vincent.diallonort
Hi,
My goal is to create a bridged VPN between a client and an amazon VPC.
But after I create the config I can’t ping a server in the same sub-network than the VPN or even the vpn address (10.0.47.169) i don't know where to look at.Any advice is welcome.
My VPN server is behind a router.So the public address is 54.208.70.198 and the internal ip of the VPN server is 10.0.47.169/255.255.224.0
The router is 10.0.32.1
My configuration is
/etc/sysctl.conf
net.ipv4.ip_forward=1
/etc/network/interfaces
auto lo
iface lo inet loopback
# The primary network interface
auto eth0
auto eth1
iface eth1 inet dhcp
auto br0
iface br0 inet static
address 10.0.47.169
netmask 255.255.224.0
gateway 10.0.32.1
network 10.0.32.0
broadcast 10.0.63.255
bridge_ports eth0
iface eth0 inet manual
up ifconfig $IFACE 0.0.0.0 up
up ip link set $IFACE promisc on
down ip link set $IFACE promisc off
down ifconfig $IFACE down
The the configuration of the VPN server is :
/etc/openvpn.conf
port 1194
proto tcp
dev tap0
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key # This file should be kept secret
dh dh1024.pem
ifconfig-pool-persist ipp.txt
server-bridge 10.0.47.169 255.255.224.0 10.0.47.180 10.0.47.220
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 10.0.32.2"
tls-auth ta.key 0 # This file is secret
comp-lzo
;user nobody
;group nogroup
persist-key
persist-tun
status openvpn-status.log
log openvpn.log
log-append openvpn.log
verb 4
My client is a windows 7 the client config file is :
client
dev tap
dev-node VPNNetwork
proto tcp
remote 54.208.70.198 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca "C:\\vena\\Dropbox\\vena_dba\\AmazonArchitecture\\NAT32-V2\\ca.crt"
cert "C:\\vena\\Dropbox\\vena_dba\\AmazonArchitecture\\NAT32-V2\\vincentlaptop.crt"
key "C:\\vena\\Dropbox\\vena_dba\\AmazonArchitecture\\NAT32-V2\\vincentlaptop.key"
ns-cert-type server
tls-auth "C:\\vena\\Dropbox\\vena_dba\\AmazonArchitecture\\NAT32-V2\\ta.key" 1
comp-lzo
verb 3
When I start the vpn client the connection is fine : VPN add route to windows
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 181.47.100.1 181.47.101.12 20
0.0.0.0 128.0.0.0 10.0.47.169 10.0.47.180 30
0.0.0.0 128.0.0.0 10.0.47.169 181.47.101.12 21
10.0.32.0 255.255.224.0 On-link 10.0.47.180 286
10.0.47.180 255.255.255.255 On-link 10.0.47.180 286
10.0.63.255 255.255.255.255 On-link 10.0.47.180 286
54.208.70.198 255.255.255.255 181.47.100.1 181.47.101.12 20
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
128.0.0.0 128.0.0.0 10.0.47.169 10.0.47.180 30
128.0.0.0 128.0.0.0 10.0.47.169 181.47.101.12 21
181.47.100.0 255.255.252.0 On-link 181.47.101.12 276
181.47.101.12 255.255.255.255 On-link 181.47.101.12 276
181.47.103.255 255.255.255.255 On-link 181.47.101.12 276
192.168.4.103 255.255.255.255 181.47.100.1 181.47.101.12 20
192.168.137.0 255.255.255.0 On-link 192.168.137.1 281
192.168.137.1 255.255.255.255 On-link 192.168.137.1 281
192.168.137.255 255.255.255.255 On-link 192.168.137.1 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.0.47.180 286
224.0.0.0 240.0.0.0 On-link 181.47.101.12 276
224.0.0.0 240.0.0.0 On-link 192.168.137.1 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 10.0.47.180 286
255.255.255.255 255.255.255.255 On-link 181.47.101.12 276
255.255.255.255 255.255.255.255 On-link 192.168.137.1 281
maikcat
hi there,
some things to check...
ifconfig should report both eth0 & tap0 interfaces in PROMISC mode
ip forwarding must be enabled
brctl show should shows eth & tap under br0
you dont need to redirect gateway on your client
Michael.
vincent.diallonort
Hi,
Thanks, so i add the tap0 interface to the bridge after the VPN service start and set eth0 and tap0 with promisc. So now i can ping the vpn private network from my client but i cannot ping another server from the client.
So from the client ping 10.0.47.169 work but not 10.0.33.70
Do you think i mess up with route on the client ?
For the server i thought just by set up the ip forward will be fine but maybe i need to configure more ?
Vincent
maikcat
can you remove redirect-gateway from your server?
ip forwarding is controlled via sysctl , did you applied changes by using sysctl -p?
for testing, can you try to create the bridge/add tap to it manually BEFORE
starting up openvpn?
after that you can use wireshark to see what exactly is happening....
Michael.
vincent.diallonort
Hi,
I remove the redirect gateway from my conf file.
When i try to add the tap0 interface (sudo brctel addif br0 tap0 ) to my bridge before start openvpn i get an error saying that tap0 not exist
Then i tried sudo ifconfig tap0 up i get “tap0: ERROR while getting interface flags: No such device”
So i start the openvpn manually ( i stop it before to all the check look like openvpn start when my machine start)
sudo service openvpn start
Then i set up eth0 and tap0 in promisc mode
sudo ifconfig eth0 promisc up
sudo ifconfig tap0 promisc up
Then i add tap0 to the bridge
sudo brctl addif br0 tap0
Regardig the systctl i changed before the file /etc/sysctl.conf and uncomment this line
net.ipv4.ip_forward=1
So to check i ran sysctl net.ipv4.ip_forward and i give me back
net.ipv4.ip_forward = 1
So it still can ping the vpn server but no other server on the destination network. I guess i gonna find a way to install VPN and remote in to run wireshark and find out.
I was wondering how can i verify if their is some firewall on my linux vpn server ? ( it's an ubuntu)
Thanks a lot
Vincent
maikcat
iptables is the command for adding/removing rules,
you can display your setup by using
iptables -L -v
Michael.
vincent.diallonort
Hi,
I keep going using whireshark and something is weird.
So i use whireshark on the client and start to ping the VPN server 10.0.56.160.
I see packet going throw the virtual interface.
Now i ping another server on the VPN network 10.0.33.70
I see the echo request going throw my internet interface instead of my VPN interface ( so it didn't get any echo reply back)
So i check route on my client but look like correct i have these route who look like okay to me
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 186.19.248.1 186.19.251.102 20
0.0.0.0 0.0.0.0 10.0.32.1 10.0.56.161 286
0.0.0.0 128.0.0.0 10.0.47.169 10.0.56.161 30
0.0.0.0 128.0.0.0 10.0.47.169 186.19.251.102 21
10.0.32.0 255.255.224.0 On-link 10.0.56.161 286
10.0.56.161 255.255.255.255 On-link 10.0.56.161 286
10.0.63.255 255.255.255.255 On-link 10.0.56.161 286
Vincent
