Site-to-Site VPN: Ping to Client fails

nathaniel

I want to make a site-to-site VPN connection and have set up a test environment where i have 4 VMs.

They are connected like this:

--------------------------                          -----------------
|   VM 2                 |                          | VM 3          |
|OVPN-Server             | Network 1                |IP:            |
|eth1: 192.168.177.20----|--------------------------|192.168.177.30 |
|eth1:0: 192.168.179.20  | 192.168.177.0/24         |Gateway:       |
|tun0: 10.0.0.1          |                          |192.168.177.20 |
--------------------------                          -----------------
          | | Internet
          | |
          | | 
          | | Network 2: OpenVPN
          | | 10.0.0.0/24
          | |
          | |
--------------------------                          -----------------
|   VM 1                 |                          | VM 4          |
|OVPN-Client             | Network 3                |               |
|eth2:   192.168.178.10--|--------------------------|192.168.178.40 |
|eth2:0: 192.168.179.10  | 192.168.178.0/24         |Gateway:       |
|tun0: 10.0.0.6 (dhcp)   |                          |192.168.178.10 |
--------------------------                          -----------------

As you can see, each VM only has one interface, for VM2/server and VM1/client those interfaces have multiple IPs.

What should be:
Everyone should be able to ping everyone else.
What is:
VM1: ping to VM2 @ 192.168.177.20 [works]
VM1: ping to VM2 @ 10.0.0.1 [works]
VM1: ping to VM3 @ 192.168.177.30 [fails]
VM3: ping to VM2 @ 192.168.177.20 [works]
VM3: ping to VM2 @ 192.168.179.20 [works]
VM3: ping to VM2 @ 10.0.0.1 [fails]
VM2: ping to VM1 @192.168.179.10 [works]
VM2: ping to VM1 @ 10.0.0.6 [works]
VM2: ping to VM1 @192.168.178.10 [fails]

VM4 is not up yet as it slows down my host machine. I will test the full setup when everything else works.

These are the configuration files:

#server.conf
port 1194
proto udp
dev tun
server 10.0.0.0 255.255.255.0
dh /etc/openvpn/keys/dh1024.pem
ca /etc/openvpn/keys/ca.crt
key /etc/openvpn/keys/server.key
cert /etc/openvpn/keys/server.crt
client-config-dir /etc/openvpn/ccd
keepalive 10 60
route 192.168.178.0 255.255.255.0
push "route 192.168.177.0 255.255.255.0"

#/etc/openvpn/ccd/client
iroute 192.168.178.0 255.255.255.0

#client.conf
port 1194
proto udp
dev tun
client
remote 192.168.179.20
ca /etc/openvpn/keys/ca.crt
key /etc/openvpn/keys/client.key
cert /etc/openvpn/keys/client.crt

If anyone speaks german, I followed this tutorial: http://wiki.openvpn.eu/index.php/Config_ServerNET_ClientNET

Thanks in advance.

nathaniel

I figured it must be a routing problem, everything else works and the logfile looks good too.

I added the gateway in the server.conf, but it didn't help:

#server.conf
port 1194
proto udp
dev tun
server 10.0.0.0 255.255.255.0
[... certs ...]
keepalive 10 60
route 192.168.178.0 255.255.255.0 192.168.178.10
push "route 192.168.177.0 255.255.255.0 192.168.177.20"

Like said, it's still not working (same ping fail as above). I also added "verb 3" for logging and "local..." to get rid of those undefs in the log. OpenVPN version is 2.1, it's the standard packages from the debian6 repository since the VMs are all debian6.

(Why is it that I can't edit my post above? I would change the title to something more routing-like.)

blumman

I know a little bit of German but I wouldn't be able to have a full on conversation in German. 🙂

Did you update your static routes and iptables on both routers?

I think you need to follow the basic forum rules in order to receive professional help. Some information about your configuration is missing such as logs and output of "cat /proc/sys/net/ipv4/ip_forward"

nathaniel

Vielen Dank^^ *

I did not change anything in iptables (It's not mentioned by the tutorial I followed). Network configuration on all VMs is "bridging mode" and /etc/network/interfaces contains static ip-configuration:

auto eth0
iface eth0 inet static
address (see the first post)
netmask 255.255.255.0
gateway (either the ip if vm 1 or 2)

auto eth0:0
iface eth0:0 inet static
... (see above or first post)

I could not find any forum rules ("The following words in your search query were ignored because they are too common words: rules forum").

My /proc/sys/net/ipv4/ip_forward contains "1", however, after each reboot it contains "0". Can I somehow make this permanent (the "1")?

Please tell me if you need more information.

*) Thank you very much

nathaniel

Again, I cannot edit my previous post.

Everything seems to work with VMs 1-3 running. The trick was that when the configuration from the tutorial was done, I restarted the VMs to take snapshots. After restart, the ip_forward was reset to 0. When I manually set it to 1 after bootup, everything works like expected.

Two questions remain:
1) Can I somehow make the ip forward permanent? (/proc/sys/net/ipv4/ip_forward)
2) Can anyone put a [Solved] up there in the thread-title (afterwards)?

nathaniel

Ok, issue solved. Just had to uncomment in file /etc/sysctl.conf the line

net.ipv4.ip_forward = 1

Everything solved. Thread can be closed.

For further information, see http://www.ducea.com/2006/08/01/how-to-enable-ip-forwarding-in-linux/