OpenVPN setup - odd behaviour

wickwire

Hi,

I've been struggling for a while now, searched the forums but haven't actually found a solution for this:

I'm trying to set up a routed vpn, from the outside to my LAN - so I used this guide:

https://community.openvpn.net/openvpn/wiki/BridgingAndRouting

- My LAN is managed by a TL-WR2543ND gigabit router with stock firmware (192.168.55.1)
- In the LAN, I've set up an Ubuntu headless machine with openvpn server configuration
- The openvpn server has one NIC, registers a LAN IP = 192.168.55.103
- The openvpn server uses network 10.9.0.0 for the vpn, in the server.conf
- The openvpn server configuration has push "rule 192.168.55.0 255.255.255.0"
- The openvpn server has net.ipv4.ip_forward=1 set up
- The openvpn server has iptables rules set up as stated in the guide "different openvpn server than the LAN gateway"
- The TP-Link router has port forwarding configured for port 1198 to the openvpn server
- The TP-Link router has a static route added for a destination network 10.9.0.0 and a default gateway 192.168.55.103

- In the LAN, I also have a NAS box, an embedded cubieboard device, an iMac and a wireless printer

I then have another internet access to simulate the outside access, to which I have my client attached ( Linux Mint 14)
My objective is to be able to access the LAN machines through the VPN, as if I was inside the LAN.

At this point, I'm able to successfully connect to the openvpn server from the outside access

My client receives ip 10.9.0.2 and I can ping/ssh into the openvpn server either at 192.168.55.103 or 10.9.0.1
I am also able to ping/ssh from a LAN machine to my openvpn client: 192.168.55.102 > 10.9.0.2

Problem: I cannot access any other LAN element, from the client. Just the openvpn server.

However, while testing, I found one scenario which enables proper vpn traffic:

- I first access the openvpn server through ssh, from the client (using the LAN ip 192.168.55.103)
- from the openvpn server, I ssh into the NAS (192.168.55.102)
- from the NAS, I ssh back into the client, on the VPN ip (10.9.0.2)

Once I do the last step, I am able to connect to the NAS, port 80, from the client (10.9.0.2 > 192.168.55.102)

Checking incoming connections with netstat on the NAS, I found out that when doing that without the 3 steps above,
nestat on the NAS shows SYN_RECV connections but I can't open the NAS WebUI
Once I perform the 3 steps, and then attempt to connect directly from the client to the NAS, I get TIME_WAIT and ESTABLISHED connections
While I have at least TIME_WAIT connections hanging on the NAS, from the client, I'm always able to connect through the openvpn setup

Ok, I'm a bit unsure on what to do to fix this, below I'm posting my openvpn server/client configurations:

server:

mode server
tls-server

local 192.168.55.103 ## ip/hostname of server
port 1198 ## default openvpn port
proto udp

dev tun

persist-key
persist-tun

#certificates and encryption
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key  # This file should be kept secret
dh /etc/openvpn/dh1024.pem
tls-auth /etc/openvpn/ta.key 0 # This file is secret

cipher BF-CBC        # Blowfish (default)
comp-lzo

topology subnet
server 10.9.0.0 255.255.255.0
push "route 192.168.55.0 255.255.255.0"

#log and security
user nobody
group nogroup
keepalive 10 120
status openvpn-status.log
verb 3

script-security 3

client:

client
dev tun
remote <TP-Link WAN IP> 1198

ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/client.crt
key /etc/openvpn/keys/client.key
tls-auth /etc/openvpn/keys/ta.key 1

cipher BF-CBC

comp-lzo

verb 3

If anyone has any idea on why the ssh loopback issue makes it work and more importantly, how to fix it, please let me know - I'd really like to have things working, but haven't got a clue on what is wrong here...

Thanks in advance!

maikcat

hi there,

The openvpn server has iptables rules set up as stated in the guide "different openvpn server than the LAN gateway"

it would be VERY helpfull if you simply post the output of

iptables -L -v
iptables -L -t nat -v

I then have another internet access to simulate the outside access, to which I have my client attached ( Linux Mint 14)

one important note....
is your linux mint has ip address from subnet 192.168.55.0/24 ?

Michael.

wickwire

Hi, thanks for replying,

The Linux Mint client connects with a secondary internet access to simulate the external access to the LAN, so it has the public IP and then the VPN ip: 10.9.0.2

Another issue I noticed:

my tun device on the client reports this line as:

inet addr:10.9.0.2 P-t-P:10.9.0.2 Mask:255.255.255.255

Which seems odd...

Anyways, I managed to solve the issue with a less elegant way, from the guide I posted:

route add -net 10.9.0.0 netmask 255.255.255.0 gw 192.168.55.103

I added this on each of the other LAN elements and managed to get things working!

So I thought either I have a bad configuration with the VPN or my LAN TP-Link Router isn't properly propagating the static routes as it should.

Anyways, I'm unable to supply the outputs you've requested at the moment but I will do so as soon as possible, in spite of having things working (sort of) I'd like to learn this as well!

Thank you once again