No Connection, though connected to VPN

djslimer

Hi there,

i hope, you can help me. I'm not sure, if I'm right here, but maybe you know, what to do, and my tries to search for "routing" "vm" "virtual" "vpn" were ignored because the words were to common (single and combined). So please don't be angry, if there are lots of solution within this forum.

Now I will come to my simple Problem:

- Infrastructure: The internet connection is realized by a cable connection and a FritzBox (FB) Cable. Behind the FB, I have a windows VM host, with several VMs. On a CentOS VM runs my OpenVPN server.
The FB is one DNS, I have another server, which is the DNS for our internal development domains.
IPs:
FB x.x.1.1
DNS2: x.x.1.2
VM Host: x.x.1.3
OpenVPN (eth0): x.x.1.4
OpenVPN (tun0): x.x.2.1
VPN-Clients: x.x.2.0

- Goal: I want to be able, to connect with a PC, Smartphone.... via VPN to get access to my internal infrastructure. So I want to bring single workers from outside to inside (I do not want to connect different locations).

Problem description:
Now, trying to connect to the OpenVPN server works. So, the outter Device gets a connection and an IP from my VPN.
So, an Client get's the IP x.x.2.3

Now, ping to tun0: works. (x.x.2.3 -> x.x.2.1)
Ping to eth0: works. (x.x.2.3 -> x.x.1.4)

but after this, there is great silence.
In my opinion, it is the routing. And this is what I do not know. can you help me? which information do you need?
I played a bit with the routes, but with no effect. this is my current routing table

Destination Gateway       Genmask            Flags Metric Ref Use Iface
x.x.1.4       x.x.2.1         255.255.255.255  UGH   0        0    0    tun0
x.x.2.2       *                255.255.255.255  UH     0        0    0    tun0
x.x.1.0       *                255.255.255.0     U       1        0    0    eth0
x.x.2.0       x.x.1.3         255.255.255.0     UG     0        0    0    eth0
x.x.2.0       x.x.1.1         255.255.255.0     UG     0        0    0    eth0
x.x.2.0       x.x.2.2         255.255.255.0     UG     0        0    0    tun0
default       fritz.box       0.0.0.0              UG      0        0    0    eth0

So, i come to the openVPN, but after this, it stops.
any ideas? any questions?

Thanks so much for help.

cya DJ

maikcat

2 things to check,

make sure you have enabled ip forwarding on openvpn server & you have configured
firewall rules to allow traffic from/to vpn tunnel

add a static route for vpn subnet to your internal servers, i know that your router
"should" route traffic correctly but i have seen many times cheap routers ignoring
static routes... :S

also make sure that firewalls on your servers also allow traffic from vpn subnet as well.

Michael.

djslimer

ip forwarding is enabled, nat masquearding, too.

with static route you think about sth like that?
x.x.2.0 -> x.x.1.2 ?

my FB has a dialog for adding routes.

djslimer

Ahm, what I forgot to mention, I made a test. Our development server are only reachable by url, if the eth interface knows the second DNS x.x.1.2 otherwise, a 404 is thrown.
I was connected within my internal network by LAN (eth0 = x.x.1.12). With the DNS-Entry, I could reach mySite.dev. So I removed the entry, tried to call the mySite.dev, and it runs to the nirvana. Then I connected locally to the VPN, I got an x.x.2.y IP on tun0, tried to connect to mySite.dev and it worked. So, the DNS-Push Option works. The route, I guess, was found by a way to me along my internal IP. May I right?

maikcat

about the static route, it should be like

x.x.2.0 -> x.x.1.4 (packages destined to vpn interface should be forwarded to openvpn server)

it would be good if you posted your configs so anyone who reads (including me)
get a better idea about your setup..

also avoid testing the vpn while in the same lan...
if you push routes to your clients will be easy to mess things up...

if you test openvpn by using a client connecting from internet,what problems
do you have?
if you perform NAT on openvpn server itself , can you post the iptables rule used?

Michael.

djslimer

Sorry, I was away the last days.
Thanks for the hints, I will try.
Here is my server.conf

port 1194
proto udp
dev tun
ca myCA.crt
cert mySERVER.crt
key mySERVER.key 
dh dh1024.pem
server 192.168.2.0 255.255.255.0
push "route 192.168.1.0 255.255.255.0"
push "dhcp-option DNS 192.168.1.2"
push "dhcp-option DNS 192.168.1.1"
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log         openvpn.log
verb 6

Regarding to your questions:
- I only connect to the vpn while in the same lan to test the certificate or to get the dns provided. Both are working, so the connection will be established successfully (both lan and internet) and I get the local dns-server provided (my development server are reachable after beeing connected, not before.)
- push routes to my clients? you mean to set a route manually to one special client? but this exactly is my problem. Routing 😉 I try today to get firm on that topic.
- problem while connecting over internet: by dynDNS I get the publi IP of my router. when establishing the connection, the handshake and everything is ok. the connection is successfully established. All connections on my far away client (e.g. radio livestream) keep alive, I get an IP from the VPN-GW (e.g. x.x.2.3). But I don't get any response from the VPN-GW. Whithin the logfile I can see such error:

Wed Aug 7 18:25:18 2013 us=878235 myCLient/x.x.1.40:62276 MULTI: bad source address from client [fe80::x:x:x:x], packet dropped.

I got the same error with a public IPv4.

Wed Jul 31 17:16:18 2013 us=588533 myCLient/publicIPv4:56758 MULTI: bad source address from client [fe80::x:x:x:x], packet dropped.
Wed Jul 31 17:16:18 2013 us=588574 myCLient/publicIPv4:56758 UDPv4 READ [109] FROM [AF_INET] publicIPv4:56758, P_DATA_V1 kid=0 DATA len=108

- NAT on VPN GW: do you mean this?

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     icmp --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:openvpn 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

maikcat

NAT on VPN GW: do you mean this?

no

use iptables -L -t nat -v

Michael.

djslimer

Chain PREROUTING (policy ACCEPT 527K packets, 140M bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 7539 packets, 542K bytes)
 pkts bytes target     prot opt in     out     source               destination         
   17  1044 MASQUERADE  all  --  any    tun0    anywhere             anywhere            
    0     0 MASQUERADE  all  --  any    eth3    192.168.2.0/24     anywhere            

Chain OUTPUT (policy ACCEPT 7539 packets, 542K bytes)
 pkts bytes target     prot opt in     out     source               destination

maikcat

as long the only thing you want is to access your internal lan client,
please disable ALL NAT related rules...

also

Chain POSTROUTING (policy ACCEPT 7539 packets, 542K bytes)
 pkts bytes target     prot opt in     out     source               destination         
   17  1044 MASQUERADE  all  --  any    tun0    anywhere             anywhere           
    0     0 MASQUERADE  all  --  any    eth3    192.168.2.0/24     anywhere

eth3?!?!?!?!?!

Michael.

djslimer

I have done that:

iptables -t nat -F
iptables -t nat -X

iptables -L -t nat -v show now this

Chain PREROUTING (policy ACCEPT 527K packets, 140M bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 7539 packets, 542K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 7539 packets, 542K bytes)
 pkts bytes target     prot opt in     out     source               destination

yes, my std. ethernet device is eth3. I don't know really why, but may because I had to install a generic network device on the VM to get the LAN Adapter running.

and no, no success. 😉

djslimer

what are about routes within the router?

currently I have there one route: 192.168.2.0 255.255.255.0 192.168.1.4

djslimer

regarding to eth3 and eth0, I did forgot to correct the value before I was hitting the submit button.

originally on my machine it is eth3, for some reason, I do not anymore know I thought, it would be better to rewrite it by using eth0.

maikcat

first a stupid question...

the openvpn server is a VM, right?
if yes are you using bridging for its ethernet?

currently I have there one route: 192.168.2.0 255.255.255.0 192.168.1.4

can you for testing add this static route to a pc inside your lan and try to access it?
sometimes static routes on routers dont work as expected...

Michael.

djslimer

hi,

esp. a great thanks!!!! to maikcat. you tried to help me, and I think, there is sth. what make my solution possible.

after the last trial, I changed sth I thought it is not really important, the result was, that I could get any more any connection. So I decided to start with completely fresh OS. but before I could start, I remind me on ipfire and the openPVN service there. after some problems with the right certificates, I came to the same point I was with openVPN.

The connection was possible, after connecting, it was only possible to connect to my (IPFire) VM. nothing behind.

After this, I did only one thing. I added a route at my router from everything out of my VP-Net to my IPFire/OpenVPN Gateway.
let's say, the IPFire now has the ip x.x.1.5, the VP-Clients came from y.y.5.0

so, in my topology there is now a route on x.x.1.1.: from y.y.5.0 to: x.x.1.5 --- y.y. because actually it is a complete different ip-address-area (e.g. 192.168.1.0 and 10.0.0.0), some would have meant, that the areas should be the same, but indeed, it is completely unimportant (except the fact, that it shouldn't be the same, like 192.168.4.1-120 and 192.168.4.121-254 - openVPN moans on that).

and this was all, and now it works. everything else is the same. so
(Router) ------ [SWITCH] -------- DNS ............... x.x.1.0
|------------- VM-HOST ........ x.x.1.0
| |---------OpenVPN(eth0) - inactive ........ x.x.1.0
| |---------OpenVPN(tun0) - inactive ........ x.x.2.0
| |---------IPFire(eth) ........ x.x.1.0
| |---------IPFire(tun) ........ y.y.y.0
| |--- ...
|------------- local development servers
|--- ...

So, i can't call it a solution, but a proper workaround or bypass.

Thanks again. But, one question my I ask in addition:
Can you give me some hints for some good information on routing (if possible german, english will do), or do you have some short hint, to avoid frustrating traps?

maikcat

Can you give me some hints for some good information on routing (if possible german, english will do), or do you have some short hint, to avoid frustrating traps?

i can provide you a link to a very good book about tcp/ip...

http://shop.oreilly.com/product/9780596002978.do

Regards

Michael.