Hi - I have been running OpenVPN for years and have never tried to do this. I have a tunnel (tun) set up and can route from client ot server fine and I can access all clients on subnet behind OpenVPN server (running on Asus router RT-N66U). Tonight I wanted to rsync some files from a client on the server end of my tunnel back to the client machine (Mac OSX running Viscosity). I can not work out how to add the necessary routes (and possibly firewall rules on the server end) to get that traffic back to my client. I have drawn a quick diagram showing what I want to achieve: [img]https://dl.dropbox.com/u/973862/forums/route.png[/img] My config on the router (server) is: [code] # Automatically generated configuration daemon server 10.12.0.0 255.255.255.0 proto udp port 1194 dev tun21 cipher AES-256-CBC comp-lzo adaptive keepalive 15 60 verb 3 push "route 192.168.12.0 255.255.255.0" tls-auth static.key 0 ca ca.crt dh dh.pem cert server.crt key server.key status-version 2 status status[/code] and on my client: [code]remote myserver.dyndns.org 1194 udp persist-key tls-client ns-cert-type server tls-auth ta.key 1 pull ca ca.crt dev tun persist-tun cert cert.crt comp-lzo adaptive nobind key key.key route 1.1.1.0 255.255.255.0 vpn_gateway default cipher AES-256-CBC[/code] This is the relevant NVRAM contents on the OpenVPN server (Asus RT-N66U): [code]admin@(none):/tmp/home/root# nvram show | grep vpn_server1 size: 41470 bytes (24066 left) vpn_server1_nm=255.255.255.0 vpn_server1_local=10.8.0.1 vpn_server1_hmac=0 vpn_server1_rgw=0 vpn_server1_poll=0 vpn_server1_reneg=-1 vpn_server1_r1=192.168.1.50 vpn_server1_r2=192.168.1.55 vpn_server1_pdns=0 vpn_server1_if=tun vpn_server1_custom=route 192.168.10.0 255.255.255.0 10.12.0.1 vpn_server1_remote=10.8.0.2 vpn_server1_comp=adaptive vpn_server1_ccd_val= vpn_server1_firewall=auto vpn_server1_ccd=0 vpn_server1_sn=10.12.0.0 vpn_server1_c2c=0 vpn_server1_plan=1 vpn_server1_crypt=tls vpn_server1_ccd_excl=0 vpn_server1_proto=udp vpn_server1_dhcp=1 vpn_server1_cipher=AES-256-CBC vpn_server1_port=1194 admin@(none):/tmp/home/root# [/code] Any help would be appreciated.

in order lan-to-lan scenario to work you must: 1) specify a ccd file for your client containing an iroute statement with your clients network f.e iroute 192.168.1.0 255.255.255.0 2) add a route command to your server config with your clients network f.e route 192.168.1.0 255.255.255.0 3) enable ip forwarding on client Michael.

I did read about the ccd files in the OpenVPN book but my server runs on an Asus router and I have no file system to include a file on.

So I managed to get a ccd file on a mounted partition on the router and the server seems to have picked up the config next time I connected: [code]Jan 3 23:30:22 openvpn[1286]: 123.243.221.86:51866 [ilium007] Peer Connection Initiated with 1.1.1.1:51866 Jan 3 23:30:22 openvpn[1286]: ilium007/123.243.221.86:51866 OPTIONS IMPORT: reading client specific options from: /jffs/openvpn/clients/ilium007 Jan 3 23:30:22 openvpn[1286]: ilium007/123.243.221.86:51866 MULTI: Learn: 10.12.0.6 -> ilium007/1.1.1.1:51866 Jan 3 23:30:22 openvpn[1286]: ilium007/123.243.221.86:51866 MULTI: primary virtual IP for ilium007/1.1.1.1:51866: 10.12.0.6 Jan 3 23:30:22 openvpn[1286]: ilium007/123.243.221.86:51866 MULTI: internal route 192.168.10.0/24 -> ilium007/1.1.1.1:51866 Jan 3 23:30:22 openvpn[1286]: ilium007/123.243.221.86:51866 MULTI: Learn: 192.168.10.0/24 -> ilium007/1.1.1.1:51866 Jan 3 23:30:24 openvpn[1286]: ilium007/123.243.221.86:51866 PUSH: Received control message: 'PUSH_REQUEST' Jan 3 23:30:24 openvpn[1286]: ilium007/123.243.221.86:51866 SENT CONTROL [ilium007]: 'PUSH_REPLY,route 192.168.12.0 255.255.255.0,route 10.12.0.1,topology net30,ping 15,ping-restart 60,ifconfig 10.12.0.6 10.12.0.5' (status=1) Jan 3 23:30:25 openvpn[1286]: ilium007/123.243.221.86:51866 MULTI: Learn: 192.168.10.100 -> ilium007/1.1.1.1:51866 Jan 3 23:30:32 openvpn[1286]: ilium007/123.243.221.86:51866 Replay-window backtrack occurred [1][/code] but I still cannot ping the client machine from a host on the server side of the network.

So this is on the router: [code]admin@(none):/tmp/home/root# netstat -nr Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 202.7.204.42 0.0.0.0 255.255.255.255 UH 0 0 0 ppp0 10.12.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun21 10.12.0.0 10.12.0.2 255.255.255.0 UG 0 0 0 tun21 1.1.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 192.168.12.0 0.0.0.0 255.255.255.0 U 0 0 0 br0 192.168.10.0 10.12.0.2 255.255.255.0 UG 0 0 0 tun21 127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo 0.0.0.0 202.7.204.42 0.0.0.0 UG 0 0 0 ppp0 admin@(none):/tmp/home/root# ping 192.168.10.100 PING 192.168.10.100 (192.168.10.100): 56 data bytes * * * [/code] Routing table shows a route to the 192.168.10.0 network (where my client is) but I cant ping 192.168.10.100 (the actual OpenVPN client IP). I think its strange that I can't ping this device from the remote server. Is there a way of working out if it is iptables dropping the connection on the router (OpenVPN server) side ? This is the iptables output on the OpenVPN server: [code]admin@(none):/tmp/home/root# iptables -L -n -v Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 1044 96404 ACCEPT all -- tun21 * 0.0.0.0/0 0.0.0.0/0 1473 231K ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1194 2 141 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID 509 31427 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 4 447 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 state NEW 541 35303 ACCEPT all -- br0 * 0.0.0.0/0 0.0.0.0/0 state NEW 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:67 dpt:68 16 3935 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy ACCEPT 28 packets, 4400 bytes) pkts bytes target prot opt in out source destination 346 18703 ACCEPT all -- tun21 * 0.0.0.0/0 0.0.0.0/0 26 1616 TCPMSS tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x17/0x02 TCPMSS clamp to PMTU 990 707K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 0 0 DROP all -- !br0 ppp0 0.0.0.0/0 0.0.0.0/0 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID 0 0 ACCEPT all -- br0 br0 0.0.0.0/0 0.0.0.0/0 0 0 DROP icmp -- ppp0 * 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate DNAT Chain OUTPUT (policy ACCEPT 3479 packets, 2324K bytes) pkts bytes target prot opt in out source destination Chain FUPNP (0 references) pkts bytes target prot opt in out source destination Chain PControls (0 references) pkts bytes target prot opt in out source destination 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 Chain logaccept (0 references) pkts bytes target prot opt in out source destination 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW LOG flags 7 level 4 prefix `ACCEPT ' 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 Chain logdrop (0 references) pkts bytes target prot opt in out source destination 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW LOG flags 7 level 4 prefix `DROP' 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 admin@(none):/tmp/home/root# [/code] And this shows a traceroute from the OpenVPN client (192.168.10.100) to the host I am trying to come back the other way on (192.168.12.101): [code]macbookair:~ ilium007$ traceroute -n 192.168.12.101 traceroute to 192.168.12.101 (192.168.12.101), 64 hops max, 52 byte packets 1 10.12.0.1 48.708 ms 50.359 ms 49.527 ms 2 192.168.12.101 49.118 ms 47.522 ms 48.084 ms macbookair:~ ilium007$ [/code] And this is the failed traceroute back to the initiating OpenVPN client (192.168.10.100): [code]traceroute to 192.168.10.100 (192.168.10.100), 3 hops max, 52 byte packets 1 192.168.12.1 0.958 ms 0.618 ms 0.624 ms 2 * * * 3 * * * iMacQLD:Dropbox lynelle$ [/code]

:mrgreen: Progress !!!! I enabled ip forwarding on the OSX client: [code]macbookair:~ ilium007$ sudo sysctl -w net.inet.ip.forwarding=1 net.inet.ip.forwarding: 0 -> 1 macbookair:~ ilium007$ [/code] As soon as I did this I could see ping responses from the OpenVPN server (remote end gateway/router): [code]admin@(none):/tmp/home/root# ping 192.168.10.100 PING 192.168.10.100 (192.168.10.100): 56 data bytes 64 bytes from 192.168.10.100: seq=7 ttl=64 time=66.219 ms 64 bytes from 192.168.10.100: seq=8 ttl=64 time=62.325 ms 64 bytes from 192.168.10.100: seq=9 ttl=64 time=60.293 ms 64 bytes from 192.168.10.100: seq=10 ttl=64 time=60.832 ms --- 192.168.10.100 ping statistics --- 11 packets transmitted, 4 packets received, 63% packet loss round-trip min/avg/max = 60.293/62.417/66.219 ms[/code] But from the client on the server end (192.168.12.100) I still cant ping the OpenVPN client (192.168.10.100): [code]iMacQLD:~ ilium007$ ping 192.168.10.1 PING 192.168.10.1 (192.168.10.1): 56 data bytes ^C --- 192.168.10.1 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss[/code] The routing table on the remote machine (192.168.12.100): [code]iMacQLD:~ ilium007$ netstat -nr Routing tables Internet: Destination Gateway Flags Refs Use Netif Expire default 192.168.12.1 UGSc 3 0 en0 127 127.0.0.1 UCS 0 0 lo0 127.0.0.1 127.0.0.1 UH 1 523104 lo0 169.254 link#4 UCS 0 0 en0 192.168.10 192.168.12.1 UGSc 0 0 en0 192.168.12 link#4 UCS 3 0 en0 192.168.12.1 30:85:a9:6c:e9:20 UHLWIir 4 21 en0 1111 192.168.12.100 127.0.0.1 UHS 0 0 lo0 192.168.12.145 4c:b1:99:17:3e:45 UHLWIi 0 38 en0 1177 192.168.12.186 78:a3:e4:e4:83:9e UHLWIi 0 38 en0 1115[/code] the routing table on the remote OpenVPN server / gateway: [code]admin@(none):/tmp/home/root# netstat -nr Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 202.7.204.32 0.0.0.0 255.255.255.255 UH 0 0 0 ppp0 10.12.12.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun21 10.12.12.0 10.12.12.2 255.255.255.0 UG 0 0 0 tun21 1.1.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 192.168.12.0 0.0.0.0 255.255.255.0 U 0 0 0 br0 192.168.10.0 10.12.12.2 255.255.255.0 UG 0 0 0 tun21 127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo 0.0.0.0 202.7.204.32 0.0.0.0 UG 0 0 0 ppp0 [/code] and the routing table from the local OpenVPN client (192.168.10.100): [code]macbookair:~ ilium007$ netstat -nr Routing tables Internet: Destination Gateway Flags Refs Use Netif Expire default 192.168.10.1 UGSc 131 5 en2 1.1.1/24 10.12.12.5 UGSc 0 0 tun0 10.12.12/24 10.12.12.5 UGSc 1 0 tun0 10.12.12.5 10.12.12.6 UH 6 0 tun0 60.240.79.56/32 192.168.10.1 UGSc 1 0 en2 127 127.0.0.1 UCS 0 0 lo0 127.0.0.1 127.0.0.1 UH 7 25063 lo0 169.254 link#4 UCS 0 0 en2 192.168.10 link#4 UCS 4 0 en2 192.168.10.1 50:46:5d:6d:9:68 UHLWIir 134 1809 en2 1126 192.168.10.100 127.0.0.1 UHS 0 0 lo0 192.168.10.172 cc:8:e0:3e:b:b9 UHLWIi 0 114 en2 427 192.168.10.200 0:15:17:3d:52:d2 UHLWIi 0 1 en2 198 192.168.10.255 ff:ff:ff:ff:ff:ff UHLWbI 0 3 en2 192.168.12 10.12.12.5 UGSc 2 6 tun0[/code] Does anyone have any more ideas ?

post your server config & ccd contents... Michael.

Server config: [code]admin@(none):/tmp/home/root# cat /tmp/etc/openvpn/server1/config.ovpn # Automatically generated configuration daemon server 10.12.12.0 255.255.255.0 proto udp port 1194 dev tun21 cipher AES-256-CBC comp-lzo adaptive keepalive 15 60 verb 3 push "route 192.168.12.0 255.255.255.0" tls-auth static.key 0 ca ca.crt dh dh.pem cert server.crt key server.key status-version 2 status status # Custom Configuration client-config-dir /jffs/openvpn/clients route 192.168.10.0 255.255.255.0 client-to-client verb 3 admin@(none):/tmp/home/root# [/code] Custom config file (the 1.1.1.0 route is for an ADSL modem on the other end and works fine): [code]admin@(none):/tmp/home/root# cat /jffs/openvpn/clients/ilium007 push "route 192.168.12.0 255.255.255.0" push "route 1.1.1.0 255.255.255.0" iroute 192.168.10.0 255.255.255.0 admin@(none):/tmp/home/root# [/code] Client conf: [code]macbookair:~ ilium007$ cat ~/Desktop/lynelle.visc/config.conf #-- Config Auto Generated By Viscosity --# #viscosity startonopen false #viscosity dhcp true #viscosity dnssupport false #viscosity name lynelle #viscosity ipv6 false remote xxx.dyndns.org 1194 udp persist-key tls-client ns-cert-type server tls-auth ta.key 1 pull ca ca.crt dev tun persist-tun cert cert.crt comp-lzo adaptive nobind key key.key verb 3 cipher AES-256-CBC macbookair:~ ilium007$ [/code]

some things to check: instead of ping user tracert to verify routing, check firewall rules (incoming traffic) on pcs you want to access, also to ensure that your ccd file is used assing a static ip to your client using ifconfig-push 10.12.12.18 10.12.12.17 this will give 10.12.12.18 to your cilent, if your client doesnt get .18 then your ccd is not parsed... Michael.

Cool - I will check. I know that the ccd is being parsed as that is where I have some of my routing config. I have tried the static IP but will try again. There is no firewall running on the machine I am trying to ping as I have tested this separately.

So I have tested and the ccd is definitely being parsed: Client side log: [code]Jan 06 10:04:56: MANAGEMENT: >STATE:1357430696,ASSIGN_IP,,10.12.12.18, Jan 06 10:04:56: /sbin/ifconfig tun0 delete Jan 06 10:04:56: NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure Jan 06 10:04:56: /sbin/ifconfig tun0 10.12.12.18 10.12.12.17 mtu 1500 netmask 255.255.255.255 up Jan 06 10:04:56: MANAGEMENT: >STATE:1357430696,ADD_ROUTES,,, Jan 06 10:04:56: /sbin/route add -net 192.168.12.0 10.12.12.17 255.255.255.0 Jan 06 10:04:56: /sbin/route add -net 10.12.12.0 10.12.12.17 255.255.255.0 Jan 06 10:04:56: /sbin/route add -net 192.168.12.0 10.12.12.17 255.255.255.0 Jan 06 10:04:56: /sbin/route add -net 1.1.1.0 10.12.12.17 255.255.255.0 Jan 06 10:04:56: Initialization Sequence Completed[/code] Server side log: [code]Jan 6 10:04:53 openvpn[731]: OPTIONS IMPORT: reading client specific options from: /jffs/openvpn/clients/ilium007 Jan 6 10:04:53 openvpn[731]: MULTI: Learn: 10.12.12.18 -> ilium007/123.243.221.86:59730 Jan 6 10:04:53 openvpn[731]: MULTI: primary virtual IP for ilium007/123.243.221.86:59730: 10.12.12.18 Jan 6 10:04:53 openvpn[731]: MULTI: internal route 192.168.10.0/24 -> ilium007/123.243.221.86:59730 Jan 6 10:04:53 openvpn[731]: MULTI: Learn: 192.168.10.0/24 -> ilium007/123.243.221.86:59730[/code] And I can ping the OpenVPN client from the OpenVPN server: [code]ASUSWRT RT-N66U_3.0.0.4 Sun Dec 16 01:33:41 UTC 2012 admin@(none):/tmp/home/root# ping 192.168.10.100 PING 192.168.10.100 (192.168.10.100): 56 data bytes 64 bytes from 192.168.10.100: seq=0 ttl=64 time=71.225 ms 64 bytes from 192.168.10.100: seq=1 ttl=64 time=60.623 ms --- 192.168.10.100 ping statistics --- 3 packets transmitted, 2 packets received, 33% packet loss round-trip min/avg/max = 60.623/65.924/71.225 ms admin@(none):/tmp/home/root# ping 10.12.12.18 PING 10.12.12.18 (10.12.12.18): 56 data bytes 64 bytes from 10.12.12.18: seq=0 ttl=64 time=62.824 ms 64 bytes from 10.12.12.18: seq=1 ttl=64 time=61.872 ms --- 10.12.12.18 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max = 61.872/62.348/62.824 ms[/code] But not from the server side client machine: [code]iMacQLD:~ ilium007$ ping 192.168.10.100 PING 192.168.10.100 (192.168.10.100): 56 data bytes ^C --- 192.168.10.100 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss iMacQLD:~ ilium007$ ping 10.12.12.18 PING 10.12.12.18 (10.12.12.18): 56 data bytes ^C --- 10.12.12.18 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss iMacQLD:~ ilium007$ [/code]

How do I route back from server to client ?

nito

Hi

Have you found a working solution? Please post your working configs, I am having the same problem

Regards

ilium007

Hi - yes, I got everything working. I am happy to give you a hand. Pease post your OpenVPN config files for each end (client/server) and your routing tables for client and server (and any other machine you are trying to route traffic to).

maikcat

Guys please create a new topic... 8-)

i am locking this one...

Michael.

« Previous Page