Searching Idea for a Test Setup for Site2Site-Connection

nathaniel

Alternative Title: OpenVPN Test Setup with VMs turned out not to be a good idea

I have two hosted servers rented in a data center which are running a couple of VMs. Both of them have their internal network on something like 192.168.0.*. Both of them are connected to the internet (of course) and the VMs have ports forwarded to the internet such as http on some or ssh on most.

Now I want to connect those two internal networks with an openVPN tunnel. Background is, that one of the VMs is running a LDAP which should be accessed by all others. Because there may be other services shared between both root servers in the future, it's probably easier to handle encryption separately by the vpn and not by each individual application.

To try the configuration in a test scenario, I set up 4 VMs locally on my desktop using VirtualBox (Bridged Mode). There are two subnets, each with two VMs. There is also a third subnet connecting one VM of each subnet.

The problem is, I can ping from VM 3 to VM 4 and the other way around even without the VPN running. There is nothing in the routing tables except the default gateway (tested with "route"). This works as soon as VM 1 and VM 2 are both up. Emptying the arp cache ("ip neigh flush") did not help. So this scenario is certainly not a good idea to test an example configuration. Has anyone a better idea?

--------------------------                          -----------------
|   VM 2                 |                          | VM 3          |
|OVPN-Server             | Network 1                |IP:            |
|eth1: 192.168.177.20----|--------------------------|192.168.177.30 |
|eth1:0: 192.168.179.20  | 192.168.177.0/24         |Gateway:       |
|tun0: 10.0.0.1          |                          |192.168.177.20 |
|Gw: 192.168.177.20      |                          |               |
--------------------------                          -----------------
          | | Internet
          | |
          | | 
          | | Network 2: OpenVPN
          | | 10.0.0.0/24
          | |
          | |
--------------------------                          -----------------
|   VM 1                 |                          | VM 4          |
|OVPN-Client             | Network 3                |               |
|eth2:   192.168.178.10--|--------------------------|192.168.178.40 |
|eth2:0: 192.168.179.10  | 192.168.178.0/24         |Gateway:       |
|tun0: 10.0.0.6 (dhcp)   |                          |192.168.178.10 |
|Gw: 192.168.178.10      |                          |               |
--------------------------                          -----------------

VM1,3 and 4 are running debian6, VM2 is running debian7. VPN is not running for this problem to occur. (See last paragraph above the scheme)

nathaniel

Ok, now i got it. I didn't see you can make more than one internal network (which are completely separated) in virtualbox. Now it looks like this:

--------------------------                          -----------------
|   VM 2                 |                          | VM 3          |
|OVPN-Server             | Internal Network 1       |IP: (eth2)     |
|eth1: 192.168.177.20    |--------------------------|192.168.177.30 |
|eth2: 192.168.56.20     | 192.168.177.0/24         |Gateway:       |
|tun0: 10.0.0.1          |                          |192.168.177.20 |
|Gw:   192.168.177.20    |                          |               |
--------------------------                          -----------------
          | | Host-Only Network: 192.168.56.0/24
          | | Host-IP: 192.168.56.5
          | | DHCP-Server: 192.168.56.100 (not used)
	  	  | | Tunnel: 10.0.0.0/24
          | | The Host can run Wireshark on the Host-Only Interface
          | | to sniff encrypted traffic.
--------------------------                          -----------------
|   VM 1                 |                          | VM 4          |
|OVPN-Client             | Internal Network 3       |IP: (eth3)     |
|eth2: 192.168.178.10    |--------------------------|192.168.178.40 |
|eth3: 192.168.56.10     | 192.168.178.0/24         |Gateway:       |
|tun0: 10.0.0.6 (dhcp)   |                          |192.168.178.10 |
|Gw:   192.168.178.10    |                          |               |
--------------------------                          -----------------

Problem is, routing is not working.

#server.conf
local 192.168.56.20
port 1194
proto udp
dev tun
server 10.0.0.0 255.255.255.0
dh /etc/openvpn/keys/dh1024.pem
ca /etc/openvpn/keys/ca.crt
key /etc/openvpn/keys/server01.key
cert /etc/openvpn/keys/server01.crt
client-config-dir /etc/openvpn/ccd # <- says "iroute 192.168.178.0 255.255.255.0" in /etc/openvpn/ccd/client
keepalive 10 60
route 192.168.178.0 255.255.255.0
push "route 192.168.177.0 255.255.255.0"
verb 3

#client.conf
port 1194
proto udp
dev tun
client
remote 192.168.56.20
ca /root/easyrsa/toclient/ca.crt
key /root/easyrsa/toclient/vpnclient01.key
cert /root/easyrsa/toclient/vpnclient01.crt

A quick look at the routing tables lets me wonder where 10.0.0.2 and 10.0.0.5 came from:

Client (VM1 aka IP ends with 10)
Ziel            Router          Genmask         Flags Metric Ref    Use Iface
10.0.0.5        *               255.255.255.255 UH    0      0        0 tun0 <- ping @ 10.0.0.5 fails from either side
10.0.0.1        10.0.0.5        255.255.255.255 UGH   0      0        0 tun0
192.168.178.0   *               255.255.255.0   U     0      0        0 eth2
192.168.177.0   10.0.0.5        255.255.255.0   UG    0      0        0 tun0 <- this line makes the routing to the sever network
192.168.56.0    *               255.255.255.0   U     0      0        0 eth3
default         192.168.178.10  0.0.0.0         UG    0      0        0 eth2

Server (VM2 aka IP ends with 20)
Ziel            Router          Genmask         Flags Metric Ref    Use Iface
10.0.0.2        *               255.255.255.255 UH    0      0        0 tun0 <- ping @ 10.0.0.2 fails from either side
192.168.178.0   10.0.0.2        255.255.255.0   UG    0      0        0 tun0 <- this line makes the routing to the client network
192.168.179.0   *               255.255.255.0   U     0      0        0 eth1
192.168.177.0   *               255.255.255.0   U     0      0        0 eth1
10.0.0.0        10.0.0.2        255.255.255.0   UG    0      0        0 tun0
192.168.56.0    *               255.255.255.0   U     0      0        0 eth2
default         192.168.177.20  0.0.0.0         UG    0      0        0 eth1

So, what goes wrong here?

nathaniel

The problem was, that the filename of /etc/openvpn/ccd/client did not match the common name of the clients certificate, hence, the iroute command was not executed.

The 10.0.0.2 and 10.0.0.5 come from a ptp connection from openvpn. The ifconfig command shows them not as IP addresses, but as ptp endpoints after the ip address. Since it's working now, i assume the behavior was correct.

janjust

Glad to hear you've worked it out for yourself. And

The 10.0.0.2 and 10.0.0.5 come from a ptp connection from openvpn. The ifconfig command shows them not as IP addresses, but as ptp endpoints after the ip address. Since it's working now, i assume the behavior was correct.

yes this is the normal behaviour.