Unable to ping remote network from server network

ravim

Hi: I am a beginner. I have two DDWRT routers I am trying to setup site to site openvpn. Connection is established and I can ping the server network PCs (192.168.2.*) from the client network PC (192.168.76.*). I can ping the remote tunnel IP (10.0.125.2) from server network (192.168.2.*), but I cannot ping any clients behind the client router (192.168.76.*). Below is the configuration. I will try to upload a picture of my network. I have tried adding a route to the client network on server (route add -net 192.168.76.0 netmask 255.255.255.0 gw 10.0.125.2), still can't ping. Can someone help?

When I look at the traffic on server tunnel (tun0) using tcpdump, I see the ICMP echo going to 192.168.76.*, but tcpdump on client router tunnel interface (tun1) doesn't show the the ICMP echo traffic.

Server openvpn.conf

dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
key /tmp/openvpn/key.pem
cert /tmp/openvpn/cert.pem
client-config-dir /tmp/openvpn/ccd
push "route 192.168.2.0 255.255.255.0"
server 10.0.125.0 255.255.255.0
topology subnet
dev tun
proto udp
keepalive 10 120
tls-server
comp-lzo
daemon
client-to-client
verb 3
status /tmp/openvpn/openvpn.log
script-security 2
route 192.168.76.0 255.255.255.0

Server Firewall

iptables -I INPUT -p udp --dport 1194 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT 
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT 
iptables -A INPUT -i tun+ -j ACCEPT
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

Client

ca /tmp/openvpncl/ca.crt
cert /tmp/openvpncl/client.crt
key /tmp/openvpncl/client.key
management 127.0.0.1 16
management-log-cache 100
verb 3
mute 3
syslog
writepid /var/run/openvpncl.pid
client
resolv-retry infinite
nobind
persist-key
persist-tun
script-security 2
dev tun1
proto udp
cipher bf-cbc
auth sha1
remote xxxxxx 1194
comp-lzo yes
tls-client
tun-mtu 1500
mtu-disc yes
fast-io
tun-ipv6
log /var/log/openvpn.log

Client Firewall

iptables -I INPUT -p udp --dport 1194 -j ACCEPT
iptables -I FORWARD -i br0 -o tun1 -j ACCEPT 
iptables -I FORWARD -i tun1 -o br0 -j ACCEPT 
iptables -A INPUT -i tun+ -j ACCEPT
iptables -t nat -A POSTROUTING -o tun1 -j MASQUERADE

When I restart the server router, I see the following in the logs

Aug  5 19:46:47 em-fw openvpn[9619]: OpenVPN 2.3.0 mips-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Mar 25 2013
Aug  5 19:46:47 em-fw openvpn[9619]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Aug  5 19:46:48 em-fw openvpn[9619]: Diffie-Hellman initialized with 1024 bit key
Aug  5 19:46:48 em-fw openvpn[9619]: Socket Buffers: R=[163840->131072] S=[163840->131072]
Aug  5 19:46:48 em-fw openvpn[9619]: ROUTE_GATEWAY X.X.X.X/255.255.252.0 IFACE=vlan2 HWADDR=10:6f:3f:da:59:a9
Aug  5 19:46:48 em-fw openvpn[9619]: OpenVPN ROUTE: OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options
Aug  5 19:46:48 em-fw openvpn[9619]: OpenVPN ROUTE: failed to parse/resolve route for host/network: 192.168.76.0
Aug  5 19:46:48 em-fw openvpn[9619]: TUN/TAP device tun0 opened
Aug  5 19:46:48 em-fw openvpn[9619]: TUN/TAP TX queue length set to 100
Aug  5 19:46:48 em-fw openvpn[9619]: do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Aug  5 19:46:48 em-fw openvpn[9619]: /sbin/ifconfig tun0 10.0.125.1 netmask 255.255.255.0 mtu 1500 broadcast 10.0.125.255
Aug  5 19:46:48 em-fw openvpn[9629]: UDPv4 link local (bound): [undef]
Aug  5 19:46:48 em-fw openvpn[9629]: UDPv4 link remote: [undef]
Aug  5 19:46:48 em-fw openvpn[9629]: MULTI: multi_init called, r=256 v=256
Aug  5 19:46:48 em-fw openvpn[9629]: IFCONFIG POOL: base=10.0.125.2 size=252, ipv6=0
Aug  5 19:46:48 em-fw openvpn[9629]: Initialization Sequence Completed
Aug  5 19:48:34 em-fw openvpn[9629]: X.X.X.X(client IP):50057 TLS: Initial packet from [AF_INET]X.X.X.X(client IP):50057, sid=90a76e66 e2a0da70
Aug  5 19:48:35 em-fw openvpn[9629]: X.X.X.X(client IP):50057 VERIFY OK: depth=1, C=US, ST=VA, L=Fairfax, O=eManage, OU=changeme, CN=OpenVPN-CA, name=changeme, emailAddress=xxx@gmail.com
Aug  5 19:48:35 em-fw openvpn[9629]: X.X.X.X(client IP):50057 VERIFY OK: depth=0, C=US, ST=VA, L=Fairfax, O=eManage, OU=changeme, CN=ark_router, name=changeme, emailAddress=xxx@gmail.com
Aug  5 19:48:35 em-fw openvpn[9629]: X.X.X.X(client IP):50057 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Aug  5 19:48:35 em-fw openvpn[9629]: X.X.X.X(client IP):50057 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Aug  5 19:48:35 em-fw openvpn[9629]: X.X.X.X(client IP):50057 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Aug  5 19:48:35 em-fw openvpn[9629]: X.X.X.X(client IP):50057 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Aug  5 19:48:35 em-fw openvpn[9629]: X.X.X.X(client IP):50057 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Aug  5 19:48:35 em-fw openvpn[9629]: X.X.X.X(client IP):50057 [ark_router] Peer Connection Initiated with [AF_INET]162.17.198.177:50057
Aug  5 19:48:35 em-fw openvpn[9629]: ark_router/X.X.X.X(client IP):50057 MULTI_sva: pool returned IPv4=10.0.125.2, IPv6=(Not enabled)
Aug  5 19:48:35 em-fw openvpn[9629]: ark_router/X.X.X.X(client IP):50057 MULTI: Learn: 10.0.125.2 -> ark_router/X.X.X.X(client IP):50057
Aug  5 19:48:35 em-fw openvpn[9629]: ark_router/X.X.X.X(client IP):50057 MULTI: primary virtual IP for ark_router/X.X.X.X(client IP):50057: 10.0.125.2
Aug  5 19:48:37 em-fw openvpn[9629]: ark_router/X.X.X.X(client IP):50057 PUSH: Received control message: 'PUSH_REQUEST'
Aug  5 19:48:37 em-fw openvpn[9629]: ark_router/X.X.X.X(client IP):50057 send_push_reply(): safe_cap=940
Aug  5 19:48:37 em-fw openvpn[9629]: ark_router/X.X.X.X(client IP):50057 SENT CONTROL [ark_router]: 'PUSH_REPLY,route 192.168.2.0 255.255.255.0,route-gateway 10.0.125.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.0.125.2 255.255.255.0' (status=1)

In the above log, it seems to be creating a route before the VPN is up and running.
Aug 5 19:46:48 em-fw openvpn[9619]: OpenVPN ROUTE: OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options
Aug 5 19:46:48 em-fw openvpn[9619]: OpenVPN ROUTE: failed to parse/resolve route for host/network: 192.168.76.0

maikcat

hi there,

first remove

topology subnet

from your server config,
also you need to create a ccd file named client with the following contents

iroute 192.168.76.0 255.255.255.0

Michael.

ravim

Michael: thanks. I have created the server config using the GUI on the router. I donot see a way for me to create the file in the ccd dir from the GUI. If I add

echo "iroute 192.168.76.0 255.255.255.0" > /tmp/openvpn/ccd/ark_router

to Administration->Commands->Startup, how do I ensure this command runs after the openvpn server is started so the /tmp/openvpn/ccd exists? Or is there a different way to create this file?

Ravi

maikcat wrotehi there,

first remove

topology subnet

from your server config,
also you need to create a ccd file named client with the following contents

iroute 192.168.76.0 255.255.255.0

Michael.

maikcat

sorry but i never use ddwrt for openvpn server.... 🙁

is there a server you can use for the openvpn service?

Michael.

biggs

ravim, I'm sure that your DDWRT router has SSH server built-in, so use it for create and modify files etc.