Hi all OpenVPN / Network Newbie here.
I have OpenVPN working, as in a client can connect to the server.
However when it comes to ping I HAD it working from Client to Server but since then I have broken things. I am trying to fix them up.
It seems routing related and it's either my routing tables or my iptables setup it feels.
* So the goals are to get the client and server ping each other from the 10.10.10.0/24 and 172.20.10.0/28 Subnet
* Get DNS settings installed on the client upon connection.
Just a side note I can browse the Internet no problems, from the vpn client through the server. I am not sure if there is a split-tunneling enabled in the setup below?
Server network config: vpn01
eth0 Link encap:Ethernet HWaddr 14:DA:E9:A2:AB:AF
inet addr:10.10.10.69 Bcast:10.10.10.255 Mask:255.255.255.0
inet6 addr: fe80::16da:e9ff:fea2:abaf/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:2728 errors:0 dropped:0 overruns:0 frame:0
TX packets:1963 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:262395 (256.2 KiB) TX bytes:319105 (311.6 KiB)
Interrupt:27
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
wlan0 Link encap:Ethernet HWaddr D0:DF:9A:AD:10:76
inet addr:192.168.1.116 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::d2df:9aff:fead:1076/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1411 errors:0 dropped:0 overruns:0 frame:0
TX packets:1331 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:154728 (151.1 KiB) TX bytes:149274 (145.7 K
iB)
[root@vpn01 ~]# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.8.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 wlan0
10.10.10.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
169.254.0.0 0.0.0.0 255.255.0.0 U 1002 0 0 eth0
169.254.0.0 0.0.0.0 255.255.0.0 U 1003 0 0 wlan0
0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 wlan0
[root@vpn01 ~]# iptables -nvL
Chain INPUT (policy ACCEPT 170 packets, 15546 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- tun+ * 0.0.0.0/0 0.0.0.0/0
1133 89963 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1194
3532 300K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
2 120 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
5 300 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- tun+ * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 3728 packets, 483K bytes)
pkts bytes target prot opt in out source destination
[root@vpn01 ~]# iptables -nvL -t nat
Chain PREROUTING (policy ACCEPT 100 packets, 11109 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 116 packets, 7261 bytes)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE all -- * wlan0 10.8.0.0/24 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 116 packets, 7261 bytes)
pkts bytes target prot opt in out source destination
traceroute 172.20.10.1 = this was going straight over my Internet connection and not over the tun0.
So I added a route:
ip route add 172.20.10.0/28 via 10.8.0.2
[root@vpn01 ~]# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.8.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
172.20.10.0 10.8.0.2 255.255.255.240 UG 0 0 0 tun0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 wlan0
10.10.10.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
169.254.0.0 0.0.0.0 255.255.0.0 U 1002 0 0 eth0
169.254.0.0 0.0.0.0 255.255.0.0 U 1003 0 0 wlan0
0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 wlan0
This then timed out: got worse 🙁
[root@vpn01 ~]# traceroute 172.20.10.1
traceroute to 172.20.10.1 (172.20.10.1), 30 hops max, 60 byte packets
1 * * *
2 * * *
3 * * *
4 * * *
5 * * *
6 * * *
[root@vpn01 ~]# ping 172.20.10.1
PING 172.20.10.1 (172.20.10.1) 56(84) bytes of data.
[root@vpn01 ~]# tcpdump -i tun0
18:50:15.526942 IP 10.8.0.1 > 172.20.10.1: ICMP echo request, id 27918, seq 1, length 64
18:50:16.526693 IP 10.8.0.1 > 172.20.10.1: ICMP echo request, id 27918, seq 2, length 64
Server Config:
[root@vpn01 ~]# cat /etc/openvpn/server.conf
local 192.168.1.116
port 1194
proto udp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
route 192.168.1.0 255.255.255.0
route 10.10.10.0 255.255.255.0
client-config-dir /etc/openvpn/ccd
client-to-client
push route 10.10.10.0 255.255.255.0
push route 192.168.1.0 255.255.255.0
keepalive 10 120
comp-lzo
persist-key
persist-tun
management tunnel 23000 stdin
push "dhcp-option DNS 10.10.10.1"
status openvpn-status.log
verb 5
[root@vpn01 ~]# cat /etc/openvpn/ccd/wsmint
iroute 10.10.10.0 255.255.255.0
On the Client: wsmint
wsmint ~ # ifconfig
eth0 Link encap:Ethernet HWaddr 00:19:b9:64:cc:d1
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
Interrupt:18
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:70 errors:0 dropped:0 overruns:0 frame:0
TX packets:70 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:6720 (6.7 KB) TX bytes:6720 (6.7 KB)
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.6 P-t-P:10.8.0.5 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:227 errors:0 dropped:0 overruns:0 frame:0
TX packets:244 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:13620 (13.6 KB) TX bytes:14640 (14.6 KB)
wlan0 Link encap:Ethernet HWaddr 00:18:de:82:a7:a2
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
wlan1 Link encap:Ethernet HWaddr 00:1c:df:58:c1:14
inet addr:172.20.10.2 Bcast:172.20.10.15 Mask:255.255.255.240
inet6 addr: fe80::21c:dfff:fe58:c114/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:9419 errors:0 dropped:0 overruns:0 frame:0
TX packets:7014 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:6760677 (6.7 MB) TX bytes:1156018 (1.1 MB)
wlan0:avahi Link encap:Ethernet HWaddr 00:18:de:82:a7:a2
inet addr:169.254.10.33 Bcast:169.254.255.255 Mask:255.255.0.0
UP BROADCAST MULTICAST MTU:1500 Metric:1
wsmint ~ # route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 172.20.10.1 0.0.0.0 UG 0 0 0 wlan1
10.8.0.0 10.8.0.5 255.255.255.0 UG 0 0 0 tun0
10.8.0.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
172.20.10.0 0.0.0.0 255.255.255.240 U 0 0 0 wlan1
192.168.1.0 10.8.0.5 255.255.255.0 UG 0 0 0 tun0
Same on this connection the route was not pushed: and it was going over the internet and not the tun0 device
ip route add 10.10.10.0/24 via 10.8.0.5
wsmint ~ # route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 172.20.10.1 0.0.0.0 UG 0 0 0 wlan1
0.0.0.0 0.0.0.0 0.0.0.0 U 1003 0 0 wlan0
10.8.0.0 10.8.0.5 255.255.255.0 UG 0 0 0 tun0
10.8.0.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 wlan0
172.20.10.0 0.0.0.0 255.255.255.240 U 0 0 0 wlan1
192.168.1.0 10.8.0.5 255.255.255.0 UG 0 0 0 tun0
Troubleshooting with traceoute:
wsmint ~ # traceroute 10.10.10.69 = times out
wsmint ~ # tcpdump -i tun0
19:10:14.293304 IP 10.8.0.6.42027 > 10.10.10.69.33434: UDP, length 32
19:10:14.293362 IP 10.8.0.6.51522 > 10.10.10.69.33435: UDP, length 32
19:10:14.293404 IP 10.8.0.6.43901 > 10.10.10.69.33436: UDP, length 32
19:10:14.293440 IP 10.8.0.6.37599 > 10.10.10.69.33437: UDP, length 32
wsmint ~ # iptables -nvL
Chain INPUT (policy DROP 163 packets, 16695 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- tun+ * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1194
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:6001
0 0 ACCEPT tcp -- * * 10.10.10.0/24 0.0.0.0/0 tcp dpt:5901
38 4028 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
7537 6476K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:51413
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:51413
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- tun+ * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 1456 packets, 359K bytes)
wsmint ~ # iptables -nvL -t nat
Chain PREROUTING (policy ACCEPT 55 packets, 6388 bytes)
pkts bytes target prot opt in out source destination
Chain INPUT (policy ACCEPT 6 packets, 694 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 594 packets, 38597 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 580 packets, 36393 bytes)
pkts bytes target prot opt in out source destination
15 2465 MASQUERADE all -- * wlan0 0.0.0.0/0 0.0.0.0/0
Client config:
wsmint ~ # cat /etc/openvpn/client.conf
;up /etc/openvpn/update-resolv-conf
;down /etc/openvpn/update-resolv-conf
client
remote x.x.x.x 1194
dev tun
proto udp
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/wsmint.crt
key /etc/openvpn/keys/wsmint.key
ns-cert-type server
comp-lzo
verb 5
keepalive 10 120
So the situation at current is I can connect from the client to the server and browse the Internet.
I currently cannot ping from client to server and vice versa.
Thanks for your time.
