can't ping from server to clients

jianjunliu

I set up an openvpn-server on an openvz and centos 5 vps, and configured openvpn-clients on other similar vps and home ubuntu 12.04. Everything seems fine. I can even connect between the clients over the openvpn. But I cannot ping from the server to any of the clients. Any help much appreciated.

The following is the configuration of one of my openvpn servers:

[root@server3 openvpn]# grep -vE '^#|^;|^$' server.conf
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-to-client
duplicate-cn
keepalive 10 120
tls-auth ta.key 0 # This file is secret
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 3
[root@server3 openvpn]# 
[root@server3 openvpn]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     udp  --  anywhere             anywhere            udp dpt:openvpn 
ACCEPT     icmp --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     all  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     all  --  10.8.0.0/24          anywhere            
ACCEPT     all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
[root@server3 openvpn]# 
[root@server3 openvpn]# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.8.0.2        *               255.255.255.255 UH    0      0        0 tun0
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
169.254.0.0     *               255.255.0.0     U     0      0        0 venet0
default         *               0.0.0.0         U     0      0        0 venet0
[root@server3 openvpn]# 
[root@server3 openvpn]# ifconfig
lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:46 errors:0 dropped:0 overruns:0 frame:0
          TX packets:46 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:4254 (4.1 KiB)  TX bytes:4254 (4.1 KiB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:52 errors:0 dropped:0 overruns:0 frame:0
          TX packets:91 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:6427 (6.2 KiB)  TX bytes:9221 (9.0 KiB)

venet0    Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:127.0.0.1  P-t-P:127.0.0.1  Bcast:0.0.0.0  Mask:255.255.255.255
          UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1
          RX packets:291148 errors:0 dropped:0 overruns:0 frame:0
          TX packets:242556 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:190067758 (181.2 MiB)  TX bytes:97632347 (93.1 MiB)

venet0:0  Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:173.254.244.199  P-t-P:173.254.244.199  Bcast:173.254.244.199  Mask:255.255.255.255
          UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1

[root@server3 openvpn]#

The following is the configuration of one of the clients of the above openvpn-server:

[root@server5 openvpn]# grep -vE '^#|^;|^$' 173.254.244.199.conf
client
dev tun
proto udp
remote 173.254.244.199 1194
route 10.8.0.0 255.255.255.0
resolv-retry infinite
nobind
persist-key
persist-tun
ca 173.254.244.199/ca.crt
cert 173.254.244.199/client1.crt
key 173.254.244.199/client1.key
ns-cert-type server
tls-auth 173.254.244.199/ta.key 1
comp-lzo
verb 3
[root@server5 openvpn]# 
[root@server5 openvpn]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     udp  --  anywhere             anywhere            udp dpt:openvpn 
ACCEPT     icmp --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     all  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     all  --  10.8.0.0/24          anywhere            
ACCEPT     all  --  10.9.0.0/24          anywhere            
ACCEPT     all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
[root@server5 openvpn]# 
[root@server5 openvpn]# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.9.0.5        *               255.255.255.255 UH    0      0        0 tun1
10.8.0.13       *               255.255.255.255 UH    0      0        0 tun0
10.8.0.0        10.8.0.13       255.255.255.0   UG    0      0        0 tun0
10.9.0.0        10.9.0.5        255.255.255.0   UG    0      0        0 tun1
link-local      *               255.255.0.0     U     1002   0        0 venet0
default         *               0.0.0.0         U     0      0        0 venet0
[root@server5 openvpn]# 
[root@server5 openvpn]# ifconfig
lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:2699 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2699 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:232550 (227.0 KiB)  TX bytes:232550 (227.0 KiB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.14  P-t-P:10.8.0.13  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:18 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:1662 (1.6 KiB)  TX bytes:336 (336.0 b)

tun1      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.9.0.6  P-t-P:10.9.0.5  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:5 errors:0 dropped:0 overruns:0 frame:0
          TX packets:5 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:420 (420.0 b)  TX bytes:420 (420.0 b)

venet0    Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:127.0.0.1  P-t-P:127.0.0.1  Bcast:0.0.0.0  Mask:255.255.255.255
          UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1
          RX packets:151647 errors:0 dropped:0 overruns:0 frame:0
          TX packets:155778 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:33762194 (32.1 MiB)  TX bytes:22045892 (21.0 MiB)

venet0:0  Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:198.23.250.119  P-t-P:198.23.250.119  Bcast:198.23.250.119  Mask:255.255.255.255
          UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1

[root@server5 openvpn]#

Now I can ping from the openvpn client to its server:

[root@server5 openvpn]# ping 10.8.0.1
PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.
64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=0.520 ms
64 bytes from 10.8.0.1: icmp_seq=2 ttl=64 time=0.411 ms
64 bytes from 10.8.0.1: icmp_seq=3 ttl=64 time=1.14 ms
64 bytes from 10.8.0.1: icmp_seq=4 ttl=64 time=0.561 ms
^C
--- 10.8.0.1 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3792ms
rtt min/avg/max/mdev = 0.411/0.658/1.140/0.283 ms
[root@server5 openvpn]#

And I can even ping other clients of the same openvpn server:

[root@server5 openvpn]# ping 10.9.0.14
PING 10.9.0.14 (10.9.0.14) 56(84) bytes of data.
64 bytes from 10.9.0.14: icmp_seq=1 ttl=64 time=241 ms
64 bytes from 10.9.0.14: icmp_seq=2 ttl=64 time=242 ms
64 bytes from 10.9.0.14: icmp_seq=3 ttl=64 time=241 ms
64 bytes from 10.9.0.14: icmp_seq=4 ttl=64 time=255 ms
64 bytes from 10.9.0.14: icmp_seq=5 ttl=64 time=241 ms
^C
--- 10.9.0.14 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4469ms
rtt min/avg/max/mdev = 241.661/244.780/255.892/5.591 ms
[root@server5 openvpn]#

But I canNOT ping from the openvpn server to any of its clients:

[root@server3 openvpn]# ping 10.8.0.14
PING 10.8.0.14 (10.8.0.14) 56(84) bytes of data.

--- 10.8.0.14 ping statistics ---
13 packets transmitted, 0 received, 100% packet loss, time 12000ms

[root@server3 openvpn]#

maikcat

if you use wireshak to capture traffic what do you see?

Michael.

jianjunliu

Thanks for replying. I am not familiar with Wireshark and have just installed it on my homes ubuntu which has openvpn clients installed.
When I am pinging an openvpn-server, I can see packets out from tun0. When pinging from the openvpn-server to this client on the ubuntu, there was NO packets coming onto tun0 but there ARE some UDP packets coming from the vps server(173.254.244.199) to the local interface eth0 and ppp0.

maikcat

can you post the output of

iptables -L -t nat -v

on your openvpn server

Michael.

jianjunliu

Thanks Michael. I don't quite understand but have done it.

[root@server3 openvpn]# iptables -L -t nat -v
Chain PREROUTING (policy ACCEPT 9450 packets, 675K bytes)
pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 9237 packets, 609K bytes)
pkts bytes target prot opt in out source destination
523 37923 SNAT all -- any any 10.8.0.0/24 anywhere to:173.254.244.199
0 0 SNAT all -- any any 10.8.0.0/24 anywhere to:173.254.244.199
0 0 SNAT all -- any any 10.8.0.0/24 anywhere to:173.254.244.199
0 0 SNAT all -- any any 10.8.0.0/24 anywhere to:173.254.244.199
0 0 SNAT all -- any any 10.8.0.0/24 anywhere to:173.254.244.199
0 0 SNAT all -- any any 10.8.0.0/24 anywhere to:173.254.244.199
0 0 SNAT all -- any any 10.8.0.0/24 anywhere to:173.254.244.199
0 0 SNAT all -- any any 10.8.0.0/24 anywhere to:173.254.244.199
0 0 SNAT all -- any any 10.8.0.0/24 anywhere to:173.254.244.199
5029 274K SNAT all -- any venet0 anywhere anywhere to:173.254.244.199
0 0 SNAT all -- any any 10.8.0.0/24 anywhere to:173.254.244.199

Chain OUTPUT (policy ACCEPT 14601 packets, 908K bytes)
pkts bytes target prot opt in out source destination
[root@server3 openvpn]#

jianjunliu

Hi Michael,
Finally I have got it right. It's about iptables -t nat on my vps.
Thanks very much.