farDarkMist
Hi
I'm using openvpn to connect multiple clients to certain ip addresses on some servers trought their private ip adresses.
I installed OpenVPN with a routed interface (tun0) into a server with a public IP + 3 private IP networks. I pushed successfully the routes into the clients, authenticated all right, added on the server the iptables rules to do SNAT to the internal networks. And everything seems ok, Except for one thing: The client that generates a TCP request is unable to accept the response from remote servers (on any linux/windows client happens).
Let me dump the info:
[openvnc client addr: 10.10.10.6] [openvpn server addr: 10.10.10.253]
[REMOTE-HOST: network: 192.168.0.0/24, 172.16.0.0/24, openvpn-network:10.10.10.0/24]
No Source Destination Protocol Lenght hw_src_addr hw_dst_addr src_port dst_port
1 10.10.10.6 192.168.0.68 TCP 60 N/A N/A 57211 22
2 192.168.0.68 10.10.10.6 TCP 60 N/A N/A 22 57211
3 10.10.10.6 192.168.0.68 TCP 52 N/A N/A 57211 22
4 192.168.0.68 10.10.10.6 SSH 73 N/A N/A 22 57211
5 10.10.10.6 192.168.0.68 ICMP 101 N/A N/A 22 57211
6 192.168.0.68 10.10.10.6 SSH 73 N/A N/A 22 57211
client sends the SYN from a dynamic port (57211) to a remote well known port (22)
server responds SYN+ACK from the well known port 22 client responds ACK establishing the 3 way handshake
server starts ssh protocol information from port 22 as the connection is in ESTABLISHED state client sends a icmp telling the server that the port is unreacheable ( like the server tried to start the connection )
Anyone could get me some pointers please?
[Server]
port 1194
proto tcp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh2048.pem
server 10.10.10.0 255.255.255.0
ifconfig-pool-persist /etc/openvpn/keys/ipp.txt
push "route 192.168.0.0 255.255.255.0"
push "route 172.16.0.0 255.255.255.0"
keepalive 10 120
cipher BF-CBC # Blowfish (default)
cipher AES-128-CBC # AES
comp-lzo
persist-key
persist-tun
verb 3
plugin /usr/local/lib/openvpn-auth-ldap.so "/etc/openvpn/ldap.conf"
[Client]
client
dev tun0
proto tcp
remote my-remote-server.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/keys/amx-ca.crt
ns-cert-type server
comp-lzo
verb 3
cert /etc/openvpn/keys/x-do.crt
key /etc/openvpn/keys/x.do.key
cipher BF-CBC # Blowfish (default)
cipher AES-128-CBC # AES
auth-user-pass
Thank you for the help!
