_req=2 ttl=64 time=302 m
ping fron client to serverLAN (fail)
PING 192.168.20.10 (192.168.20.10) 56(84) bytes of data.
^C
--- 192.168.20.10 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2000ms
so I insert the route:
route add -net 192.168.20.0/24 gw 10.0.0.1
and ping works to 192.168.20.0/24
traceroute 192.168.20.1 #(from client)
traceroute to 192.168.20.1 (192.168.20.1), 30 hops max, 60 byte packets
1 10.0.0.1 (10.0.0.1) 304.678 ms 568.154 ms 568.187 ms
2 192.168.20.1 (192.168.20.1) 568.213 ms 568.232 ms 568.251 m
but ping to 8.8.8.8 does not work 🙁
traceroute 8.8.8.8
traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets
1 172.17.32.1 (172.17.32.1) 0.936 ms 1.271 ms 1.129 m
that shows there is no route to the internet via tap0. but if I change the dafault route to 192.168.20.1 the vpn connection collapses (is also logical)
From the server i can ping to
ping 10.0.0.10 (the VPN Client - ok)
traceroute 10.0.0.10
traceroute to 10.0.0.10 (10.0.0.10), 30 hops max, 40 byte packets
1 10.0.0.10 (10.0.0.10) 305.832 ms 307.788 ms 307.734 m
ping 192.168.20.1 (Internet GW - ok)
traceroute 192.168.20.1
traceroute to 192.168.20.1 (192.168.20.1), 30 hops max, 40 byte packets
1 router.creutz.net (192.168.20.1) 0.353 ms 0.357 ms 0.431 m
ping 8.8.8.8 (IP to Internet - ok)
traceroute 8.8.8.8
traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 40 byte packets
1 router.creutz.net (192.168.20.1) 0.389 ms 0.345 ms 0.397 ms
2 10.129.64.1 (10.129.64.1) 6.343 ms 10.921 ms 9.254 ms
3 7113A-MX960-02-ae10-2210.dar.unity-media.net (81.210.130.61) 9.676 ms 9.626 ms 9.670 ms
4 7111A-MX960-01-ae3.fra.unity-media.net (80.69.107.118) 10.028 ms 10.125 ms 9.949 ms
5 72.14.213.197 (72.14.213.197) 10.049 ms 10.095 ms 9.811 ms
6 72.14.238.44 (72.14.238.44) 10.016 ms 10.005 ms 72.14.238.46 (72.14.238.46) 9.786 ms
7 72.14.239.60 (72.14.239.60) 10.080 ms 72.14.239.62 (72.14.239.62) 12.678 ms 72.14.236.68 (72.14.236.68) 8.739 ms
8 209.85.254.116 (209.85.254.116) 8.574 ms 209.85.254.118 (209.85.254.118) 7.401 ms 209.85.254.116 (209.85.254.116) 7.372 ms
9 google-public-dns-a.google.com (8.8.8.8) 14.015 ms 13.509 ms 13.553 m
Something like iptables or an other FW is not configured. Neither the server nor the client. But I've also been experimenting with this and entered the server:
iptables -t nat -A POSTROUTING -o eth0 -s 10.0.0.1/24 -j SNAT --to 192.168.20.1
No success. Oddly, looks after the iptables command like:
iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destinatio
all clear?? no rule?? hmmmm...
Then I wrote this script:
#---------------------------------------------------------
#! /bin/bash
# Allow traffic initiated from VPN to access LAN
iptables -I FORWARD -i tap0 -o eth0 \
-s 10.0.0.0/24 -d 192.168.20.0/24 \
-m conntrack --ctstate NEW -j ACCEPT
# Allow established traffic to pass back and forth
iptables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED \
-j ACCEPT
#------------------------------------------------------
allso no result, but entries at iptables -L:
L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT all -- 10.0.0.0/24 192.168.20.0/24 ctstate NEW
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
further i tested with:
/sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
/sbin/iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -A FORWARD -i eth1 -o eth0 -j ACCEP
but no internet at the client -that´s stupid...
In my opinion the client is missing the route to the Internet via 192.168.20.1. Or anything which was pushed to the routes and the iptables rules on the server does not. But how do I get it back?
I'm really grateful for any idea (auch gerne in deutsch)
Best regards
andre
