redmage123
Hello all,
I'm getting the following error in my openvpn.log
Bad source address from client...Packet dropped.
Here's my setup.
Openvpn server 10.11.14.1 (10.11.0.0/16 network) ubuntu 12.04
Openvpn client gateway 10.10.12.1 (10.10.0.0/16 network). Debian
client 10.10.12.149 (10.10.0.0/16 network). Debian
the 10.10.12.149 client is a VM (xen) that is guested on the 10.10.12.1 host.
the openvpn server is also a Xen Master which is why it uses xenbr0 as its public network
device rather than eth0.
I can successfully ping the server (10.11.14.1) from the client gateway (10.10.12.1) , However, I don't get any reply when I ping from server to the client, and I get the packet dropped error when i try to ping from 10.10.12.149 to the server (10.11.14.1)
I researched the problem on the net and on this forum, and supplied the suggested
fixes, but I'm still getting the problem.
i'm running out of things to try so any help would be appreciated.
Thanks,
-- redmage123
Here are the relevant files:
Server.conf:
----------------------------------------------------------------------------------------------------
port 1194
proto tcp-server
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
#push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
push "route 10.11.0.0 netmask 255.255.0.0"
#client-to-client
#duplicate-cn
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log /var/log/openvpn.log
verb 6
client-config-dir ccd
route 10.10.0.0 255.255.0.0
------------------------------------------------------------------------------------------------------------------
The ccd/client file:
------------------------------------------------------------
iroute 10.10.0.0 255.255.0.0
------------------------------------------------------------
Client gateway client.conf file...
--------------------------------------------------------------------------------
client
;dev tap
dev tun
;dev-node MyTap
proto tcp
remote 193.1.33.25 1194
;remote my-server-2 1194
;remote-random
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]
;mute-replay-warnings
ca ca.crt
cert client.crt
key client.key
ns-cert-type server
;tls-auth ta.key 1
;cipher x
comp-lzo
-------------------------------------------------------------------------------------------------------------------------------
Server's routing table:
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 193.1.33.1 0.0.0.0 UG 0 0 0 xenbr0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
10.8.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
10.10.0.0 10.8.0.2 255.255.0.0 UG 0 0 0 tun0
10.11.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth1
10.11.14.10 0.0.0.0 255.255.255.255 UH 0 0 0 vif3.0
10.11.14.20 0.0.0.0 255.255.255.255 UH 0 0 0 vif4.0
192.168.10.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1
193.1.33.0 0.0.0.0 255.255.255.192 U 0 0 0 xenbr0
ipv4 forwarding is enabled on both the server and the client gateway.
Additionally the following iptables rules were applied on the client gateway:
-A INPUT -p tcp -m tcp --dport 1194 -j ACCEPT
-A INPUT -i tun+ -j ACCEPT
-A FORWARD -i tun+ -j ACCEPT
and the server has the following iptables ruie:
-A POSTROUTING -s 10.8.0.0/24 -o xenbr0 -j MASQUERADE
to allow NAT between the xenbr0 device and the tun0 device.
redmage123
One additional piece of information...I am able to ping from the server to the client gateway if
i use the 10.8.0.x ipaddr, I presume that this confirms that the openvpn tunnel is up and running, i.e. not an openvpn issue per se.
thanks,
-- redmage123
