Hello wise openVPN oracle 😉
I have following setup:
+-------------------------+ <- Static route added
(public IP)| | 10.8.0.0/24 to 192.168.0.200
{INTERNET}=============={ Router |
| |
| LAN switch |
+------------+------------+
| (192.168.0.1)
| Rasperry PI
| +-----------------------+
| | |
| | OpenVPN | eth0: 192.168.0.200/24
+--------------{eth0 server | tun0: 10.8.0.1/24
| | |
| | {tun0} |
| +-----------------------+
|
+--------+-----------+
| |
| Other LAN clients |
| |
| 192.168.0.0/24 |
| (internal net) |
+--------------------+
Symptoms and facts:
o I can not ping any any adress from inet. Internally all 10.x and 192.x adresses works fine (routers does not block ping!)
o No internet browsing possible
o Internal routing works fine. E.g. I can SSH to any client in the 10.8.0.0/24 net
o I will NOT like to push any route to the router (192.168.0.1) since all traffic should go through the tunnel from the clients.
o Router (Netgear WND4000) has a static route 10.8.0.0/24 to 192.168.0.200
Setup in detail:
CLIENT
======
client config:
--------------
client
proto udp
dev tun
ca ca.crt
dh dh2048.pem
cert laptop.crt
key laptop.key
remote foo.bar.net 1194
cipher DES-CBC
verb 2
mute 20
keepalive 10 120
comp-lzo
persist-key
persist-tun
float
resolv-retry infinite
nobind
up laptop.up
down laptop.down
ifconfig:
---------
eth0 Link encap:Ethernet HWaddr 00:22:68:0d:b5:6c
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
Interrupt:20 Memory:fc200000-fc220000
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:2046 errors:0 dropped:0 overruns:0 frame:0
TX packets:2046 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:256778 (256.7 KB) TX bytes:256778 (256.7 KB)
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.6 P-t-P:10.8.0.5 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:112 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 B) TX bytes:7025 (7.0 KB)
wlan0 Link encap:Ethernet HWaddr 00:22:fa:d1:b9:cc
inet addr:192.168.0.20 Bcast:192.168.0.255 Mask:255.255.255.0
inet6 addr: fe80::222:faff:fed1:b9cc/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:21485 errors:0 dropped:0 overruns:0 frame:0
TX packets:39660 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:7487656 (7.4 MB) TX bytes:6311704 (6.3 MB)
IP_FORWARD is active
--------------------
cat /proc/sys/net/ipv4/ip_forward
1
route:
------
Kernel IP routing table
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 10.8.0.5 0.0.0.0 UG 0 0 0 tun0
10.8.0.0 10.8.0.5 255.255.255.0 UG 0 0 0 tun0
10.8.0.5 * 255.255.255.255 UH 0 0 0 tun0
HSI-KBW-149-172 192.168.0.1 255.255.255.255 UGH 0 0 0 wlan0
link-local * 255.255.0.0 U 1000 0 0 tun0
192.168.0.0 * 255.255.255.0 U 9 0 0 wlan0
Snippet syslog:
---------------
Jan 26 17:07:37 laptop nm-openvpn[4471]: UDPv4 link remote: [AF_INET]149.172.39.13:1194
Jan 26 17:07:38 laptop nm-openvpn[4471]: [server] Peer Connection Initiated with [AF_INET]149.172.39.13:1194
Jan 26 17:07:40 laptop nm-openvpn[4471]: Options error: route parameter netmask '255.255.255.0"' must be an IP address
Jan 26 17:07:40 laptop nm-openvpn[4471]: TUN/TAP device tun0 opened
Jan 26 17:07:40 laptop nm-openvpn[4471]: /usr/lib/NetworkManager/nm-openvpn-service-openvpn-helper tun0 1500 1542 10.8.0.6 10.8.0.5 init
Jan 26 17:07:40 laptop NetworkManager[901]: SCPlugin-Ifupdown: devices added (path: /sys/devices/virtual/net/tun0, iface: tun0)
Jan 26 17:07:40 laptop NetworkManager[901]: SCPlugin-Ifupdown: device added (path: /sys/devices/virtual/net/tun0, iface: tun0): no ifupdown configuration found.
Jan 26 17:07:40 laptop NetworkManager[901]: <warn> /sys/devices/virtual/net/tun0: couldn't determine device driver; ignoring...
Jan 26 17:07:40 laptop NetworkManager[901]: <info> VPN connection 'laptop' (IP4 Config Get) reply received from old-style plugin.
Jan 26 17:07:40 laptop NetworkManager[901]: <info> VPN Gateway: 149.172.39.13
Jan 26 17:07:40 laptop NetworkManager[901]: <info> Tunnel Device: tun0
Jan 26 17:07:40 laptop NetworkManager[901]: <info> IPv4 configuration:
Jan 26 17:07:40 laptop NetworkManager[901]: <info> Internal Gateway: 10.8.0.5
Jan 26 17:07:40 laptop NetworkManager[901]: <info> Internal Address: 10.8.0.6
Jan 26 17:07:40 laptop NetworkManager[901]: <info> Internal Prefix: 32
Jan 26 17:07:40 laptop NetworkManager[901]: <info> Internal Point-to-Point Address: 10.8.0.5
Jan 26 17:07:40 laptop NetworkManager[901]: <info> Maximum Segment Size (MSS): 0
Jan 26 17:07:40 laptop NetworkManager[901]: <info> Static Route: 10.8.0.0/24 Next Hop: 10.8.0.0
Jan 26 17:07:40 laptop NetworkManager[901]: <info> Forbid Default Route: no
Jan 26 17:07:40 laptop NetworkManager[901]: <info> DNS Domain: '(none)'
Jan 26 17:07:40 laptop NetworkManager[901]: <info> No IPv6 configuration
Jan 26 17:07:40 laptop nm-openvpn[4471]: Initialization Sequence Completed
Jan 26 17:07:41 laptop NetworkManager[901]: <info> VPN connection 'laptop' (IP Config Get) complete.
Jan 26 17:07:41 laptop NetworkManager[901]: <info> Policy set 'laptop' (tun0) as default for IPv4 routing and DNS.
Jan 26 17:07:41 laptop NetworkManager[901]: <info> VPN plugin state changed: started (4)
Nameresolution works:
----------------------
laptop openvpn # dig google.de
; <<>> DiG 9.8.1-P1 <<>> google.de
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14040
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;google.de. IN A
;; ANSWER SECTION:
google.de. 8 IN A 173.194.35.183
google.de. 8 IN A 173.194.35.184
google.de. 8 IN A 173.194.35.191
;; Query time: 12 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sat Jan 26 17:20:13 2013
;; MSG SIZE rcvd: 75
SERVER
======
server config:
--------------
port 1194
proto udp
dev tun0
ca keys/blacksheeps/ca.crt
cert keys/blacksheeps/server.crt
key keys/blacksheeps/server.key
dh keys/blacksheeps/dh2048.pem
server 10.8.0.0 255.255.255.0
crl-verify keys/blacksheeps/crl.pem
ifconfig-pool-persist servers/blacksheeps/logs/ipp.txt
cipher DES-CBC
user nobody
group nogroup
status servers/blacksheeps/logs/openvpn-status.log
log-append servers/blacksheeps/logs/openvpn.log
verb 2
mute 20
max-clients 100
management 127.0.0.1 8876
keepalive 10 120
client-config-dir /etc/openvpn/servers/blacksheeps/ccd
client-to-client
comp-lzo
persist-key
persist-tun
ccd-exclusive
up servers/blacksheeps/bin/blacksheeps.up
down servers/blacksheeps/bin/blacksheeps.down
push "redirect-gateway def1"
push "dhcp-option DNS 10.8.0.1"
script-security 2 system
ifconfig:
---------
eth0 Link encap:Ethernet Hardware Adresse b8:27:eb:df:d5:ce
inet Adresse:192.168.0.200 Bcast:192.168.0.255 Maske:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metrik:1
RX packets:2038987 errors:0 dropped:0 overruns:0 frame:0
TX packets:1068175 errors:0 dropped:0 overruns:0 carrier:0
Kollisionen:0 Sendewarteschlangenlänge:1000
RX bytes:2367308543 (2.2 GiB) TX bytes:394003170 (375.7 MiB)
lo Link encap:Lokale Schleife
inet Adresse:127.0.0.1 Maske:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metrik:1
RX packets:91362 errors:0 dropped:0 overruns:0 frame:0
TX packets:91362 errors:0 dropped:0 overruns:0 carrier:0
Kollisionen:0 Sendewarteschlangenlänge:0
RX bytes:65950465 (62.8 MiB) TX bytes:65950465 (62.8 MiB)
tun0 Link encap:UNSPEC Hardware Adresse 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet Adresse:10.8.0.1 P-z-P:10.8.0.1 Maske:255.255.255.0
UP PUNKTZUPUNKT RUNNING NOARP MULTICAST MTU:1500 Metrik:1
RX packets:137 errors:0 dropped:0 overruns:0 frame:0
TX packets:132 errors:0 dropped:0 overruns:0 carrier:0
Kollisionen:0 Sendewarteschlangenlänge:100
RX bytes:10636 (10.3 KiB) TX bytes:14646 (14.3 KiB)
IP_FORWARD is active
--------------------
cat /proc/sys/net/ipv4/ip_forward
1
route:
------
Kernel-IP-Routentabelle
Ziel Router Genmask Flags Metric Ref Use Iface
default 192.168.0.1 0.0.0.0 UG 0 0 0 eth0
10.8.0.0 * 255.255.255.0 U 0 0 0 tun0
192.168.0.0 * 255.255.255.0 U 0 0 0 eth0
Snippet syslog:
---------------
Feb 10 11:41:17 raspi ifplugd(tun0)[32217]: ifplugd 0.28 initializing.
Feb 10 11:41:17 raspi ifplugd(tun0)[32217]: Using interface tun0/00:00:00:00:00:00 with driver <tun> (version: 1.6)
Feb 10 11:41:17 raspi ifplugd(tun0)[32217]: Using detection mode: SIOCETHTOOL
Feb 10 11:41:17 raspi ifplugd(tun0)[32217]: Initialization complete, link beat detected.
Feb 10 11:41:17 raspi ifplugd(tun0)[32217]: Executing '/etc/ifplugd/ifplugd.action tun0 up'.
Feb 10 11:41:17 raspi ifplugd(tun0)[32217]: client: Ignoring unknown interface tun0=tun0.
Feb 10 11:41:17 raspi ifplugd(tun0)[32217]: Program executed successfully.
Feb 10 11:41:18 raspi ntpd[2504]: Listen normally on 8 tun0 10.8.0.1 UDP 123
Feb 10 11:41:18 raspi ntpd[2504]: peers refreshed
Nameresolution works:
----------------------
raspi:/etc/openvpn# dig google.de
; <<>> DiG 9.8.4-P1 <<>> google.de
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22041
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;google.de. IN A
;; ANSWER SECTION:
google.de. 136 IN A 173.194.44.31
google.de. 136 IN A 173.194.44.23
google.de. 136 IN A 173.194.44.24
;; Query time: 11 msec
;; SERVER: 192.168.0.1#53(192.168.0.1)
;; WHEN: Sun Feb 10 12:50:36 2013
;; MSG SIZE rcvd: 75
iptables should work (interesting parts bold):
iptables-save
# Generated by iptables-save v1.4.14 on Sun Feb 10 13:05:08 2013
*nat
:PREROUTING ACCEPT [82:5884]
:INPUT ACCEPT [42:2612]
:OUTPUT ACCEPT [1:51]
:POSTROUTING ACCEPT [1:51]
[b]-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE[/b]
COMMIT
# Completed on Sun Feb 10 13:05:08 2013
# Generated by iptables-save v1.4.14 on Sun Feb 10 13:05:08 2013
*mangle
:PREROUTING ACCEPT [2174316:2443274903]
:INPUT ACCEPT [2125577:2419006950]
:FORWARD ACCEPT [48707:24263929]
:OUTPUT ACCEPT [1164058:456053332]
:POSTROUTING ACCEPT [1209187:480655277]
COMMIT
# Completed on Sun Feb 10 13:05:08 2013
# Generated by iptables-save v1.4.14 on Sun Feb 10 13:05:08 2013
*filter
:INPUT DROP [1726:460877]
:FORWARD DROP [0:0]
:OUTPUT DROP [32:2432]
:fail2ban-pam-generic - [0:0]
:fail2ban-pure-ftpd - [0:0]
:fail2ban-ssh - [0:0]
:fail2ban-ssh-ddos - [0:0]
-A INPUT -p tcp -m multiport --dports 21,20,990,989 -j fail2ban-pure-ftpd
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh-ddos
-A INPUT -p tcp -j fail2ban-pam-generic
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 67 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 137 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 138 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 139 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8080 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 10000 -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -p udp -m udp --dport 80 -j ACCEPT
-A INPUT -p udp -m udp --dport 137 -j ACCEPT
-A INPUT -p udp -m udp --dport 138 -j ACCEPT
-A INPUT -p udp -m udp --dport 139 -j ACCEPT
-A INPUT -p udp -m udp --dport 7878 -j ACCEPT
-A INPUT -p udp -m udp --dport 1194 -j ACCEPT
-A INPUT -p udp -m udp --dport 8080 -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j DROP
[b]-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.8.0.0/24 -i tun0 -o eth0 -m conntrack --ctstate NEW -j ACCEPT[/b]
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 67 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 137 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 138 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 139 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 8080 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 10000 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 67 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 80 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 137 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 138 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 139 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 1194 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 8080 -j ACCEPT
-A fail2ban-pam-generic -j RETURN
-A fail2ban-pure-ftpd -j RETURN
-A fail2ban-ssh -j RETURN
-A fail2ban-ssh-ddos -j RETURN
COMMIT
# Completed on Sun Feb 10 13:05:08 2013
tcpdump on openvpn server shows only dns requests:
tcpdump -n -i eth0 udp port 1194
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
13:06:28.396778 IP 149.172.39.13.46867 > 192.168.0.200.1194: UDP, length 53
13:06:33.526977 IP 192.168.0.200.1194 > 149.172.39.13.46867: UDP, length 53
13:06:36.541513 IP 149.172.39.13.46867 > 192.168.0.200.1194: UDP, length 93
13:06:36.543090 IP 192.168.0.200.1194 > 149.172.39.13.46867: UDP, length 125
13:06:36.567600 IP 149.172.39.13.46867 > 192.168.0.200.1194: UDP, length 93
13:06:36.569179 IP 192.168.0.200.1194 > 149.172.39.13.46867: UDP, length 125
13:06:36.575682 IP 149.172.39.13.46867 > 192.168.0.200.1194: UDP, length 101
13:06:36.577313 IP 192.168.0.200.1194 > 149.172.39.13.46867: UDP, length 125
13:06:36.582872 IP 149.172.39.13.46867 > 192.168.0.200.1194: UDP, length 101
13:06:36.584779 IP 192.168.0.200.1194 > 149.172.39.13.46867: UDP, length 125
13:06:36.599596 IP 149.172.39.13.46867 > 192.168.0.200.1194: UDP, length 101
13:06:36.599865 IP 149.172.39.13.46867 > 192.168.0.200.1194: UDP, length 93
13:06:36.601937 IP 192.168.0.200.1194 > 149.172.39.13.46867: UDP, length 133
13:06:36.602488 IP 192.168.0.200.1194 > 149.172.39.13.46867: UDP, length 125
13:06:36.603959 IP 149.172.39.13.46867 > 192.168.0.200.1194: UDP, length 93
13:06:36.611275 IP 149.172.39.13.46867 > 192.168.0.200.1194: UDP, length 101
13:06:41.546267 IP 149.172.39.13.46867 > 192.168.0.200.1194: UDP, length 93
13:06:41.548898 IP 192.168.0.200.1194 > 149.172.39.13.46867: UDP, length 125
13:06:41.572640 IP 149.172.39.13.46867 > 192.168.0.200.1194: UDP, length 93
13:06:41.574131 IP 192.168.0.200.1194 > 149.172.39.13.46867: UDP, length 125
13:06:41.580893 IP 149.172.39.13.46867 > 192.168.0.200.1194: UDP, length 101
I am out of any ideas.... Any helpful hint would be appreciated!
Regards,
Michael
