How do I route back from server to client ?

ilium007

Hi - I have been running OpenVPN for years and have never tried to do this. I have a tunnel (tun) set up and can route from client ot server fine and I can access all clients on subnet behind OpenVPN server (running on Asus router RT-N66U). Tonight I wanted to rsync some files from a client on the server end of my tunnel back to the client machine (Mac OSX running Viscosity). I can not work out how to add the necessary routes (and possibly firewall rules on the server end) to get that traffic back to my client. I have drawn a quick diagram showing what I want to achieve:

My config on the router (server) is:

# Automatically generated configuration
daemon
server 10.12.0.0 255.255.255.0
proto udp
port 1194
dev tun21
cipher AES-256-CBC
comp-lzo adaptive
keepalive 15 60
verb 3
push "route 192.168.12.0 255.255.255.0"
tls-auth static.key 0
ca ca.crt
dh dh.pem
cert server.crt
key server.key
status-version 2
status status

and on my client:

remote myserver.dyndns.org 1194 udp
persist-key
tls-client
ns-cert-type server
tls-auth ta.key 1
pull
ca ca.crt
dev tun
persist-tun
cert cert.crt
comp-lzo adaptive
nobind
key key.key
route 1.1.1.0 255.255.255.0 vpn_gateway default
cipher AES-256-CBC

This is the relevant NVRAM contents on the OpenVPN server (Asus RT-N66U):

admin@(none):/tmp/home/root# nvram show | grep vpn_server1
size: 41470 bytes (24066 left)
vpn_server1_nm=255.255.255.0
vpn_server1_local=10.8.0.1
vpn_server1_hmac=0
vpn_server1_rgw=0
vpn_server1_poll=0
vpn_server1_reneg=-1
vpn_server1_r1=192.168.1.50
vpn_server1_r2=192.168.1.55
vpn_server1_pdns=0
vpn_server1_if=tun
vpn_server1_custom=route 192.168.10.0 255.255.255.0 10.12.0.1
vpn_server1_remote=10.8.0.2
vpn_server1_comp=adaptive
vpn_server1_ccd_val=
vpn_server1_firewall=auto
vpn_server1_ccd=0
vpn_server1_sn=10.12.0.0
vpn_server1_c2c=0
vpn_server1_plan=1
vpn_server1_crypt=tls
vpn_server1_ccd_excl=0
vpn_server1_proto=udp
vpn_server1_dhcp=1
vpn_server1_cipher=AES-256-CBC
vpn_server1_port=1194
admin@(none):/tmp/home/root#

Any help would be appreciated.

maikcat

in order lan-to-lan scenario to work you must:

1) specify a ccd file for your client containing an iroute statement with your clients network

f.e iroute 192.168.1.0 255.255.255.0

2) add a route command to your server config with your clients network

f.e route 192.168.1.0 255.255.255.0

3) enable ip forwarding on client

Michael.

ilium007

I did read about the ccd files in the OpenVPN book but my server runs on an Asus router and I have no file system to include a file on.

ilium007

So I managed to get a ccd file on a mounted partition on the router and the server seems to have picked up the config next time I connected:

Jan  3 23:30:22 openvpn[1286]: 123.243.221.86:51866 [ilium007] Peer Connection Initiated with 1.1.1.1:51866
Jan  3 23:30:22 openvpn[1286]: ilium007/123.243.221.86:51866 OPTIONS IMPORT: reading client specific options from: /jffs/openvpn/clients/ilium007
Jan  3 23:30:22 openvpn[1286]: ilium007/123.243.221.86:51866 MULTI: Learn: 10.12.0.6 -> ilium007/1.1.1.1:51866
Jan  3 23:30:22 openvpn[1286]: ilium007/123.243.221.86:51866 MULTI: primary virtual IP for ilium007/1.1.1.1:51866: 10.12.0.6
Jan  3 23:30:22 openvpn[1286]: ilium007/123.243.221.86:51866 MULTI: internal route 192.168.10.0/24 -> ilium007/1.1.1.1:51866
Jan  3 23:30:22 openvpn[1286]: ilium007/123.243.221.86:51866 MULTI: Learn: 192.168.10.0/24 -> ilium007/1.1.1.1:51866
Jan  3 23:30:24 openvpn[1286]: ilium007/123.243.221.86:51866 PUSH: Received control message: 'PUSH_REQUEST'
Jan  3 23:30:24 openvpn[1286]: ilium007/123.243.221.86:51866 SENT CONTROL [ilium007]: 'PUSH_REPLY,route 192.168.12.0 255.255.255.0,route 10.12.0.1,topology net30,ping 15,ping-restart 60,ifconfig 10.12.0.6 10.12.0.5' (status=1)
Jan  3 23:30:25 openvpn[1286]: ilium007/123.243.221.86:51866 MULTI: Learn: 192.168.10.100 -> ilium007/1.1.1.1:51866
Jan  3 23:30:32 openvpn[1286]: ilium007/123.243.221.86:51866 Replay-window backtrack occurred [1]

but I still cannot ping the client machine from a host on the server side of the network.

ilium007

So this is on the router:

admin@(none):/tmp/home/root# netstat -nr
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
202.7.204.42    0.0.0.0         255.255.255.255 UH        0 0          0 ppp0
10.12.0.2       0.0.0.0         255.255.255.255 UH        0 0          0 tun21
10.12.0.0       10.12.0.2       255.255.255.0   UG        0 0          0 tun21
1.1.1.0         0.0.0.0         255.255.255.0   U         0 0          0 eth0
192.168.12.0    0.0.0.0         255.255.255.0   U         0 0          0 br0
192.168.10.0    10.12.0.2       255.255.255.0   UG        0 0          0 tun21
127.0.0.0       0.0.0.0         255.0.0.0       U         0 0          0 lo
0.0.0.0         202.7.204.42    0.0.0.0         UG        0 0          0 ppp0
admin@(none):/tmp/home/root# ping 192.168.10.100
PING 192.168.10.100 (192.168.10.100): 56 data bytes
* * *

Routing table shows a route to the 192.168.10.0 network (where my client is) but I cant ping 192.168.10.100 (the actual OpenVPN client IP).

I think its strange that I can't ping this device from the remote server.

Is there a way of working out if it is iptables dropping the connection on the router (OpenVPN server) side ?

This is the iptables output on the OpenVPN server:

admin@(none):/tmp/home/root# iptables -L -n -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 1044 96404 ACCEPT     all  --  tun21  *       0.0.0.0/0            0.0.0.0/0           
 1473  231K ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:1194 
    2   141 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           state INVALID 
  509 31427 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
    4   447 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           state NEW 
  541 35303 ACCEPT     all  --  br0    *       0.0.0.0/0            0.0.0.0/0           state NEW 
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp spt:67 dpt:68 
   16  3935 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT 28 packets, 4400 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  346 18703 ACCEPT     all  --  tun21  *       0.0.0.0/0            0.0.0.0/0           
   26  1616 TCPMSS     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x17/0x02 TCPMSS clamp to PMTU 
  990  707K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
    0     0 DROP       all  --  !br0   ppp0    0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           state INVALID 
    0     0 ACCEPT     all  --  br0    br0     0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       icmp --  ppp0   *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           ctstate DNAT 

Chain OUTPUT (policy ACCEPT 3479 packets, 2324K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FUPNP (0 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain PControls (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain logaccept (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW LOG flags 7 level 4 prefix `ACCEPT ' 
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain logdrop (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW LOG flags 7 level 4 prefix `DROP' 
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           
admin@(none):/tmp/home/root#

And this shows a traceroute from the OpenVPN client (192.168.10.100) to the host I am trying to come back the other way on (192.168.12.101):

macbookair:~ ilium007$ traceroute -n 192.168.12.101
traceroute to 192.168.12.101 (192.168.12.101), 64 hops max, 52 byte packets
 1  10.12.0.1  48.708 ms  50.359 ms  49.527 ms
 2  192.168.12.101  49.118 ms  47.522 ms  48.084 ms
macbookair:~ ilium007$

And this is the failed traceroute back to the initiating OpenVPN client (192.168.10.100):

traceroute to 192.168.10.100 (192.168.10.100), 3 hops max, 52 byte packets
 1  192.168.12.1  0.958 ms  0.618 ms  0.624 ms
 2  * * *
 3  * * *
iMacQLD:Dropbox lynelle$

ilium007

:mrgreen: Progress !!!!

I enabled ip forwarding on the OSX client:

macbookair:~ ilium007$ sudo sysctl -w net.inet.ip.forwarding=1
net.inet.ip.forwarding: 0 -> 1
macbookair:~ ilium007$

As soon as I did this I could see ping responses from the OpenVPN server (remote end gateway/router):

admin@(none):/tmp/home/root# ping 192.168.10.100
PING 192.168.10.100 (192.168.10.100): 56 data bytes
64 bytes from 192.168.10.100: seq=7 ttl=64 time=66.219 ms
64 bytes from 192.168.10.100: seq=8 ttl=64 time=62.325 ms
64 bytes from 192.168.10.100: seq=9 ttl=64 time=60.293 ms
64 bytes from 192.168.10.100: seq=10 ttl=64 time=60.832 ms

--- 192.168.10.100 ping statistics ---
11 packets transmitted, 4 packets received, 63% packet loss
round-trip min/avg/max = 60.293/62.417/66.219 ms

But from the client on the server end (192.168.12.100) I still cant ping the OpenVPN client (192.168.10.100):

iMacQLD:~ ilium007$ ping 192.168.10.1
PING 192.168.10.1 (192.168.10.1): 56 data bytes
^C
--- 192.168.10.1 ping statistics ---
1 packets transmitted, 0 packets received, 100.0% packet loss

The routing table on the remote machine (192.168.12.100):

iMacQLD:~ ilium007$ netstat -nr
Routing tables

Internet:
Destination        Gateway            Flags        Refs      Use   Netif Expire
default            192.168.12.1       UGSc            3        0     en0
127                127.0.0.1          UCS             0        0     lo0
127.0.0.1          127.0.0.1          UH              1   523104     lo0
169.254            link#4             UCS             0        0     en0
192.168.10         192.168.12.1       UGSc            0        0     en0
192.168.12         link#4             UCS             3        0     en0
192.168.12.1       30:85:a9:6c:e9:20  UHLWIir         4       21     en0   1111
192.168.12.100     127.0.0.1          UHS             0        0     lo0
192.168.12.145     4c:b1:99:17:3e:45  UHLWIi          0       38     en0   1177
192.168.12.186     78:a3:e4:e4:83:9e  UHLWIi          0       38     en0   1115

the routing table on the remote OpenVPN server / gateway:

admin@(none):/tmp/home/root# netstat -nr
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
202.7.204.32    0.0.0.0         255.255.255.255 UH        0 0          0 ppp0
10.12.12.2      0.0.0.0         255.255.255.255 UH        0 0          0 tun21
10.12.12.0      10.12.12.2      255.255.255.0   UG        0 0          0 tun21
1.1.1.0         0.0.0.0         255.255.255.0   U         0 0          0 eth0
192.168.12.0    0.0.0.0         255.255.255.0   U         0 0          0 br0
192.168.10.0    10.12.12.2      255.255.255.0   UG        0 0          0 tun21
127.0.0.0       0.0.0.0         255.0.0.0       U         0 0          0 lo
0.0.0.0         202.7.204.32    0.0.0.0         UG        0 0          0 ppp0

and the routing table from the local OpenVPN client (192.168.10.100):

macbookair:~ ilium007$ netstat -nr
Routing tables

Internet:
Destination        Gateway            Flags        Refs      Use   Netif Expire
default            192.168.10.1       UGSc          131        5     en2
1.1.1/24           10.12.12.5         UGSc            0        0    tun0
10.12.12/24        10.12.12.5         UGSc            1        0    tun0
10.12.12.5         10.12.12.6         UH              6        0    tun0
60.240.79.56/32    192.168.10.1       UGSc            1        0     en2
127                127.0.0.1          UCS             0        0     lo0
127.0.0.1          127.0.0.1          UH              7    25063     lo0
169.254            link#4             UCS             0        0     en2
192.168.10         link#4             UCS             4        0     en2
192.168.10.1       50:46:5d:6d:9:68   UHLWIir       134     1809     en2   1126
192.168.10.100     127.0.0.1          UHS             0        0     lo0
192.168.10.172     cc:8:e0:3e:b:b9    UHLWIi          0      114     en2    427
192.168.10.200     0:15:17:3d:52:d2   UHLWIi          0        1     en2    198
192.168.10.255     ff:ff:ff:ff:ff:ff  UHLWbI          0        3     en2
192.168.12         10.12.12.5         UGSc            2        6    tun0

Does anyone have any more ideas ?

maikcat

post your server config & ccd contents...

Michael.

ilium007

Server config:

admin@(none):/tmp/home/root# cat /tmp/etc/openvpn/server1/config.ovpn 
# Automatically generated configuration
daemon
server 10.12.12.0 255.255.255.0
proto udp
port 1194
dev tun21
cipher AES-256-CBC
comp-lzo adaptive
keepalive 15 60
verb 3
push "route 192.168.12.0 255.255.255.0"
tls-auth static.key 0
ca ca.crt
dh dh.pem
cert server.crt
key server.key
status-version 2
status status

# Custom Configuration
client-config-dir /jffs/openvpn/clients
route 192.168.10.0 255.255.255.0
client-to-client
verb 3
admin@(none):/tmp/home/root#

Custom config file (the 1.1.1.0 route is for an ADSL modem on the other end and works fine):

admin@(none):/tmp/home/root# cat /jffs/openvpn/clients/ilium007 
push "route 192.168.12.0 255.255.255.0"
push "route 1.1.1.0 255.255.255.0"
iroute 192.168.10.0 255.255.255.0
admin@(none):/tmp/home/root#

Client conf:

macbookair:~ ilium007$ cat ~/Desktop/lynelle.visc/config.conf 
#-- Config Auto Generated By Viscosity --#

#viscosity startonopen false
#viscosity dhcp true
#viscosity dnssupport false
#viscosity name lynelle
#viscosity ipv6 false
remote xxx.dyndns.org 1194 udp
persist-key
tls-client
ns-cert-type server
tls-auth ta.key 1
pull
ca ca.crt
dev tun
persist-tun
cert cert.crt
comp-lzo adaptive
nobind
key key.key
verb 3
cipher AES-256-CBC
macbookair:~ ilium007$

maikcat

some things to check:

instead of ping user tracert to verify routing,
check firewall rules (incoming traffic) on pcs you want to access,

also to ensure that your ccd file is used assing a static ip to your client using

ifconfig-push 10.12.12.18 10.12.12.17

this will give 10.12.12.18 to your cilent,
if your client doesnt get .18 then your ccd is not parsed...

Michael.

ilium007

Cool - I will check. I know that the ccd is being parsed as that is where I have some of my routing config. I have tried the static IP but will try again. There is no firewall running on the machine I am trying to ping as I have tested this separately.

ilium007

So I have tested and the ccd is definitely being parsed:

Client side log:

Jan 06 10:04:56: MANAGEMENT: >STATE:1357430696,ASSIGN_IP,,10.12.12.18,
Jan 06 10:04:56: /sbin/ifconfig tun0 delete
Jan 06 10:04:56: NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
Jan 06 10:04:56: /sbin/ifconfig tun0 10.12.12.18 10.12.12.17 mtu 1500 netmask 255.255.255.255 up
Jan 06 10:04:56: MANAGEMENT: >STATE:1357430696,ADD_ROUTES,,,
Jan 06 10:04:56: /sbin/route add -net 192.168.12.0 10.12.12.17 255.255.255.0
Jan 06 10:04:56: /sbin/route add -net 10.12.12.0 10.12.12.17 255.255.255.0
Jan 06 10:04:56: /sbin/route add -net 192.168.12.0 10.12.12.17 255.255.255.0
Jan 06 10:04:56: /sbin/route add -net 1.1.1.0 10.12.12.17 255.255.255.0
Jan 06 10:04:56: Initialization Sequence Completed

Server side log:

Jan  6 10:04:53 openvpn[731]: OPTIONS IMPORT: reading client specific options from: /jffs/openvpn/clients/ilium007
Jan  6 10:04:53 openvpn[731]: MULTI: Learn: 10.12.12.18 -> ilium007/123.243.221.86:59730
Jan  6 10:04:53 openvpn[731]: MULTI: primary virtual IP for ilium007/123.243.221.86:59730: 10.12.12.18
Jan  6 10:04:53 openvpn[731]: MULTI: internal route 192.168.10.0/24 -> ilium007/123.243.221.86:59730
Jan  6 10:04:53 openvpn[731]: MULTI: Learn: 192.168.10.0/24 -> ilium007/123.243.221.86:59730

And I can ping the OpenVPN client from the OpenVPN server:

ASUSWRT RT-N66U_3.0.0.4 Sun Dec 16 01:33:41 UTC 2012
admin@(none):/tmp/home/root# ping 192.168.10.100
PING 192.168.10.100 (192.168.10.100): 56 data bytes
64 bytes from 192.168.10.100: seq=0 ttl=64 time=71.225 ms
64 bytes from 192.168.10.100: seq=1 ttl=64 time=60.623 ms

--- 192.168.10.100 ping statistics ---
3 packets transmitted, 2 packets received, 33% packet loss
round-trip min/avg/max = 60.623/65.924/71.225 ms

admin@(none):/tmp/home/root# ping 10.12.12.18
PING 10.12.12.18 (10.12.12.18): 56 data bytes
64 bytes from 10.12.12.18: seq=0 ttl=64 time=62.824 ms
64 bytes from 10.12.12.18: seq=1 ttl=64 time=61.872 ms

--- 10.12.12.18 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 61.872/62.348/62.824 ms

But not from the server side client machine:

iMacQLD:~ ilium007$ ping 192.168.10.100
PING 192.168.10.100 (192.168.10.100): 56 data bytes
^C
--- 192.168.10.100 ping statistics ---
1 packets transmitted, 0 packets received, 100.0% packet loss
iMacQLD:~ ilium007$ ping 10.12.12.18
PING 10.12.12.18 (10.12.12.18): 56 data bytes
^C
--- 10.12.12.18 ping statistics ---
1 packets transmitted, 0 packets received, 100.0% packet loss
iMacQLD:~ ilium007$

maikcat

can you please write each hosts lan ip/hostname because i am lost here... :geek:

also use traceroute instead of ping to verify your routing scheme...

Michael.

ilium007

Sure..... VPN established form client software on HOST1 to Router/OpenVPN Server

OpenVPN Client         Router     Internet     Router/OpenVPN Server         HOST2
   HOST1
192.168.10.100----192.168.10.1 ---------------->>>192.168.12.1            192.168.12.100

Trying to ping from HOST2 to HOST1:
OpenVPN Client         Router      Internet      Router/OpenVPN Server         HOST2
       HOST1
192.168.10.100<<===192.168.10.1 ===================192.168.12.1==========192.168.12.100

Does make it a bit clearer ?

maikcat

can you also for the record mention which one is :
f.e imacqld,macbookair,ASUSWRT RT-N66U_3.0.0.4

i also noticed your comment:

But not from the server side client machine:
Code:
iMacQLD:~ ilium007$ ping 192.168.10.100
PING 192.168.10.100 (192.168.10.100): 56 data bytes
^C
--- 192.168.10.100 ping statistics ---
1 packets transmitted, 0 packets received, 100.0% packet loss
iMacQLD:~ ilium007$ ping 10.12.12.18
PING 10.12.12.18 (10.12.12.18): 56 data bytes
^C
--- 10.12.12.18 ping statistics ---
1 packets transmitted, 0 packets received, 100.0% packet loss
iMacQLD:~ ilium007$

can you ping from imacqld 10.12.12.1?

can you post the output of

iptables -L -t nat -v on both openvpn server/client?

Michael.

ilium007

Sure - and thanks for taking the time to help me out.. the clients are both OSX and we have ipfw (not iptables like linux) but I can list these rules just the same.

OpenVPN Client         Router           Internet     Router/OpenVPN Server         HOST2
   macbookair        ASUS RT-N66U                       ASUS RT-N66U               iMacQld
192.168.10.100-------192.168.10.1 --------------------->>>192.168.12.1            192.168.12.100

Trying to ping from HOST2 to HOST1:
OpenVPN Client         Router           Internet     Router/OpenVPN Server         HOST2
   macbookair        ASUS RT-N66U                       ASUS RT-N66U               iMacQld
192.168.10.100<<===192.168.10.1 =======================192.168.12.1==========192.168.12.100

Ping 10.12.12.1 from iMacQLD (192.168.12.100):

iMacQLD:~ ilium007$ ping 10.12.12.1
PING 10.12.12.1 (10.12.12.1): 56 data bytes
^C
--- 10.12.12.1 ping statistics ---
1 packets transmitted, 0 packets received, 100.0% packet loss

List firewall rules on iMacQLD (192.168.12.100) - there are none:

iMacQLD:~ ilium007$ sudo ipfw list
Password:
65535 allow ip from any to any
iMacQLD:~ ilium007$

List firewall rules on OpenVPN client (macbookair - 192.168.10.100):

macbookair:~ ilium007$ sudo ipfw list
Password:
65535 allow ip from any to any
macbookair:~ ilium007$

List firewall rules from server (Asus RT-N66U 192.168.10.1):

macbookair:~ brantwinter$ ssh admin@192.168.10.1
admin@192.168.10.1's password: 


ASUSWRT RT-N66U_3.0.0.4 Sun Dec 16 01:33:41 UTC 2012
admin@(none):/tmp/home/root# iptables -L -n -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  tun21  *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:1194 
   65  3816 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           state INVALID 
 1371  180K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
   23  4821 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           state NEW 
 1992  218K ACCEPT     all  --  br0    *       0.0.0.0/0            0.0.0.0/0           state NEW 
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp spt:67 dpt:68 
  732  284K DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT 1463 packets, 99539 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  tun21  *       0.0.0.0/0            0.0.0.0/0           
 1041 66540 TCPMSS     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x17/0x02 TCPMSS clamp to PMTU 
44708   19M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
    0     0 DROP       all  --  !br0   ppp0    0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       all  --  !br0   eth0    0.0.0.0/0            0.0.0.0/0           
  642 34518 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           state INVALID 
    0     0 ACCEPT     all  --  br0    br0     0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       icmp --  ppp0   *       0.0.0.0/0            0.0.0.0/0           
    5   240 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           ctstate DNAT 

Chain OUTPUT (policy ACCEPT 4048 packets, 859K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FUPNP (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.10.187      tcp dpt:4242 

Chain PControls (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain logaccept (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW LOG flags 7 level 4 prefix `ACCEPT ' 
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain logdrop (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW LOG flags 7 level 4 prefix `DROP' 
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           
admin@(none):/tmp/home/root#

And interfaces on the OpenVPN server (Asus RT-N66U 192.168.10.1):

tun21      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
           inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
           UP POINTOPOINT RUNNING NOARP PROMISC MULTICAST  MTU:1500  Metric:1
           RX packets:0 errors:0 dropped:0 overruns:0 frame:0
           TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:100 
           RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

br0        Link encap:Ethernet  HWaddr 50:46:5D:6D:09:68  
           inet addr:192.168.10.1  Bcast:192.168.10.255  Mask:255.255.255.0
           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
           RX packets:29233 errors:0 dropped:0 overruns:0 frame:0
           TX packets:27713 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:0 
           RX bytes:5410836 (5.1 MiB)  TX bytes:16699261 (15.9 MiB)

maikcat

hang on mate...

tun21 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP PROMISC MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

br0 Link encap:Ethernet HWaddr 50:46:5D:6D:09:68
inet addr:192.168.10.1 Bcast:192.168.10.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:29233 errors:0 dropped:0 overruns:0 frame:0
TX packets:27713 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:5410836 (5.1 MiB) TX bytes:16699261 (15.9 MiB)

your openvpn interface uses 10.8.0.0/24 subnet....????

in your server config (previous posted)

admin@(none):/tmp/home/root# cat /tmp/etc/openvpn/server1/config.ovpn
# Automatically generated configuration
daemon
server 10.12.12.0 255.255.255.0
proto udp
port 1194
dev tun21
cipher AES-256-CBC
comp-lzo adaptive
keepalive 15 60
verb 3
push "route 192.168.12.0 255.255.255.0"
tls-auth static.key 0
ca ca.crt
dh dh.pem
cert server.crt
key server.key
status-version 2
status status

server directive uses 10.12.12.0/24 network??????

which one is correct????

the above is on 10.1 ,which means that doesnt effect your setup.? (test openvpn maybe?)

anyway, your 12.x client SHOULD ping 10.12.12.1 (this is the tun interface on 192.168.12.1 router correct?)
if it cant,there is routing problem to 192.168.12.0 side.... OR something blocking traffic to/from
this network (software running on mac maybe?)

Michael.

Michael

ilium007

Sorry - I should have stated that I changed the routed TUN subnet - I thought it would be implied in the latest details, but yes. I changed the tun subnet to 10.12.12.0 to make it align with the OpenVPN server network of 192.168.12.0.

I will confirm that the 192.168.12.100 machine can't ping the OpenVPN server tun interface of 10.12.12.1 later tonight.

There is nothing on either mac that should stop things, no firewall, no software that would block. Routing tables on both 192.168.10.100 and 192.168.12.100 are correct.

ilium007

So I draw a diagram like all good techies should in times of confusion :lol:

So that should clarify the IP's, and what can and cant be pinged.

The route table on Client 1 (the one I can't ping Client 2 from) is:

iMacQLD:~ lynellewinter$ netstat -nr
Routing tables

Internet:
Destination        Gateway            Flags        Refs      Use   Netif Expire
default            192.168.12.1       UGSc            3        0     en0
127                127.0.0.1          UCS             0        0     lo0
127.0.0.1          127.0.0.1          UH              1    29425     lo0
169.254            link#4             UCS             0        0     en0
192.168.12         link#4             UCS             2        0     en0
192.168.12.1       30:85:a9:6c:e9:20  UHLWIir         4       14     en0   1195
192.168.12.100     127.0.0.1          UHS             0        0     lo0
192.168.12.255     ff:ff:ff:ff:ff:ff  UHLWbI          0       23     en0

The routing table on Router1 (the OpenVPN server) is:

admin@(none):/tmp/home/root# netstat -nr
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
202.7.179.120   0.0.0.0         255.255.255.255 UH        0 0          0 ppp0
10.12.12.2      0.0.0.0         255.255.255.255 UH        0 0          0 tun21
10.12.12.0      10.12.12.2      255.255.255.0   UG        0 0          0 tun21
1.1.1.0         0.0.0.0         255.255.255.0   U         0 0          0 eth0
192.168.12.0    0.0.0.0         255.255.255.0   U         0 0          0 br0
192.168.10.0    10.12.12.2      255.255.255.0   UG        0 0          0 tun21
127.0.0.0       0.0.0.0         255.0.0.0       U         0 0          0 lo
0.0.0.0         202.7.179.120   0.0.0.0         UG        0 0          0 ppp0

The route table in Router 2:

admin@(none):/tmp/home/root# netstat -nr
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
10.8.0.2        0.0.0.0         255.255.255.255 UH        0 0          0 tun21
202.7.179.113   0.0.0.0         255.255.255.255 UH        0 0          0 ppp0
10.8.0.0        10.8.0.2        255.255.255.0   UG        0 0          0 tun21
1.1.1.0         0.0.0.0         255.255.255.0   U         0 0          0 eth0
192.168.10.0    0.0.0.0         255.255.255.0   U         0 0          0 br0
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 eth0
127.0.0.0       0.0.0.0         255.0.0.0       U         0 0          0 lo
0.0.0.0         202.7.179.113   0.0.0.0         UG        0 0          0 ppp0
admin@(none):/tmp/home/root#

The route table on Client 2:

macbookair:~ ilium007$ netstat -nr
Routing tables

Internet:
Destination        Gateway            Flags        Refs      Use   Netif Expire
default            192.168.10.1       UGSc            9        2     en0
default            192.168.10.1       UGScI           0        0     en2
1.1.1/24           10.12.12.17        UGSc            0        0    tun0
10.12.12/24        10.12.12.17        UGSc            0        1    tun0
10.12.12.17        10.12.12.18        UH              5        2    tun0
60.240.79.56/32    192.168.10.1       UGSc            1        5     en2
127                127.0.0.1          UCS             0        0     lo0
127.0.0.1          127.0.0.1          UH              9   413344     lo0
169.254            link#5             UCS             0        0     en0
192.168.10         link#5             UCS             5        0     en0
192.168.10         link#4             UCSI            2        0     en2
192.168.10.1       50:46:5d:6d:9:68   UHLWIi          2        4     en2   1137
192.168.10.1       50:46:5d:6d:9:68   UHLWIir        11     2109     en0   1196
192.168.10.100     127.0.0.1          UHS             0        2     lo0
192.168.10.172     cc:8:e0:3e:b:b9    UHLWIi          0      115     en0    920
192.168.10.187     127.0.0.1          UHS             0       12     lo0
192.168.10.200     0:15:17:3d:52:d2   UHLWIi          2     5010     en0    613
192.168.10.202     4:1e:64:99:f3:d7   UHLWIi          0        0     en2    260
192.168.10.202     4:1e:64:99:f3:d7   UHLWIi          0        0     en0    196
192.168.10.255     ff:ff:ff:ff:ff:ff  UHLWbI          0       10     en0
192.168.12         10.12.12.17        UGSc            2        0    tun0

From Router 1 I can ping Client 2:

admin@(none):/tmp/home/root# ping 192.168.12.100
PING 192.168.12.100 (192.168.12.100): 56 data bytes
64 bytes from 192.168.12.100: seq=0 ttl=64 time=1.069 ms
64 bytes from 192.168.12.100: seq=1 ttl=64 time=0.339 ms
64 bytes from 192.168.12.100: seq=2 ttl=64 time=0.339 ms
64 bytes from 192.168.12.100: seq=3 ttl=64 time=0.383 ms

--- 192.168.12.100 ping statistics ---
4 packets transmitted, 4 packets received, 0% packet loss
round-trip min/avg/max = 0.339/0.532/1.069 ms

admin@(none):/tmp/home/root#

but from Client 1 I cannot ping Client 2:

PING 192.168.10.100 (192.168.10.100): 56 data bytes
^C
--- 192.168.10.100 ping statistics ---
1 packets transmitted, 0 packets received, 100.0% packet loss
iMacQLD:~ lynellewinter$

From Router 2 I can ping Client 2 (so ping is not blocked on the Mac):

admin@(none):/tmp/home/root# ping 192.168.10.100
PING 192.168.10.100 (192.168.10.100): 56 data bytes
64 bytes from 192.168.10.100: seq=0 ttl=64 time=0.824 ms
64 bytes from 192.168.10.100: seq=1 ttl=64 time=0.650 ms
64 bytes from 192.168.10.100: seq=2 ttl=64 time=0.490 ms
64 bytes from 192.168.10.100: seq=3 ttl=64 time=0.553 ms

--- 192.168.10.100 ping statistics ---
4 packets transmitted, 4 packets received, 0% packet loss
round-trip min/avg/max = 0.490/0.629/0.824 ms

admin@(none):/tmp/home/root#

And obviously I can ping Client 1 from Client 2 (thats how I am ssh'ing to it to get these stats):

macbookair:~ ilium007$ ping 192.168.12.100
PING 192.168.12.100 (192.168.12.100): 56 data bytes
64 bytes from 192.168.12.100: icmp_seq=0 ttl=63 time=61.752 ms
64 bytes from 192.168.12.100: icmp_seq=1 ttl=63 time=62.053 ms
64 bytes from 192.168.12.100: icmp_seq=2 ttl=63 time=65.750 ms
64 bytes from 192.168.12.100: icmp_seq=3 ttl=63 time=63.571 ms
^C
--- 192.168.12.100 ping statistics ---
4 packets transmitted, 4 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 61.752/63.282/65.750/1.583 ms
macbookair:~ ilium007$

**EDIT** Just noticed the 10.8.0.2 in the Router 2 route table - that is for the OpenVPN Server (related to VPNing into my network (192.168.10.0/24) but unrelated to this issues I think)

ilium007

And Client 1 cannot ping 10.12.12.1:

iMacQLD:~ lynellewinter$ ping 10.12.12.1
PING 10.12.12.1 (10.12.12.1): 56 data bytes
^C
--- 10.12.12.1 ping statistics ---
1 packets transmitted, 0 packets received, 100.0% packet loss
iMacQLD:~ lynellewinter$

and Client 1 cannot ping 10.12.12.18:

iMacQLD:~ ilium007$ ping 10.12.12.18
PING 10.12.12.18 (10.12.12.18): 56 data bytes
^C
--- 10.12.12.18 ping statistics ---
1 packets transmitted, 0 packets received, 100.0% packet loss
iMacQLD:~ ilium007$

But Client 2 can ping 10.12.12.1:

macbookair:~ ilium007$ ping 10.12.12.1
PING 10.12.12.1 (10.12.12.1): 56 data bytes
64 bytes from 10.12.12.1: icmp_seq=0 ttl=64 time=67.183 ms
64 bytes from 10.12.12.1: icmp_seq=1 ttl=64 time=65.641 ms
^C
--- 10.12.12.1 ping statistics ---
2 packets transmitted, 2 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 65.641/66.412/67.183/0.771 ms
macbookair:~ ilium007$

and Client 2 can ping 10.12.12.18:

macbookair:~ ilium007$ ping 10.12.12.1
PING 10.12.12.1 (10.12.12.1): 56 data bytes
64 bytes from 10.12.12.1: icmp_seq=0 ttl=64 time=62.716 ms
64 bytes from 10.12.12.1: icmp_seq=1 ttl=64 time=63.392 ms
64 bytes from 10.12.12.1: icmp_seq=2 ttl=64 time=63.271 ms
^C
--- 10.12.12.1 ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 62.716/63.126/63.392/0.294 ms
macbookair:~ ilium007$

And Router 1 can ping 10.12.12.1:

admin@(none):/tmp/home/root# ping 10.12.12.1
PING 10.12.12.1 (10.12.12.1): 56 data bytes
64 bytes from 10.12.12.1: seq=0 ttl=64 time=0.302 ms
64 bytes from 10.12.12.1: seq=1 ttl=64 time=0.247 ms
64 bytes from 10.12.12.1: seq=2 ttl=64 time=0.232 ms

--- 10.12.12.1 ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 0.232/0.260/0.302 ms

admin@(none):/tmp/home/root#

So does this mean the issue is somewhere between Client 1 and Router 1 ? If it is I just cant see it !

ilium007

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.