No routing between client and server LANs in routed mode

rdamara963

I must be missing something really basic that the VPN is established but there is no routing across the tunnel between client and server LANs. Below is the setup and I appreciate any guidance.

Setup
=====
*Routed (tun) mode
*Client subnet: 10.1.10.0/24. 10.1.10.30 is a host on client LAN. OpenVPN client IP is 10.1.10.18.
*Server subnet: 10.2.10.0/24. 10.2.10.30 is a host on server LAN. OpenVPN server IP is 10.2.10.18.
*VPN subnet: 10.0.200.0/24
*VPN is established

Problem
=======
1) Client can ping host in server LAN(10.2.10.30). However, client host (10.1.10.30) can't ping 10.2.10.30. Default gw on 10.1.10.30 is 10.1.10.18
2) Server can ping VPN subnet IP of client but can't ping any of the LAN IPs including 10.1.10.18

Server Config
==========
proto udp
port 11901
tun-mtu 1500
tun-mtu-extra 64
dev tun0
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/dh2048.pem
server 10.0.200.0 255.255.255.0
ifconfig-pool-persist /etc/openvpn/ipp.txt
push "route 10.2.10.0 255.255.255.0"
client-to-client
client-config-dir client-configs
route 10.1.10.0 255.255.255.0
keepalive 10 120
cipher BF-CBC
max-clients 15
persist-tun
persist-key
verb 5
user nobody
group nobody

Client config
==========
client
remote x.x.x.x
proto udp
port 11901
tun-mtu 1500
tun-mtu-extra 64
dev tun0
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/pa-office.crt
key /etc/openvpn/keys/pa-office.key
keepalive 10 120
cipher BF-CBC
persist-tun
persist-key
verb 5
user nobody
group nobody

Thanks,
Ravi.

maikcat

please post the contents of your ccd file as well...

Michael.

rdamara963

ccd has a file named "pa-office"(name same as client cn) and it has the below one line

iroute 10.1.10.0 255.255.255.0

Also, below are the routing tables

Server
======
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
10.0.200.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
10.2.10.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
10.1.10.0 10.0.200.2 255.255.255.0 UG 0 0 0 tun0
10.0.200.0 10.0.200.2 255.255.255.0 UG 0 0 0 tun0
10.0.0.0 10.2.10.1 255.0.0.0 UG 0 0 0 eth0
0.0.0.0 x.x.x.x 0.0.0.0 UG 0 0 0 eth1

Client
=====
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
10.0.200.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
10.2.10.0 10.0.200.5 255.255.255.0 UG 0 0 0 tun0
10.1.10.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
10.0.200.0 10.0.200.5 255.255.255.0 UG 0 0 0 tun0
0.0.0.0 10.1.10.1 0.0.0.0 UG 0 0 0 eth0

Thanks,
Ravi.

maikcat

is ip forwarding enabled on both openvpn server/client?

any firewall enabled on both server/client?

if you traceroute what it shows?

Michael.

rdamara963

* IP forwarding is enabled on both server and client. Not sure if the issue is because of the following errors.

server
-------
[root@server ~]# sysctl -p | grep net.ipv4.ip_forward
error: "net.bridge.bridge-nf-call-ip6tables" is an unknown key
error: "net.bridge.bridge-nf-call-iptables" is an unknown key
error: "net.bridge.bridge-nf-call-arptables" is an unknown key
net.ipv4.ip_forward = 1

Client
-------
[root@client ~]# sysctl -p | grep net.ipv4.ip_forward
error: "net.bridge.bridge-nf-call-ip6tables" is an unknown key
error: "net.bridge.bridge-nf-call-iptables" is an unknown key
error: "net.bridge.bridge-nf-call-arptables" is an unknown key
net.ipv4.ip_forward = 1

* There were no iptable rules when I first setup OpenVPN. But, I added the below rules to see if it makes any difference

Server
-------
[root@server ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere

Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Client
-------
[root@client ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere

Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

* Traceroute from client eth0 interface (IP: 10.1.10.18) to 10.2.10.30 goes to client router (10.1.10.1) instead of going through the tunnel. I feel I am missing something here as the traffic is not forwarded as I expected. Client has a routing table entry for 10.2.10.0/24 network with tun0 as the outbound interface (please see the kernel routing tables on client and server in my earlier response).

[root@client ~]# traceroute -i eth0 10.2.10.30
traceroute to 10.2.10.30 (10.2.10.30), 30 hops max, 60 byte packets
1 10.1.10.1 (10.1.10.1) 0.579 ms 1.435 ms 1.826 ms
2 * * *
3 * * *
4 * * *
5 * * *
6 * * *

Traceroute from client tun0 interface (10.0.200.6) to 10.2.10.30 is routing to the tunnel as expected.

[root@client ~]# traceroute -i tun0 10.2.10.30
traceroute to 10.2.10.30 (10.2.10.30), 30 hops max, 60 byte packets
1 10.0.200.1 (10.0.200.1) 87.775 ms 87.803 ms 87.855 ms
2 10.2.10.30 (10.2.10.30) 87.877 ms 87.899 ms 87.917 ms
[root@client ~]#

Traceroute from a server side host (10.2.10.30) to 10.1.10.18 stops at server

C:\Users\ravikanth.damaraju>tracert 10.1.10.18

Tracing route to 10.1.10.18 over a maximum of 30 hops

1 7 ms <1 ms <1 ms 10.2.10.18
2 * * * Request timed out.
3 * * * Request timed out.
4 * * * Request timed out.
5 * * * Request timed out.
6 * * * Request timed out.
7

maikcat

hi there,

for start please add this to your ccd file:

ifconfig-push 10.0.200.18 10.0.200.17

reconnect your client and verify that tun0 gets .18 ip

what distro are you using?
are these phisical servers or VMs?

also

iptables -L -t nat -v

shows something?

Micharl

rdamara963

I added "ifconfig-push" line to my ccd file and reconnected the client. Client still has the same old IP address 10.0.200.6.

Both server and client are physical servers running RHEL 6.1.

[root@server]# iptables -L -t nat -v
Chain PREROUTING (policy ACCEPT 15M packets, 3003M bytes)
pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 353 packets, 23738 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 328 packets, 22162 bytes)
pkts bytes target prot opt in out source destination
[root@server]#

[root@client ~]# iptables -L -t nat -v
Chain PREROUTING (policy ACCEPT 112 packets, 13059 bytes)
pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 49 packets, 3676 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 49 packets, 3676 bytes)
pkts bytes target prot opt in out source destination
[root@client ~]#

maikcat

I added "ifconfig-push" line to my ccd file and reconnected the client. Client still has the same old IP address 10.0.200.6.

that means that your client is not using its ccd file...
no ccd file no lan-to-lan...

what is the name of your ccd file?

can you post the output of:

openssl x509 -subject -noout -in yourcert.crt

replace yourcert.crt with your clients cert name...

also use full path to your ccd folder & check permissions on it as well..

Michael.

rdamara963

The ccd file name was correct but owner (root user) had only read access. I granted executable permission for the file and directory and it started working.

Thanks very much for all your help Michael.

-Ravi.