I may have the same situation, if you found any fix I'll be glad to know about it.
I am restoring a VPN server after a crash, and even by restoring my backup config it can't get working as before. I've reinstalled openvpn on a fullwiped Debian system, so I may have miss something I've done before but don't know what.
port XXXX
proto udp
dev tap0
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh1024.pem
ifconfig-pool-persist ipp.txt
server-bridge 192.168.26.1 255.255.255.0 192.168.26.2 192.168.26.50
push "dhcp-option DNS 192.168.26.1"
push "dhcp-option WINS 192.168.26.1"
push "route-gateway 192.168.26.1"
client-to-client
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log openvpn.log
log-append openvpn.log
verb 5
management localhost 26231
even after :
Flushing rules IPv4 Firewall…
Flushing chain `INPUT'
Flushing chain `FORWARD'
Flushing chain `OUTPUT'
Flushing chain `blockedip'
Deleting chain `blockedip'
Flushing chain `PREROUTING'
Flushing chain `INPUT'
Flushing chain `OUTPUT'
Flushing chain `POSTROUTING'
Flushing chain `PREROUTING'
Flushing chain `INPUT'
Flushing chain `FORWARD'
Flushing chain `OUTPUT'
Flushing chain `POSTROUTING'
ACCEPT all opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0
ACCEPT all opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0
ACCEPT all opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0
:~$ sudo service iptables_conf status
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 84 7444 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 102 29616 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Client and server can't ping server
adi@client8:$ ping 192.168.26.1
PING 192.168.26.1 (192.168.26.1) 56(84) bytes of data.
From 192.168.26.8 icmp_seq=10 Destination Host Unreachable
From 192.168.26.8 icmp_seq=11 Destination Host Unreachable
Or another client, ping get stuck like that :
adi@client8:$ ping 192.168.26.6
PING 192.168.26.6 (192.168.26.6) 56(84) bytes of data.
ifconfig :
br0 Link encap:Ethernet HWaddr 00:27:0e:13:65:4e
inet adr:192.168.26.1 Bcast:192.168.26.255 Masque:255.255.255.0
adr inet6: fe80::227:eff:fe13:654e/64 Scope:Lien
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:272 errors:0 dropped:0 overruns:0 frame:0
TX packets:260 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 lg file transmission:0
RX bytes:23873 (23.3 KiB) TX bytes:24586 (24.0 KiB)
eth0.0 Link encap:Ethernet HWaddr 00:27:0e:13:65:4e
adr inet6: fe80::227:eff:fe13:654e/64 Scope:Lien
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:152 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 lg file transmission:0
RX bytes:0 (0.0 B) TX bytes:21545 (21.0 KiB)
lo Link encap:Boucle locale
inet adr:127.0.0.1 Masque:255.0.0.0
adr inet6: ::1/128 Scope:Hôte
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:340 errors:0 dropped:0 overruns:0 frame:0
TX packets:340 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 lg file transmission:0
RX bytes:74709 (72.9 KiB) TX bytes:74709 (72.9 KiB)
tap0 Link encap:Ethernet HWaddr 3a:f1:d7:a8:64:80
adr inet6: fe80::38f1:d7ff:fea8:6480/64 Scope:Lien
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:288 errors:0 dropped:0 overruns:0 frame:0
TX packets:261 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 lg file transmission:100
RX bytes:28817 (28.1 KiB) TX bytes:24552 (23.9 KiB)
bridge-start :
# Define Bridge Interface
br="br0"
# Define list of TAP interfaces to be bridged,
# for example tap="tap0 tap1 tap2".
tap="tap0"
# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="eth0.0"
eth_ip="192.168.26.1"
eth_netmask="255.255.255.0"
eth_broadcast="192.168.26.255"
for t in $tap; do
openvpn --mktun --dev $t
done
brctl addbr $br
brctl addif $br $eth
for t in $tap; do
brctl addif $br $t
done
for t in $tap; do
ifconfig $t 0.0.0.0 promisc up
done
ifconfig $eth 0.0.0.0 promisc up
ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast
Restart routine :
adi@server:~$ sudo service openvpn restart
Stopping virtual private network daemon:Sat Mar 9 00:24:12 2013 TUN/TAP device tap0 opened
Sat Mar 9 00:24:12 2013 Persist state set to: OFF
server.
Starting virtual private network daemon:Sat Mar 9 00:24:13 2013 TUN/TAP device tap0 opened
Sat Mar 9 00:24:13 2013 Persist state set to: ON
server.
I'm pretty disapointed, and do not know where to search anymore, except if there is something about the iptables that I missed.
When I turn on tcpdump on server I have the same issue than neilhwatson, ARP are sent but never received to my clients.
Last thing, I've set forwarding on ipv6 and ipv4 because we don't know.
adi@server:~$ cat /proc/sys/net/ipv6/conf/all/forwarding
1
adi@server:~$ cat /proc/sys/net/ipv4/conf/all/forwarding
1
adi@server:~$ cat /proc/sys/net/ipv4/ip_forward
1
I am able to cut off all securities setting to make this work one time.
