tun setup - ping/route problem

McDexter

Here is a (almost)working tun server config.

port xxxxx
proto tcp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key  # This file should be kept secret
dh /etc/openvpn/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.0.0 255.255.255.0"
;push "route 192.168.0.8 255.255.255.255"
;push "redirect-gateway"
push "dhcp-option DNS 192.168.0.2"
client-to-client
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 5

Remote client (default configuration) can connect and get an ip 10.8.0.6

The problem is that I can't ping to some internal machines but some I can ping and connect to.
On the other hand...I can ping remote client from internal LAN (I added route to 10.8.0.0/24 on gateway)
It is like:
ping from 10.8.0.6 to 192.168.0.2 -> OK
ping from 10.8.0.6 to 192.168.0.5 -> request timedout

ping from 192.168.0.2 to 10.8.0.6 -> OK
ping from 192.168.0.5 to 10.8.0.6 -> OK

It seems that I can ping client from any machine in LAN, but the client can ping only few machines in LAN. I try to ping Linux, Win2003 and Win 2008. It seems that this is not firewall related.

McDexter

Client setup:

client
dev tun
proto tcp
remote abcdefg portXXX
resolv-retry infinite
nobind
persist-key
persist-tun
ca "C:\\Program Files\\OpenVPN\\keys\\ca_r.crt"
cert "C:\\Program Files\\OpenVPN\\keys\\client_r.crt"
key "C:\\Program Files\\OpenVPN\\keys\\client_r.key"
ns-cert-type server
comp-lzo
verb 1

Route on VPN gateway:

# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.0.1     0.0.0.0         UG    0      0        0 eth0
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.8.0.2        *               255.255.255.255 UH    0      0        0 tun0
loopback        *               255.0.0.0       U     0      0        0 lo
link-local      *               255.255.0.0     U     0      0        0 eth0
192.168.0.0     *               255.255.255.0   U     0      0        0 eth0

It seems that I can ping from client the VPN gateway and the dns from push "dhcp-option" but nothing else 🙁
What am I doing wrong?

McDexter

iptables -vnL

# iptables -vnL
Chain INPUT (policy ACCEPT 12319 packets, 1524K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 5959 packets, 870K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 10506 packets, 1627K bytes)
 pkts bytes target     prot opt in     out     source               destination

Server logs verb 6
Ping from client to gateway or dns (working OK):

Feb 13 16:14:28 openvpn openvpn[2084]: client/xxx.xxx.xxx.xxx:pppp TUN WRITE [52]
Feb 13 16:14:28 openvpn openvpn[2084]: client/xxx.xxx.xxx.xxx:pppp TUN READ [52]
Feb 13 16:14:28 openvpn openvpn[2084]: client/xxx.xxx.xxx.xxx:pppp TCPv4_SERVER WRITE [93] to xxx.xxx.xxx.xxx:pppp: P_DATA_V1 kid=0 DATA len=92

I can see in logs that ping to any other machine is reaching gateway but there is no response

McDexter

I talked to myself 🙂

It starts to work after adding:

iptables -A INPUT -i tun+ -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

Regards 🙂

rkpoulin

I also have a similar problem.

Last night we upgraded from 1.2.3 to 2.0.2 and now, somes clients can't connect the shares drives anymore. They can ping some ip but thay can't ping the 3 servers to acces the shares drives. Any ideas why ?

Thanks, Ricky