Unable to access private network

gastan

hi

I was able to "successfully" install and configure OpenVPN on Virtual CentOS 6.4 with public IP.
On XenServer there is also bunch of machines on 192.168.0.* network.
dom0 is using bridged networking and NAT to allow 192.168.0.* VMs to get on internet.
Problem is, I am unable to get/ping on this 192.168.0.* machines via OpenVPN tunnel, presumably, because tunnel is on 10.8.0.* subnet. On pinging I get destination unreachable error from 10.8.0.1 (OpenVPN gateway)

Here is schema of network.
I suppose I just need to add some routes to dom0 or VM1=OpenVPN server to get this working?
Any help would be appreciated

dom0 - XenServer (xenbr0-publicIP1, xenbr0:1-192.168.0.1)
|
+----VM1 - (publicIP2)
| -VPN server (10.8.0.1)
| -reverse HTTP proxy
|
+----VM2 - (192.168.0.2)
| -DHCP server (192.168.0.10-100)
| -Web server - OTRS
|
+----VM3 - (192.168.0.3)
| -Web server - Joomla
|
+----VM4 - (192.168.0.4)
| -Web server - misc
|
+----VDI - vdiib (publicIP3, 192.168.0.7)
| -VDI in the Box
|
+----W7 - (DHCP 192.168.0.100)
| -Win7 dektop -VD image/source
|

--G

maikcat

please post openvpn configs.

Michael.

gastan

sorry, I could not find attach file feature

port 1194
proto udp
dev tun
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
reneg-sec 0
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.0.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 6

maikcat

so you want to route packets from VM1 which has a public ip interface & the vpn
to the 192.168.0.0/24 network to which resides all your VM's.

dom0 has 2 interfaces (1 public & 1 from 192.168.0.0/24 network,

my thought is:

you can enable ip forwarding on dom0 and secure traffic from/to xenbr0/xenbr0:1 using
firewall rules

also you need to add a static route to vm1 for 192.168.0.0/24 network via publicip1 (xenbr0 interface).

if you are using 192.168.0.1 as default gateway for your VM's then you should be ok..

Michael.

gastan

thx for your suggestions

- IP forwarding is already on on dom0
- I will try to add route to 192.168.0.0/24 on VM1 ( via dom0s 192.168.0.1 I suppose)
- dom0s public IP is as gateway on VM1, not private ip

gastan

I have added route to VM1, but no joy:(
(I believe that was also original route)

[root@vm1 ~]# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.8.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
192.168.0.0 46.4.68.52(dom0) 255.255.255.0 UG 0 0 0 eth0
46.4.68.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
169.254.0.0 0.0.0.0 255.255.0.0 U 1002 0 0 eth0
0.0.0.0 46.4.68.52(dom0) 0.0.0.0 UG 0 0 0 eth0

pinging from VPN client (it resolves host, but wont reach it)

C:\Users\gastan>ping radko.sk

Pinging radko.sk [46.229.226.50] with 32 bytes of data:
Reply from 10.8.0.1: Destination host unreachable.
Reply from 10.8.0.1: Destination host unreachable.
Reply from 10.8.0.1: Destination host unreachable.
Reply from 10.8.0.1: Destination host unreachable.

reaching 192.168.0.* network is the main idea
C:\Users\gastan>ping 192.168.0.2
Pinging 192.168.0.2 with 32 bytes of data:
Reply from 10.8.0.1: Destination host unreachable.
Reply from 10.8.0.1: Destination host unreachable.
Reply from 10.8.0.1: Destination host unreachable.

C:\Users\gastan>tracert 192.168.0.2

Tracing route to 192.168.0.2 over a maximum of 30 hops

1 74 ms 74 ms 73 ms 10.8.0.1
2 10.8.0.1 reports: Destination host unreachable.

gastan

this is the weirdes thing (ping from dom0)

ping 10.8.0.1
PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.
From 10.8.0.66 icmp_seq=1 Destination Host Unreachable
From 10.8.0.66 icmp_seq=2 Destination Host Unreachable
From 10.8.0.66 icmp_seq=3 Destination Host Unreachable

I have no clue about 10.8.0.66 IP address

maikcat

is ip forwarding enabled on dom0?

an alternative approach would be to install a vpn client to one of your vms and enable lan-to-lan
connectivity...

Michael.

gastan

yup, IP forwarding is enabled on dom0
but I wonder where 10.8.0.66 IP comes from.
maybe that thing is misconfigured?

I will study docs on net-to-net config, maybe I could install vpn client on VM2 ?

maikcat

dom0 is using bridged networking and NAT to allow 192.168.0.* VMs to get on internet.

how exactly is NAT configured?
everything leaves your xenbr0 is NATed or your eth vms use NAT?

Michael.

gastan

there is this line in iptables
-A POSTROUTING -s 192.168.0.0/255.255.255.0 -o xenbr0 -j MASQUERADE

and
# Controls IP packet forwarding
net.ipv4.ip_forward = 1

in /etc/sysctl.conf

I also figured out what 10.8.0.66 IP was. It was my attempt on ALIAS (just like 192.168.0.1) is alias xenbr0:1

gastan

when I VM2 ping from VM1 (OpenVPN server) I get this weird info:
(dunno if it's relevant or not)
[root@vm1 ~]# ping 192.168.0.2
PING 192.168.0.2 (192.168.0.2) 56(84) bytes of data.
64 bytes from 192.168.0.2: icmp_seq=1 ttl=63 time=10.3 ms
From 46.4.68.52: icmp_seq=2 Redirect Host(New nexthop: 192.168.0.2)