[SOLVED] Stuck on routed TUN setup, pointers apreciated

blumman

Hi guys,

Just signed up as I'm stuck with configuring my routed site-to-site setup. I have previously configured the same setup between two DD-WRT routers but I needed to move away from that due performance issues. My current topology is slightly different, it involves one stand-alone OpenVPN server and one stand-alone OpenVPN client which are located "behind" the routers. I have searched through the forum and found some similar scenarios but I couldn't make sense of it all thus some help would be highly appreciated.

Just so you can try to visualize my topology, here it is.

LAN A (192.168.1.0/24) -> OpenVPN Server (192.168.1.2) -> Router A (192.168.1.1) -> Internet <- Router B (192.168.2.1) <- OpenVPN Client (192.168.2.2) <- LAN B (192.168.2.0/24)
                                    TUN0 (172.16.1.1)                                                                               TUN1 (172.16.1.2)

I have a working tunnel were I can ping/traceroute all server/client IP's from both sides of the OpenVPN instances. I can also do this from clients behind LAN A and LAN B, i.e. reach the remote OpenVPN "server" instances from the LAN clients. Here is were it stops. I'm not able to FTP/SSH/HTTP trough the tunnel. This tells me that there is a need of adding iptables. Also, I'm not able to reach any other clients from each "remote" subnets which tells me I got some kind of a routing problem.

My goal is to have these two sites linked together with no limitation on what may pass through the tunnel and have all clients being able to "see" to each other. I also want the possibility to add another site in the future. I'm a bit confused about which device to add rules/routes to but I'm guessing on the OpenVPN boxes and not on the routers. I also don't know what to configure in order to achieve this so any direct solution or pointer would be appreciated.

My configurations/logs are as below (some information has intentionally been left out or modified).

Router A's static route.

172.16.0.0      192.168.1.2 255.255.255.0   UG    2      0        0 br0
192.168.2.0    192.168.1.2 255.255.255.0   UG    2      0        0 br0

Router B's static route.

192.168.1.0   192.168.2.2 255.255.255.0   UG    1      0        0 br0
172.16.0.0      192.168.2.2 255.255.255.0   UG    1      0        0 br0

Both OpenVPN server and OpenVPN client has IP forwarding enabled.

cat /etc/sysctl.conf | grep ip_forward
net.ipv4.ip_forward = 1

OpenVPN server config.

ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
local 192.168.1.2
port X
proto udp
dev tun
persist-tun
persist-key
server 172.16.0.0 255.255.255.0
ifconfig-pool-linear ipp 0
client-to-client
client-config-dir ccd
route 192.168.2.0 255.255.255.0
keepalive 10 120
log-append /var/log/openvpn.log
status openvpn-status.log
max-clients 1
user nobody
group nogroup
comp-lzo yes

CCD config.

iroute 192.168.2.0 255.255.255.0
ifconfig-push 172.16.0.2 172.16.0.1
push "route 192.168.1.0 255.255.255.0"
push "dhcp-option WINS 192.168.1.2"

OpenVPN client config.

client
dev tun
proto udp
remote X Y
resolv-retry infinite
nobind
# user
# group
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
comp-lzo yes
verb 7
log-append /var/log/openvpn.log

OpenVPN server log.

Mon May 13 20:35:19 2013 us=752096 Current Parameter Settings:
Mon May 13 20:35:19 2013 us=752301   config = '/etc/openvpn/server.conf'
Mon May 13 20:35:19 2013 us=752347   mode = 1
Mon May 13 20:35:19 2013 us=752388   persist_config = DISABLED
Mon May 13 20:35:19 2013 us=752427   persist_mode = 1
Mon May 13 20:35:19 2013 us=752466   show_ciphers = DISABLED
Mon May 13 20:35:19 2013 us=752505   show_digests = DISABLED
Mon May 13 20:35:19 2013 us=752544   show_engines = DISABLED
Mon May 13 20:35:19 2013 us=752582   genkey = DISABLED
Mon May 13 20:35:19 2013 us=752621   key_pass_file = '[UNDEF]'
Mon May 13 20:35:19 2013 us=752661   show_tls_ciphers = DISABLED
Mon May 13 20:35:19 2013 us=752700   proto = 0
Mon May 13 20:35:19 2013 us=752739   local = '192.168.1.2'
Mon May 13 20:35:19 2013 us=752778   remote_list = NULL
Mon May 13 20:35:19 2013 us=752817   remote_random = DISABLED
Mon May 13 20:35:19 2013 us=752856   local_port = X
Mon May 13 20:35:19 2013 us=752895   remote_port = X
Mon May 13 20:35:19 2013 us=752934   remote_float = DISABLED
Mon May 13 20:35:19 2013 us=752973   ipchange = '[UNDEF]'
Mon May 13 20:35:19 2013 us=753012   bind_local = ENABLED
Mon May 13 20:35:19 2013 us=753050   dev = 'tun'
Mon May 13 20:35:19 2013 us=753089   dev_type = '[UNDEF]'
Mon May 13 20:35:19 2013 us=753128   dev_node = '[UNDEF]'
Mon May 13 20:35:19 2013 us=753187   tun_ipv6 = DISABLED
Mon May 13 20:35:19 2013 us=753227   ifconfig_local = '172.16.0.1'
Mon May 13 20:35:19 2013 us=753273   ifconfig_remote_netmask = '172.16.0.2'
Mon May 13 20:35:19 2013 us=753312   ifconfig_noexec = DISABLED
Mon May 13 20:35:19 2013 us=753351   ifconfig_nowarn = DISABLED
Mon May 13 20:35:19 2013 us=753390   shaper = 0
Mon May 13 20:35:19 2013 us=753429   tun_mtu = 1500
Mon May 13 20:35:19 2013 us=753468   tun_mtu_defined = ENABLED
Mon May 13 20:35:19 2013 us=753507   link_mtu = 1500
Mon May 13 20:35:19 2013 us=753546   link_mtu_defined = DISABLED
Mon May 13 20:35:19 2013 us=753585   tun_mtu_extra = 0
Mon May 13 20:35:19 2013 us=753624   tun_mtu_extra_defined = DISABLED
Mon May 13 20:35:19 2013 us=753663   fragment = 0
Mon May 13 20:35:19 2013 us=753702   mtu_discover_type = -1
Mon May 13 20:35:19 2013 us=753741   mtu_test = 0
Mon May 13 20:35:19 2013 us=753779   mlock = DISABLED
Mon May 13 20:35:19 2013 us=753818   keepalive_ping = 10
Mon May 13 20:35:19 2013 us=753858   keepalive_timeout = 120
Mon May 13 20:35:19 2013 us=753897   inactivity_timeout = 0
Mon May 13 20:35:19 2013 us=753936   ping_send_timeout = 10
Mon May 13 20:35:19 2013 us=753975   ping_rec_timeout = 240
Mon May 13 20:35:19 2013 us=754014   ping_rec_timeout_action = 2
Mon May 13 20:35:19 2013 us=754052   ping_timer_remote = DISABLED
Mon May 13 20:35:19 2013 us=754091   remap_sigusr1 = 0
Mon May 13 20:35:19 2013 us=754144   explicit_exit_notification = 0
Mon May 13 20:35:19 2013 us=754187   persist_tun = ENABLED
Mon May 13 20:35:19 2013 us=754226   persist_local_ip = DISABLED
Mon May 13 20:35:19 2013 us=754264   persist_remote_ip = DISABLED
Mon May 13 20:35:19 2013 us=754303   persist_key = ENABLED
Mon May 13 20:35:19 2013 us=754342   mssfix = 1450
Mon May 13 20:35:19 2013 us=754380   passtos = DISABLED
Mon May 13 20:35:19 2013 us=754420   resolve_retry_seconds = 1000000000
Mon May 13 20:35:19 2013 us=754465   connect_retry_seconds = 5
Mon May 13 20:35:19 2013 us=754505   username = 'nobody'
Mon May 13 20:35:19 2013 us=754544   groupname = 'nogroup'
Mon May 13 20:35:19 2013 us=754582   chroot_dir = '[UNDEF]'
Mon May 13 20:35:19 2013 us=754621   cd_dir = '/etc/openvpn'
Mon May 13 20:35:19 2013 us=754660   writepid = '/var/run/openvpn.server.pid'
Mon May 13 20:35:19 2013 us=754699   up_script = '[UNDEF]'
Mon May 13 20:35:19 2013 us=754737   down_script = '[UNDEF]'
Mon May 13 20:35:19 2013 us=754776   down_pre = DISABLED
Mon May 13 20:35:19 2013 us=754864   up_restart = DISABLED
Mon May 13 20:35:19 2013 us=754904   up_delay = DISABLED
Mon May 13 20:35:19 2013 us=754943   daemon = ENABLED
Mon May 13 20:35:19 2013 us=754982   inetd = 0
Mon May 13 20:35:19 2013 us=755021   log = ENABLED
Mon May 13 20:35:19 2013 us=755060   suppress_timestamps = DISABLED
Mon May 13 20:35:19 2013 us=755099   nice = 0
Mon May 13 20:35:19 2013 us=755157   verbosity = 6
Mon May 13 20:35:19 2013 us=755197   mute = 0
Mon May 13 20:35:19 2013 us=755236   gremlin = 0
Mon May 13 20:35:19 2013 us=755275   status_file = 'openvpn-status.log'
Mon May 13 20:35:19 2013 us=755314   status_file_version = 1
Mon May 13 20:35:19 2013 us=755353   status_file_update_freq = 60
Mon May 13 20:35:19 2013 us=755392   occ = ENABLED
Mon May 13 20:35:19 2013 us=755431   rcvbuf = 65536
Mon May 13 20:35:19 2013 us=755469   sndbuf = 65536
Mon May 13 20:35:19 2013 us=755509   socks_proxy_server = '[UNDEF]'
Mon May 13 20:35:19 2013 us=755548   socks_proxy_port = 0
Mon May 13 20:35:19 2013 us=755586   socks_proxy_retry = DISABLED
Mon May 13 20:35:19 2013 us=755625   fast_io = DISABLED
Mon May 13 20:35:19 2013 us=755663   comp_lzo = ENABLED
Mon May 13 20:35:19 2013 us=755702   comp_lzo_adaptive = ENABLED
Mon May 13 20:35:19 2013 us=755741   route_script = '[UNDEF]'
Mon May 13 20:35:19 2013 us=755779   route_default_gateway = '[UNDEF]'
Mon May 13 20:35:19 2013 us=755818   route_noexec = DISABLED
Mon May 13 20:35:19 2013 us=755857   route_delay = 0
Mon May 13 20:35:19 2013 us=755896   route_delay_window = 30
Mon May 13 20:35:19 2013 us=755934   route_delay_defined = DISABLED
Mon May 13 20:35:19 2013 us=755974   route 192.168.2.0/255.255.255.0/nil/nil
Mon May 13 20:35:19 2013 us=756014   route 172.16.0.0/255.255.255.0/nil/nil
Mon May 13 20:35:19 2013 us=756053   management_addr = '[UNDEF]'
Mon May 13 20:35:19 2013 us=756092   management_port = 0
Mon May 13 20:35:19 2013 us=756147   management_user_pass = '[UNDEF]'
Mon May 13 20:35:19 2013 us=756189   management_log_history_cache = 250
Mon May 13 20:35:19 2013 us=756229   management_echo_buffer_size = 100
Mon May 13 20:35:19 2013 us=756267   management_query_passwords = DISABLED
Mon May 13 20:35:19 2013 us=756306   management_hold = DISABLED
Mon May 13 20:35:19 2013 us=756346   shared_secret_file = '[UNDEF]'
Mon May 13 20:35:19 2013 us=756386   key_direction = 0
Mon May 13 20:35:19 2013 us=756425   ciphername_defined = ENABLED
Mon May 13 20:35:19 2013 us=756465   ciphername = 'X'
Mon May 13 20:35:19 2013 us=756504   authname_defined = ENABLED
Mon May 13 20:35:19 2013 us=756543   authname = 'X'
Mon May 13 20:35:19 2013 us=756582   keysize = 0
Mon May 13 20:35:19 2013 us=756620   engine = DISABLED
Mon May 13 20:35:19 2013 us=756659   replay = ENABLED
Mon May 13 20:35:19 2013 us=756698   mute_replay_warnings = DISABLED
Mon May 13 20:35:19 2013 us=756737   replay_window = 64
Mon May 13 20:35:19 2013 us=756777   replay_time = 15
Mon May 13 20:35:19 2013 us=756816   packet_id_file = '[UNDEF]'
Mon May 13 20:35:19 2013 us=756854   use_iv = ENABLED
Mon May 13 20:35:19 2013 us=756893   test_crypto = DISABLED
Mon May 13 20:35:19 2013 us=756932   tls_server = ENABLED
Mon May 13 20:35:19 2013 us=756971   tls_client = DISABLED
Mon May 13 20:35:19 2013 us=757010   key_method = 2
Mon May 13 20:35:19 2013 us=757049   ca_file = 'ca.crt'
Mon May 13 20:35:19 2013 us=757088   dh_file = 'dh2048.pem'
Mon May 13 20:35:19 2013 us=757127   cert_file = 'server.crt'
Mon May 13 20:35:19 2013 us=757183   priv_key_file = 'server.key'
Mon May 13 20:35:19 2013 us=757223   pkcs12_file = '[UNDEF]'
Mon May 13 20:35:19 2013 us=757261   cipher_list = 'X'
Mon May 13 20:35:19 2013 us=757300   tls_verify = '[UNDEF]'
Mon May 13 20:35:19 2013 us=757339   tls_remote = '[UNDEF]'
Mon May 13 20:35:19 2013 us=757378   crl_file = '[UNDEF]'
Mon May 13 20:35:19 2013 us=757418   ns_cert_type = 0
Mon May 13 20:35:19 2013 us=757457   tls_timeout = 2
Mon May 13 20:35:19 2013 us=757496   renegotiate_bytes = 0
Mon May 13 20:35:19 2013 us=757563   renegotiate_packets = 0
Mon May 13 20:35:19 2013 us=757603   renegotiate_seconds = 3600
Mon May 13 20:35:19 2013 us=757642   handshake_window = 60
Mon May 13 20:35:19 2013 us=757682   transition_window = 3600
Mon May 13 20:35:19 2013 us=757721   single_session = DISABLED
Mon May 13 20:35:19 2013 us=757760   tls_exit = DISABLED
Mon May 13 20:35:19 2013 us=757799   tls_auth_file = '[UNDEF]'
Mon May 13 20:35:19 2013 us=757842   server_network = 172.16.0.0
Mon May 13 20:35:19 2013 us=757885   server_netmask = 255.255.255.0
Mon May 13 20:35:19 2013 us=757927   server_bridge_ip = 0.0.0.0
Mon May 13 20:35:19 2013 us=757970   server_bridge_netmask = 0.0.0.0
Mon May 13 20:35:19 2013 us=758012   server_bridge_pool_start = 0.0.0.0
Mon May 13 20:35:19 2013 us=758054   server_bridge_pool_end = 0.0.0.0
Mon May 13 20:35:19 2013 us=758094   push_list = 'route 172.16.0.0 255.255.255.0,ping 10,ping-restart 120'
Mon May 13 20:35:19 2013 us=758148   ifconfig_pool_defined = ENABLED
Mon May 13 20:35:19 2013 us=758193   ifconfig_pool_start = 172.16.0.4
Mon May 13 20:35:19 2013 us=758236   ifconfig_pool_end = 172.16.0.251
Mon May 13 20:35:19 2013 us=758279   ifconfig_pool_netmask = 0.0.0.0
Mon May 13 20:35:19 2013 us=758318   ifconfig_pool_persist_filename = '[UNDEF]'
Mon May 13 20:35:19 2013 us=758358   ifconfig_pool_persist_refresh_freq = 600
Mon May 13 20:35:19 2013 us=758397   ifconfig_pool_linear = ENABLED
Mon May 13 20:35:19 2013 us=758437   n_bcast_buf = 256
Mon May 13 20:35:19 2013 us=758476   tcp_queue_limit = 64
Mon May 13 20:35:19 2013 us=758515   real_hash_size = 256
Mon May 13 20:35:19 2013 us=758554   virtual_hash_size = 256
Mon May 13 20:35:19 2013 us=758593   client_connect_script = '[UNDEF]'
Mon May 13 20:35:19 2013 us=758633   learn_address_script = '[UNDEF]'
Mon May 13 20:35:19 2013 us=758672   client_disconnect_script = '[UNDEF]'
Mon May 13 20:35:19 2013 us=758711   client_config_dir = 'ccd'
Mon May 13 20:35:19 2013 us=758750   ccd_exclusive = DISABLED
Mon May 13 20:35:19 2013 us=758789   tmp_dir = '[UNDEF]'
Mon May 13 20:35:19 2013 us=758828   push_ifconfig_defined = DISABLED
Mon May 13 20:35:19 2013 us=758870   push_ifconfig_local = 0.0.0.0
Mon May 13 20:35:19 2013 us=758912   push_ifconfig_remote_netmask = 0.0.0.0
Mon May 13 20:35:19 2013 us=758952   enable_c2c = ENABLED
Mon May 13 20:35:19 2013 us=758991   duplicate_cn = DISABLED
Mon May 13 20:35:19 2013 us=759030   cf_max = 0
Mon May 13 20:35:19 2013 us=759069   cf_per = 0
Mon May 13 20:35:19 2013 us=759108   max_clients = 1
Mon May 13 20:35:19 2013 us=759161   max_routes_per_client = 256
Mon May 13 20:35:19 2013 us=759201   client_cert_not_required = DISABLED
Mon May 13 20:35:19 2013 us=759240   username_as_common_name = DISABLED
Mon May 13 20:35:19 2013 us=759279   auth_user_pass_verify_script = '[UNDEF]'
Mon May 13 20:35:19 2013 us=759319   auth_user_pass_verify_script_via_file = DISABLED
Mon May 13 20:35:19 2013 us=759357   client = DISABLED
Mon May 13 20:35:19 2013 us=759396   pull = DISABLED
Mon May 13 20:35:19 2013 us=759436   auth_user_pass_file = '[UNDEF]'
Mon May 13 20:35:19 2013 us=759477 OpenVPN 2.0.9 i486-pc-linux-gnu [SSL] [LZO] [EPOLL] built on Sep 20 2007
Mon May 13 20:35:19 2013 us=912241 Diffie-Hellman initialized with 2048 bit key
Mon May 13 20:35:19 2013 us=914333 TLS-Auth MTU parms [ X ]
Mon May 13 20:35:19 2013 us=915776 TUN/TAP device tun0 opened
Mon May 13 20:35:19 2013 us=915931 TUN/TAP TX queue length set to 100
Mon May 13 20:35:19 2013 us=916065 ifconfig tun0 172.16.0.1 pointopoint 172.16.0.2 mtu 1500
Mon May 13 20:35:19 2013 us=924424 route add -net 192.168.2.0 netmask 255.255.255.0 gw 172.16.0.2
Mon May 13 20:35:19 2013 us=929036 route add -net 172.16.0.0 netmask 255.255.255.0 gw 172.16.0.2
Mon May 13 20:35:19 2013 us=935278 Data Channel MTU parms [ X ]
Mon May 13 20:35:19 2013 us=937261 GID set to nogroup
Mon May 13 20:35:19 2013 us=937404 UID set to nobody
Mon May 13 20:35:19 2013 us=937488 Socket Buffers: R=[118784->131072] S=[118784->131072]
Mon May 13 20:35:19 2013 us=937601 UDPv4 link local (bound): 192.168.1.2:X
Mon May 13 20:35:19 2013 us=937642 UDPv4 link remote: [undef]
Mon May 13 20:35:19 2013 us=937701 MULTI: multi_init called, r=256 v=256
Mon May 13 20:35:19 2013 us=937836 IFCONFIG POOL: base=172.16.0.4 size=248
Mon May 13 20:35:19 2013 us=937924 Initialization Sequence Completed

OpenVPN client log.

Mon May 13 20:42:17 2013 us=248487 Current Parameter Settings:
Mon May 13 20:42:17 2013 us=248687   config = '/etc/openvpn/server.conf'
Mon May 13 20:42:17 2013 us=248739   mode = 0
Mon May 13 20:42:17 2013 us=248784   persist_config = DISABLED
Mon May 13 20:42:17 2013 us=248840   persist_mode = 1
Mon May 13 20:42:17 2013 us=248885   show_ciphers = DISABLED
Mon May 13 20:42:17 2013 us=248928   show_digests = DISABLED
Mon May 13 20:42:17 2013 us=248970   show_engines = DISABLED
Mon May 13 20:42:17 2013 us=249013   genkey = DISABLED
Mon May 13 20:42:17 2013 us=249056   key_pass_file = '[UNDEF]'
Mon May 13 20:42:17 2013 us=249098   show_tls_ciphers = DISABLED
Mon May 13 20:42:17 2013 us=249158   proto = 0
Mon May 13 20:42:17 2013 us=249202   local = '[UNDEF]'
Mon May 13 20:42:17 2013 us=249250   remote_list[0] = {'X', Y}
Mon May 13 20:42:17 2013 us=249294   remote_random = DISABLED
Mon May 13 20:42:17 2013 us=249337   local_port = X
Mon May 13 20:42:17 2013 us=249380   remote_port = X
Mon May 13 20:42:17 2013 us=249423   remote_float = DISABLED
Mon May 13 20:42:17 2013 us=249466   ipchange = '[UNDEF]'
Mon May 13 20:42:17 2013 us=249508   bind_local = DISABLED
Mon May 13 20:42:17 2013 us=249550   dev = 'tun'
Mon May 13 20:42:17 2013 us=249592   dev_type = '[UNDEF]'
Mon May 13 20:42:17 2013 us=249635   dev_node = '[UNDEF]'
Mon May 13 20:42:17 2013 us=249677   tun_ipv6 = DISABLED
Mon May 13 20:42:17 2013 us=249719   ifconfig_local = '[UNDEF]'
Mon May 13 20:42:17 2013 us=249765   ifconfig_remote_netmask = '[UNDEF]'
Mon May 13 20:42:17 2013 us=249808   ifconfig_noexec = DISABLED
Mon May 13 20:42:17 2013 us=249850   ifconfig_nowarn = DISABLED
Mon May 13 20:42:17 2013 us=249900   shaper = 0
Mon May 13 20:42:17 2013 us=249946   tun_mtu = 1500
Mon May 13 20:42:17 2013 us=249989   tun_mtu_defined = ENABLED
Mon May 13 20:42:17 2013 us=250032   link_mtu = 1500
Mon May 13 20:42:17 2013 us=250074   link_mtu_defined = DISABLED
Mon May 13 20:42:17 2013 us=250116   tun_mtu_extra = 0
Mon May 13 20:42:17 2013 us=250176   tun_mtu_extra_defined = DISABLED
Mon May 13 20:42:17 2013 us=250219   fragment = 0
Mon May 13 20:42:17 2013 us=250262   mtu_discover_type = -1
Mon May 13 20:42:17 2013 us=250304   mtu_test = 0
Mon May 13 20:42:17 2013 us=250346   mlock = DISABLED
Mon May 13 20:42:17 2013 us=250389   keepalive_ping = 0
Mon May 13 20:42:17 2013 us=250432   keepalive_timeout = 0
Mon May 13 20:42:17 2013 us=250474   inactivity_timeout = 0
Mon May 13 20:42:17 2013 us=250517   ping_send_timeout = 0
Mon May 13 20:42:17 2013 us=250559   ping_rec_timeout = 120
Mon May 13 20:42:17 2013 us=250602   ping_rec_timeout_action = 2
Mon May 13 20:42:17 2013 us=250644   ping_timer_remote = DISABLED
Mon May 13 20:42:17 2013 us=250686   remap_sigusr1 = 0
Mon May 13 20:42:17 2013 us=250729   explicit_exit_notification = 0
Mon May 13 20:42:17 2013 us=250771   persist_tun = ENABLED
Mon May 13 20:42:17 2013 us=250813   persist_local_ip = DISABLED
Mon May 13 20:42:17 2013 us=250855   persist_remote_ip = DISABLED
Mon May 13 20:42:17 2013 us=250897   persist_key = ENABLED
Mon May 13 20:42:17 2013 us=250940   mssfix = 1450
Mon May 13 20:42:17 2013 us=250994   passtos = DISABLED
Mon May 13 20:42:17 2013 us=251038   resolve_retry_seconds = 1000000000
Mon May 13 20:42:17 2013 us=251081   connect_retry_seconds = 5
Mon May 13 20:42:17 2013 us=251123   username = '[UNDEF]'
Mon May 13 20:42:17 2013 us=251179   groupname = '[UNDEF]'
Mon May 13 20:42:17 2013 us=251222   chroot_dir = '[UNDEF]'
Mon May 13 20:42:17 2013 us=251308   cd_dir = '/etc/openvpn'
Mon May 13 20:42:17 2013 us=251352   writepid = '/var/run/openvpn.server.pid'
Mon May 13 20:42:17 2013 us=251394   up_script = '[UNDEF]'
Mon May 13 20:42:17 2013 us=251436   down_script = '[UNDEF]'
Mon May 13 20:42:17 2013 us=251478   down_pre = DISABLED
Mon May 13 20:42:17 2013 us=251520   up_restart = DISABLED
Mon May 13 20:42:17 2013 us=251562   up_delay = DISABLED
Mon May 13 20:42:17 2013 us=251604   daemon = ENABLED
Mon May 13 20:42:17 2013 us=251646   inetd = 0
Mon May 13 20:42:17 2013 us=251687   log = ENABLED
Mon May 13 20:42:17 2013 us=251729   suppress_timestamps = DISABLED
Mon May 13 20:42:17 2013 us=251771   nice = 0
Mon May 13 20:42:17 2013 us=251813   verbosity = 6
Mon May 13 20:42:17 2013 us=251856   mute = 0
Mon May 13 20:42:17 2013 us=251898   gremlin = 0
Mon May 13 20:42:17 2013 us=251940   status_file = '/var/run/openvpn.server.status'
Mon May 13 20:42:17 2013 us=251982   status_file_version = 1
Mon May 13 20:42:17 2013 us=252029   status_file_update_freq = 10
Mon May 13 20:42:17 2013 us=252080   occ = ENABLED
Mon May 13 20:42:17 2013 us=252124   rcvbuf = 65536
Mon May 13 20:42:17 2013 us=252178   sndbuf = 65536
Mon May 13 20:42:17 2013 us=252221   socks_proxy_server = '[UNDEF]'
Mon May 13 20:42:17 2013 us=252264   socks_proxy_port = 0
Mon May 13 20:42:17 2013 us=252306   socks_proxy_retry = DISABLED
Mon May 13 20:42:17 2013 us=252348   fast_io = DISABLED
Mon May 13 20:42:17 2013 us=252390   comp_lzo = ENABLED
Mon May 13 20:42:17 2013 us=252432   comp_lzo_adaptive = ENABLED
Mon May 13 20:42:17 2013 us=252474   route_script = '[UNDEF]'
Mon May 13 20:42:17 2013 us=252516   route_default_gateway = '[UNDEF]'
Mon May 13 20:42:17 2013 us=252565   route_noexec = DISABLED
Mon May 13 20:42:17 2013 us=252623   route_delay = 0
Mon May 13 20:42:17 2013 us=252667   route_delay_window = 30
Mon May 13 20:42:17 2013 us=252709   route_delay_defined = DISABLED
Mon May 13 20:42:17 2013 us=252752   management_addr = '[UNDEF]'
Mon May 13 20:42:17 2013 us=252794   management_port = 0
Mon May 13 20:42:17 2013 us=252836   management_user_pass = '[UNDEF]'
Mon May 13 20:42:17 2013 us=252879   management_log_history_cache = 250
Mon May 13 20:42:17 2013 us=252921   management_echo_buffer_size = 100
Mon May 13 20:42:17 2013 us=252963   management_query_passwords = DISABLED
Mon May 13 20:42:17 2013 us=253005   management_hold = DISABLED
Mon May 13 20:42:17 2013 us=253047   shared_secret_file = '[UNDEF]'
Mon May 13 20:42:17 2013 us=253091   key_direction = 0
Mon May 13 20:42:17 2013 us=253158   ciphername_defined = ENABLED
Mon May 13 20:42:17 2013 us=253202   ciphername = 'X'
Mon May 13 20:42:17 2013 us=253245   authname_defined = ENABLED
Mon May 13 20:42:17 2013 us=253288   authname = 'X'
Mon May 13 20:42:17 2013 us=253331   keysize = 0
Mon May 13 20:42:17 2013 us=253374   engine = DISABLED
Mon May 13 20:42:17 2013 us=253416   replay = ENABLED
Mon May 13 20:42:17 2013 us=253459   mute_replay_warnings = DISABLED
Mon May 13 20:42:17 2013 us=253502   replay_window = 64
Mon May 13 20:42:17 2013 us=253546   replay_time = 15
Mon May 13 20:42:17 2013 us=253588   packet_id_file = '[UNDEF]'
Mon May 13 20:42:17 2013 us=253631   use_iv = ENABLED
Mon May 13 20:42:17 2013 us=253673   test_crypto = DISABLED
Mon May 13 20:42:17 2013 us=253716   tls_server = DISABLED
Mon May 13 20:42:17 2013 us=253758   tls_client = ENABLED
Mon May 13 20:42:17 2013 us=253800   key_method = 2
Mon May 13 20:42:17 2013 us=253843   ca_file = 'ca.crt'
Mon May 13 20:42:17 2013 us=253886   dh_file = '[UNDEF]'
Mon May 13 20:42:17 2013 us=253928   cert_file = 'client.crt'
Mon May 13 20:42:17 2013 us=253971   priv_key_file = 'client.key'
Mon May 13 20:42:17 2013 us=254013   pkcs12_file = '[UNDEF]'
Mon May 13 20:42:17 2013 us=254056   cipher_list = 'X'
Mon May 13 20:42:17 2013 us=254098   tls_verify = '[UNDEF]'
Mon May 13 20:42:17 2013 us=254155   tls_remote = '[UNDEF]'
Mon May 13 20:42:17 2013 us=254210   crl_file = '[UNDEF]'
Mon May 13 20:42:17 2013 us=254284   ns_cert_type = 0
Mon May 13 20:42:17 2013 us=254329   tls_timeout = 2
Mon May 13 20:42:17 2013 us=254372   renegotiate_bytes = 0
Mon May 13 20:42:17 2013 us=254416   renegotiate_packets = 0
Mon May 13 20:42:17 2013 us=254459   renegotiate_seconds = 3600
Mon May 13 20:42:17 2013 us=254502   handshake_window = 60
Mon May 13 20:42:17 2013 us=254546   transition_window = 3600
Mon May 13 20:42:17 2013 us=254588   single_session = DISABLED
Mon May 13 20:42:17 2013 us=254631   tls_exit = DISABLED
Mon May 13 20:42:17 2013 us=254673   tls_auth_file = '[UNDEF]'
Mon May 13 20:42:17 2013 us=254752   server_network = 0.0.0.0
Mon May 13 20:42:17 2013 us=254807   server_netmask = 0.0.0.0
Mon May 13 20:42:17 2013 us=254855   server_bridge_ip = 0.0.0.0
Mon May 13 20:42:17 2013 us=254901   server_bridge_netmask = 0.0.0.0
Mon May 13 20:42:17 2013 us=254947   server_bridge_pool_start = 0.0.0.0
Mon May 13 20:42:17 2013 us=254993   server_bridge_pool_end = 0.0.0.0
Mon May 13 20:42:17 2013 us=255036   ifconfig_pool_defined = DISABLED
Mon May 13 20:42:17 2013 us=255083   ifconfig_pool_start = 0.0.0.0
Mon May 13 20:42:17 2013 us=255129   ifconfig_pool_end = 0.0.0.0
Mon May 13 20:42:17 2013 us=255190   ifconfig_pool_netmask = 0.0.0.0
Mon May 13 20:42:17 2013 us=255235   ifconfig_pool_persist_filename = '[UNDEF]'
Mon May 13 20:42:17 2013 us=255290   ifconfig_pool_persist_refresh_freq = 600
Mon May 13 20:42:17 2013 us=255334   ifconfig_pool_linear = DISABLED
Mon May 13 20:42:17 2013 us=255377   n_bcast_buf = 256
Mon May 13 20:42:17 2013 us=255421   tcp_queue_limit = 64
Mon May 13 20:42:17 2013 us=255463   real_hash_size = 256
Mon May 13 20:42:17 2013 us=255507   virtual_hash_size = 256
Mon May 13 20:42:17 2013 us=255550   client_connect_script = '[UNDEF]'
Mon May 13 20:42:17 2013 us=255593   learn_address_script = '[UNDEF]'
Mon May 13 20:42:17 2013 us=255637   client_disconnect_script = '[UNDEF]'
Mon May 13 20:42:17 2013 us=255680   client_config_dir = '[UNDEF]'
Mon May 13 20:42:17 2013 us=255723   ccd_exclusive = DISABLED
Mon May 13 20:42:17 2013 us=255765   tmp_dir = '[UNDEF]'
Mon May 13 20:42:17 2013 us=255808   push_ifconfig_defined = DISABLED
Mon May 13 20:42:17 2013 us=255854   push_ifconfig_local = 0.0.0.0
Mon May 13 20:42:17 2013 us=255901   push_ifconfig_remote_netmask = 0.0.0.0
Mon May 13 20:42:17 2013 us=255944   enable_c2c = DISABLED
Mon May 13 20:42:17 2013 us=255986   duplicate_cn = DISABLED
Mon May 13 20:42:17 2013 us=256029   cf_max = 0
Mon May 13 20:42:17 2013 us=256071   cf_per = 0
Mon May 13 20:42:17 2013 us=256114   max_clients = 1024
Mon May 13 20:42:17 2013 us=256169   max_routes_per_client = 256
Mon May 13 20:42:17 2013 us=256212   client_cert_not_required = DISABLED
Mon May 13 20:42:17 2013 us=256266   username_as_common_name = DISABLED
Mon May 13 20:42:17 2013 us=256314   auth_user_pass_verify_script = '[UNDEF]'
Mon May 13 20:42:17 2013 us=256366   auth_user_pass_verify_script_via_file = DISABLED
Mon May 13 20:42:17 2013 us=256409   client = ENABLED
Mon May 13 20:42:17 2013 us=256452   pull = ENABLED
Mon May 13 20:42:17 2013 us=256495   auth_user_pass_file = '[UNDEF]'
Mon May 13 20:42:17 2013 us=256541 OpenVPN 2.0.9 i486-pc-linux-gnu [SSL] [LZO] [EPOLL] built on Sep 20 2007
Mon May 13 20:42:17 2013 us=259315 LZO compression initialized
Mon May 13 20:42:17 2013 us=259602 Control Channel MTU parms [ X ]
Mon May 13 20:42:17 2013 us=291349 Data Channel MTU parms [ X ]
Mon May 13 20:42:17 2013 us=291471 Local Options String: 'X'
Mon May 13 20:42:17 2013 us=291581 Expected Remote Options String: 'X'
Mon May 13 20:42:17 2013 us=291676 Local Options hash (VER=V4): 'X'
Mon May 13 20:42:17 2013 us=291739 Expected Remote Options hash (VER=V4): 'X'
Mon May 13 20:42:17 2013 us=292532 Socket Buffers: R=[118784->131072] S=[118784->131072]
Mon May 13 20:42:17 2013 us=292774 UDPv4 link local: [undef]
Mon May 13 20:42:17 2013 us=292854 UDPv4 link remote: X:Y
Mon May 13 20:42:17 2013 us=293503 UDPv4 WRITE [14] to X:Y: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Mon May 13 20:42:19 2013 us=785500 UDPv4 WRITE [14] to X:Y: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Mon May 13 20:42:21 2013 us=30826 UDPv4 WRITE [14] to X:Y: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Mon May 13 20:42:23 2013 us=523224 UDPv4 WRITE [14] to X:Y: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Mon May 13 20:46:13 2013 us=522370 PUSH: Received control message: 'PUSH_REPLY,route 172.16.0.0 255.255.255.0,ping 10,ping-restart 120,route 192.168.1.0 255.255.255.0,dhcp-option WINS 192.168.1.2,ifconfig 172.16.0.2 172.16.0.1'
Mon May 13 20:46:13 2013 us=522508 OPTIONS IMPORT: timers and/or timeouts modified
Mon May 13 20:46:13 2013 us=522551 OPTIONS IMPORT: --ifconfig/up options modified
Mon May 13 20:46:13 2013 us=522591 OPTIONS IMPORT: route options modified
Mon May 13 20:46:13 2013 us=522631 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Mon May 13 20:46:13 2013 us=523732 TUN/TAP device tun0 opened
Mon May 13 20:46:13 2013 us=523859 TUN/TAP TX queue length set to 100
Mon May 13 20:46:13 2013 us=523953 ifconfig tun0 172.16.0.2 pointopoint 172.16.0.1 mtu 1500
Mon May 13 20:46:13 2013 us=532933 route add -net 172.16.0.0 netmask 255.255.255.0 gw 172.16.0.1
Mon May 13 20:46:13 2013 us=539289 route add -net 192.168.1.0 netmask 255.255.255.0 gw 172.16.0.1
Mon May 13 20:46:13 2013 us=546681 Initialization Sequence Completed

janjust

your "diagram" did not work out, I'm afraid.
From looking at your setup however, I've got a few remarks:

* why do you need a certificate based setup for a point-to-point setup? you could do this more easily using shared keys
* the CCD file contains an error: the statement

ifconfig-push 172.16.0.2 172.16.0.1

will not work. Try

ifconfig-push 172.16.0.6 172.16.0.5

instead.

blumman

janjust wroteyour "diagram" did not work out, I'm afraid.

That's weird. It looks fine from both FireFox and Internet Explorer from two different machines. Does it help if I mention that my topology looks like this?

LAN A (192.168.1.0/24)
-> OpenVPN Server (192.168.1.2), TUN0 (172.16.1.1)
-> Router A (192.168.1.1)
-> Internet
<- Router B (192.168.2.1)
<- OpenVPN Client (192.168.2.2), TUN1 (172.16.1.2)
LAN B (192.168.2.0/24)

janjust wrote* why do you need a certificate based setup for a point-to-point setup? you could do this more easily using shared keys

Good question, does it make sense from a security perspective? I intend to add more networks in the future. I'd like to be in control over who can and who cannot connect to the VPN.

janjust wrote* the CCD file contains an error: the statement

I might have misunderstood the following information: http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html
I will only have Linux "clients" connecting (OpenVPN clients and I will have Windows workstations residing in the subnets). Another thing is this piece of information.

--ifconfig-pool-linear
    Modifies the --ifconfig-pool directive to allocate individual TUN interface addresses for clients rather than /30 subnets. NOTE: This option is incompatible with Windows clients.

I remember that the tunnel endpoints between two DD-WRT routers using TUN was 172.16.0.1 and for the remote side 172.16.0.2 so the goal here was to try to re-use that confugration as much as possible. My configuration is a work in progress. My goal is to get it up and running and then afterwards fine tune it.

I'll give your suggestion a try and report back momentarily. Thanks for your response.

blumman

blumman wroteI'll give your suggestion a try and report back momentarily. Thanks for your response.

Weird I could not edit my previous reply.

So I tried your suggestion and the only thing that it did (as far as I could tell) was that instead of having the following scenario:

OpenVPN Server (192.168.1.2), TUN0 (172.16.0.1) <-> OpenVPN Client (192.168.2.2), TUN1 (172.16.0.2)

I got this scenario:

OpenVPN Server (192.168.1.2), TUN0 (172.16.0.1) <-> OpenVPN Client (192.168.2.2), TUN1 (172.16.0.6)

I could still ping 172.16.0.1 and 172.16.0.6. I could also reach the VPN "servers" but no other host residing on either 192.168.1.0/24 or 192.168.2.0/24.

Here is a trace route from a Windows client in LAN A to the remote OpenVPN client in LAN B.

Tracing route to openvpn.client [192.168.2.2] over a maximum of 30 hops:

1 5 ms 9 ms 4 ms some.router [192.168.1.1]
2 4 ms 9 ms 8 ms openvpn.server [192.168.1.2]
3 70 ms 3 ms 9 ms openvpn.client [192.168.2.2]

If I do another trace and this time to a client in the remote LAN B's subnet it looks like this:

Tracing route to 192.168.2.10 over a maximum of 30 hops

1 6 ms <1 ms <1 ms some.router [192.168.1.1]
2 <1 ms 1 ms <1 ms openvpn.server [192.168.1.2]
3 66 ms 5 ms 10 ms openvpn.client [172.16.0.6]
4 * * * Request timed out.
5 * * * Request timed out.

Looks like a routing problem don't you think? Any other suggestions?

janjust

Weird I could not edit my previous reply.

Normal users cannot edit posts - forum rules, I believe.

Instead of 'ifconfig-pool-linear' I'd recomment

topology subnet

If you want to add more networks then stick with a certificate based setup.

Now it looks like a routing issue indeed; remember that the LANs on both sides need to know about each other *AND* about the VPN IP range.

blumman

janjust wroteNormal users cannot edit posts - forum rules, I believe.

Thanks that settles that. 😉

janjust wroteInstead of 'ifconfig-pool-linear' I'd recomment

topology subnet

I have been trying to add that to my config as well because it was used in the DD-WRT config. However, it wasn't accepted by my OpenVPN server installation. Looking at http://openvpn.net/index.php/open-source/documentation/manuals/openvpn-21.html it seems as if this directive wasn't introduced until OpenVPN 2.1.x. That creates a little problem for me as my OpenVPN boxes are Debian Etch NAS installations. Naturally I'm a bit reluctant to try to use a newer version of OpenVPN as I don't know what would happen if I also upgrade the dependencies. It might brake something on the NAS rendering my data useless (in worst case scenario). I don't expect you to know what effect an upgrade might have but I thought I'd ask anyway. The following packages would need to be upgraded if I understand it correctly.

apt-cache depends openvpn
openvpn
 |Depends: debconf
  Depends: <debconf-2.0>
    cdebconf
    debconf
  Depends: libc6
  Depends: liblzo2-2
  Depends: libssl0.9.8
  Suggests: openssl

janjust wroteNow it looks like a routing issue indeed; remember that the LANs on both sides need to know about each other *AND* about the VPN IP range.

Good then I think I will try to focus on that part first. Judging by the tracert's I interpret it as if the routers know the route (due to the static routes?). Based on the last client trace in the previous reply, would you agree with me that this routing issue would be on the OpenVPN boxes? It seems as if after 172.16.0.6 the packets are gone missing. My skill set in troubleshooting this deeper is limited.

Here's a snap of the OpenVPN servers route:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
172.16.0.2      *               255.255.255.255 UH    0      0        0 tun0
192.168.1.0   *               255.255.255.0   U     0      0        0 eth0
192.168.2.0    172.16.0.2      255.255.255.0   UG    0      0        0 tun0
172.16.0.0      172.16.0.2      255.255.255.0   UG    0      0        0 tun0
5.0.0.0         *               255.0.0.0       U     0      0        0 LeafNets
default           192.168.1.1 0.0.0.0         UG    0      0        0 eth0

Here's another one from the OpenVPN client.

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
172.16.0.1      *               255.255.255.255 UH    0      0        0 tun0
192.168.1.0   172.16.0.1      255.255.255.0   UG    0      0        0 tun0
192.168.2.0    *               255.255.255.0   U     0      0        0 eth0
172.16.0.0      172.16.0.1      255.255.255.0   UG    0      0        0 tun0
5.0.0.0         *               255.0.0.0       U     0      0        0 LeafNets
default         192.168.2.1 0.0.0.0         UG    0      0        0 eth0

Correct me if I'm wrong but doesn't this look correct? As far as I can tell the routers knows both the 192.168.x.0/24 subnets and the 172.16.0.0/24 subnet. Same goes for the OpenVPN boxes it seems as if the routes are there. What am I missing?

blumman

I'm sorry for spamming.

I have played around a bit with tcpdump and it seems that the return route is not working.

Pings from the OpenVPN client server in LAN B to clients in LAN A.

21:07:22.481818 IP 172.16.0.2 > openvpn.server: ICMP echo request, id 38758, seq 1, length 64
21:07:22.481880 IP openvpn.server > 172.16.0.2: ICMP echo reply, id 38758, seq 1, length 64
21:07:23.977527 IP 172.16.0.2 > openvpn.server: ICMP echo request, id 38758, seq 2, length 64
21:07:23.977574 IP openvpn.server > 172.16.0.2: ICMP echo reply, id 38758, seq 2, length 64
21:07:24.484518 IP 172.16.0.2 > openvpn.server: ICMP echo request, id 38758, seq 3, length 64

21:07:57.893100 IP 172.16.0.2 > router.a: ICMP echo request, id 42598, seq 1, length 64
21:07:57.893867 IP router.a > 172.16.0.2: ICMP echo reply, id 42598, seq 1, length 64
21:07:58.821053 IP 172.16.0.2 > router.a: ICMP echo request, id 42598, seq 2, length 64
21:07:58.822162 IP router.a > 172.16.0.2: ICMP echo reply, id 42598, seq 2, length 64
21:07:59.822524 IP 172.16.0.2 > router.a: ICMP echo request, id 42598, seq 3, length 64
21:07:59.823524 IP router.a > 172.16.0.2: ICMP echo reply, id 42598, seq 3, length 64

21:08:12.419886 IP 172.16.0.2 > windows.client.a: ICMP echo request, id 45670, seq 1, length 64
21:08:13.373799 IP 172.16.0.2 > windows.client.a: ICMP echo request, id 45670, seq 2, length 64
21:08:14.372679 IP 172.16.0.2 > windows.client.a: ICMP echo request, id 45670, seq 3, length 64
21:08:15.372587 IP 172.16.0.2 > windows.client.a: ICMP echo request, id 45670, seq 4, length 64
21:08:16.373020 IP 172.16.0.2 > windows.client.a: ICMP echo request, id 45670, seq 5, length 64

21:08:34.942556 IP 172.16.0.2 > osx.client.a: ICMP echo request, id 48230, seq 1, length 64
21:08:35.942703 IP 172.16.0.2 > osx.client.a: ICMP echo request, id 48230, seq 2, length 64
21:08:36.941843 IP 172.16.0.2 > osx.client.a: ICMP echo request, id 48230, seq 3, length 64
21:08:37.941566 IP 172.16.0.2 > osx.client.a: ICMP echo request, id 48230, seq 4, length 64
21:08:39.525880 IP 172.16.0.2 > osx.client.a: ICMP echo request, id 48230, seq 5, length 64

I can ping the OpenVPN server and LAN A's router but no other clients. This must be easy to fix I must have forgotten something but I can't figure out what it is.

janjust

Both OpenVPN server and OpenVPN client has IP forwarding enabled.
Code:
cat /etc/sysctl.conf | grep ip_forward
net.ipv4.ip_forward = 1

what does

cat /proc/sys/net/ipv4/ip_forward

give on both client and server ? it may be that the sysctl setting is not picked up (yet).

blumman

OpenVPN Server

cat /proc/sys/net/ipv4/ip_forward
1

OpenVPN Client

cat /proc/sys/net/ipv4/ip_forward
1

I have looked in to the possibility to upgrade to OpenVPN 2.1.3 and that was a dead-end. If I would go ahead and upgrade with all the dependencies I would semi brick the NAS. The only way to revert back is to do a factory reset and then I would loose all my data. It would be foolish to do this.

I find it weird that it doesn't work. This is more or less what I'm trying to do: http://www.smallnetbuilder.com/security/security-howto/30353-how-to-set-up-a-site-to-site-vpn-with-openvpn

They are installing the same version of OpenVPN as I curently run.

dpkg -l | grep openvpn
ii  openvpn                            2.0.9-4etch1             Virtual Private Network daemon

janjust

very strange... this should work in 2.0.9 without any problems too.

On a client PC on one end, e.g. windows.client.a, add a direct route for the VPN subnet and for the "other side LAN":

route add 172.16.0.0 mask 255.255.255.0 192.168.1.x
route add 192.168.2.0 mask 255.255.255.0 192.168.1.x

then from the other LAN, try pinging this PC (swap the 168.1 and .168.2 if necessary, I'm not sure what IP the windows.client.a machine is on).

blumman

janjust,

I would like to thank you for your effort so far. Adding static routes to the Windows client did not improve the situation.

What it did was to shorten the route for the client to the destination i.e. Windows client to OpenVPN client server. Instead of going to router.a, openvpn.server and openvpn.client the hops was shorten from three to two hops. Now a traceroute will show openvpn.server and openvpn.client.

If I ping from the remote openvpn client server to the Windows machine which I just added static routes I still have the same issue. No reply is sent back to the openvpn.client. Same goes for pinging the osx.client.

I even stopped the Windows 7 firewall to see wheter the Windows client was blocking the ICMP's from the other subnet. As for the Mac, the firewall is also turned off.

I have simulated the packet flow by having all the routes present on the screen. As far as I can tell packets should find its way to the destination and also the way back. However from the remote OpenVPN client it cannot locate the destination. But from the destination client I have no problems reaching the OpenVPN client server. It just doesn't make any sense, it's as if either the OpenVPN server or client is somehow blocking the packages.

janjust

hang on - can you check that the CCD file is picked up correctly? this is most easily done by adding a flag

ccd-exclusive

to the server config - if the file is not picked up correctly the client will be refused to connect.
If so, change the directory the client-config-dir to an absolute path and make sure that the full path is readable by the openvpn process.

blumman

janjust wrotehang on - can you check that the CCD file is picked up correctly? this is most easily done by adding a flag

I tried to check this in a slightly different manner before. I commented out the iroute directive. When I did that the OpenVPN server was no longer able to ping the OpenVPN client but the OpenVPN client could do the opposite. Somehow it is picking up the CCD or partially at least.

I'm not entirely sure if I understood you correctly but this is what I did based on your suggestion. I just added this directive without commenting out the CCD from server.conf.

--ccd-exclusive
    Require, as a condition of authentication, that a connecting client has a --client-config-dir file.

While restarting the OpenVPN server I saw the following in the server log.

Sun May 19 11:01:55 2013 us=401099 route del -net 192.168.2.0 netmask 255.255.255.0
SIOCDELRT: Operation not permitted
Sun May 19 11:01:55 2013 us=406209 ERROR: Linux route delete command failed: shell command exited with error status: 7

The tunnel is still up. I can ping from server/remote network, just as before.

Here is how the CCD access looks like.

ls -la
total 40
drwxr-sr-x  6 root  admin 4096 2013-05-16 19:17 .
drwxr-sr-x 72 admin admin 4096 2013-05-16 19:34 ..
drwxr-sr-x  2 root  admin 4096 2013-05-16 19:17 ccd

Here is the client.

ls -la
total 12
drwxr-sr-x 2 root admin 4096 2013-05-16 19:17 .
drwxr-sr-x 6 root admin 4096 2013-05-16 19:17 ..
-rw-r--r-- 1 root admin  151 2013-05-19 10:57 CLIENT01

I tried running OpenVPN under root to see whether it was an access issue but it did not change anything.

I didn't notice this before but the Windows client in the remote subnet is not online today and this is now how it looks while trying to ping it.

 ping 192.168.2.10
PING 192.168.10.100 (192.168.2.10) 56(84) bytes of data.
From 172.16.0.2 icmp_seq=2 Destination Host Unreachable
From 172.16.0.2 icmp_seq=3 Destination Host Unreachable
From 172.16.0.2 icmp_seq=4 Destination Host Unreachable
From 172.16.0.2 icmp_seq=6 Destination Host Unreachable
From 172.16.0.2 icmp_seq=7 Destination Host Unreachable

Do you make any sense of this or did I not do it right?

janjust

it looks like the 'iroute' statement is picked up correctly. Just to verify, add

verb 5

to the server log, restart the server (the ip route warning is harmless) and reconnect the client; the server connection log should show whether the right name was used (capitals ARE important here).

blumman

janjust,

Thanks for your support. I finally found out what the issue was. It was two lines of iptables missing in the routers. If anyone runs in to the same issue they need the following on both routers (with the appropriate subnets).

iptables -A PREROUTING -t mangle -i <ethernet interface> -d <local subnet>/255.255.255.0 -j ROUTE --gw <openvpn server>
iptables -A PREROUTING -t mangle -i <ethernet interface> -d <openvpn subnet>/255.255.255.0 -j ROUTE --gw <openvpn server>

Could you help me label this topic as solved? 🙂

janjust

I would never have thought of this as the solution - good job!
I'll mark it down for my own reference and will set the topic to SOLVED and locked.