Hello, I am running an OpenVPN tunnel between two sites. Both sites had Linux firewalls with the OpenVPN running directly on them. The tunnel worked perfectly (i.e., machines behind each firewall could reach the machines across the tunnel) At one of the sites ("Site A"), we had to replace the Linux firewall with a Cisco ASA, and I made the Linux firewall a OpenVPN server sitting behind it. The OpenVPN port is being forward to the Linux server from the Cisco. The OpenVPN server at Site A has routing enabled and one IPTables command to masquerade the VPN subnet. I can establish the tunnel no problem. The problems I have having are: * From the Linux firewall at Site B, I can ping across the tunnel and get response from servers and workstations at Site A (that are on the LAN subnet at Site A) * From a workstation or server at Site B, I can ping the IP of the OpneVPN server at Site A, but no workstations or server. A traceroute from Site B to an IP on the LAN at Site A seems to make it to the OpenVPN server at Site A, but goes no further. * From a workstation or server at Site A, I am unable to ping any machine on Site B's LAN Here is the routing table from the OpenVPN server at Site A: [code]Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 192.168.254.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0 192.168.40.0 192.168.254.2 255.255.255.0 UG 0 0 0 tun0 192.168.10.0 0.0.0.0 255.255.254.0 U 0 0 0 eth0.10 0.0.0.0 192.168.10.1 0.0.0.0 UG 0 0 0 eth0.10[/code] In the above, 192.168.254.x is the VPN tunnel; 192,168,254,1 is the IP at Site A and 192.168.254.2 is the IP at Site B. 192.168.40/24 is the LAN subnet at Site B and 192.168.10.0/23 is the LAN subnet at Site A. Here is the routing table from the Linux firewall/OpenVPN endpoint at Site B: [code]Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 192.168.254.1 0.0.0.0 255.255.255.255 UH 0 0 0 tun0 192.168.40.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1 192.168.10.0 192.168.254.1 255.255.254.0 UG 0 0 0 tun0 111.222.128.0 0.0.0.0 255.255.252.0 U 0 0 0 eth0 0.0.0.0 111.222.128.1 0.0.0.0 UG 0 0 0 eth0[/code] In the above, the same applies from Site A, except the 111.222.128.0 subnet is the public IP on the firewall (I changed it for purposes of this post so it was not identifiable) Any ideas? I assume this is a routing issue, but I am not sure if it is something that should be done on the Cisco ASA at Site A, or the Linux OpenVPN server (also at Site A)? Thanks! :-)

[quote="mwandelaar"]What does this rule look like?[/quote] [code]iptables -A POSTROUTING -s 192.168.254.0/24 -j MASQUERADE[/code] I got that from a couple of howtos I came across for configuring an OpenVPN server behind a NAT firewall. It would not work until I put that rule in. -SilkBC

[Solved] SIte-to-Site behind NAT question

SilkBC

Hello,

I am running an OpenVPN tunnel between two sites. Both sites had Linux firewalls with the OpenVPN running directly on them. The tunnel worked perfectly (i.e., machines behind each firewall could reach the machines across the tunnel)

At one of the sites ("Site A"), we had to replace the Linux firewall with a Cisco ASA, and I made the Linux firewall a OpenVPN server sitting behind it. The OpenVPN port is being forward to the Linux server from the Cisco. The OpenVPN server at Site A has routing enabled and one IPTables command to masquerade the VPN subnet.

I can establish the tunnel no problem. The problems I have having are:

* From the Linux firewall at Site B, I can ping across the tunnel and get response from servers and workstations at Site A (that are on the LAN subnet at Site A)
* From a workstation or server at Site B, I can ping the IP of the OpneVPN server at Site A, but no workstations or server. A traceroute from Site B to an IP on the LAN at Site A seems to make it to the OpenVPN server at Site A, but goes no further.
* From a workstation or server at Site A, I am unable to ping any machine on Site B's LAN

Here is the routing table from the OpenVPN server at Site A:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.254.2   0.0.0.0         255.255.255.255 UH    0      0        0 tun0
192.168.40.0    192.168.254.2   255.255.255.0   UG    0      0        0 tun0
192.168.10.0    0.0.0.0         255.255.254.0   U     0      0        0 eth0.10
0.0.0.0         192.168.10.1    0.0.0.0         UG    0      0        0 eth0.10

In the above, 192.168.254.x is the VPN tunnel; 192,168,254,1 is the IP at Site A and 192.168.254.2 is the IP at Site B. 192.168.40/24 is the LAN subnet at Site B and 192.168.10.0/23 is the LAN subnet at Site A.

Here is the routing table from the Linux firewall/OpenVPN endpoint at Site B:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.254.1   0.0.0.0         255.255.255.255 UH    0      0        0 tun0
192.168.40.0    0.0.0.0         255.255.255.0   U     0      0        0 eth1
192.168.10.0    192.168.254.1   255.255.254.0   UG    0      0        0 tun0
111.222.128.0     0.0.0.0         255.255.252.0   U     0      0        0 eth0
0.0.0.0         111.222.128.1     0.0.0.0         UG    0      0        0 eth0

In the above, the same applies from Site A, except the 111.222.128.0 subnet is the public IP on the firewall (I changed it for purposes of this post so it was not identifiable)

Any ideas? I assume this is a routing issue, but I am not sure if it is something that should be done on the Cisco ASA at Site A, or the Linux OpenVPN server (also at Site A)?

Thanks! :-)

SilkBC

debbie10t wrotePresuming your VPN gets connected (IE. no firewalls are interfering) then it is likely that there is a routing issue.

The tunnel does indeed come up. Site A (where the OpenVPN server is located behind the Cisco) is able to ping across it with absolutely no problem. A route needs to be added to the Cisco to direct traffic destined to SIte B to the OpenVPN server, but in testing, I have confirmed that by adding a static route to individual machines at Site A, even they can ping across the tunnel.

The setup is curently like this:

SITE A

LAN Subnet: 192.168.10.0/23
OpenVPN Subnet: 192.168.254.0/24
LAN IP of OpenVPN Server: 192.168.10.15
OpenVPN IP of OpenVPN Server: 192.168.254.1

SITE B

LAN Subnet: 192.168.40.0/24
OpenVPN IP of firewall: 192.168.254.10

Site A situaton is currently:

OpenVPN server is able to ping across the tunnel to machines on Site B's subnet
Machines on Site A's subnet are able to ping machines on Site B's subnet, provided an appropriate route exists directing the traffic to the OpenVPN server (this will be done on the Cisco, but for now I have created them on individual machines as needed)

At Site B, the OpenVPN config is directly on the firewall there. Here is the situation from Site B:

From the firewall, I can ping across the tunnel no problem (i.e., I can ping machines on Site A's subnet)
From a machine on Site B's subnet, I can ping the LAN IP of the OpenVPN server (192.168.10.15)
From a machine on Site B's subnet, I am unable to ping anything on Site A's subnet (192.168.10.0/23)
A traceroute from a machine on Site B's subnet to an IP on Site A's subnet (192.168.10.20) goes two hops: first hop is Site B's firewall IP (192.168.40.1) and the second hop is the OpenVPN Server's VPN IP (192.168.254.1); the rest of the hops time out (there should be three hops, with the final one being the IP I am tracerouting to)
The same traceroute from the firewall goes also has just two hops: the first hop is 192.168.254.1 and the second hop is the IP I am tracerouting to (192.168.10.20)

So traffic from Site B subnet *is* hitting the Open VPN server at Site A, but for some reason, the Open VPN server is not routing it.

(That was a long-winded way of saying I sgree it is a routing problem).

debbie10t wroteAlso, I am guessing that the topology of your network changed due to the introduction of the Cisco ASA but the configuration files you use on the VPN machines did not change.

You are correct about the topology changing, but I believe I have changed the config files appropriately.

debbie10t wroteThe best place to start is to post your configs (without #comments), at least that way we will have some idea of what you are expecting OpenVPN to do .....

I am posting them below. I have masked host names and public IPs where appropriate.

Here is the config from the OpenVPN server at SIte A:

dev tun0
port 1194
local 192.168.10.15

ca keys/site_a/ca.crt
cert keys/site_a/sites.crt
key keys/site_a/sites.key
dh keys/site_a/dh2048.pem
crl-verify keys/site_a/crl.pem
persist-key

server 192.168.254.0 255.255.255.0
ifconfig-pool-persist servers/sites/logs/ipp.txt
status servers/sites/logs/openvpn-status.log
log-append servers/sites/logs/openvpn.log
verb 1
keepalive 10 60

max-clients 10
client-config-dir /etc/openvpn/servers/sites/ccd
comp-lzo

user nobody
group nogroup
mute 0
tls-server
persist-tun
route 192.168.40.0 255.255.255.0
push "route 192.168.10.0 255.255.254.0"
push "route 192.168.40.0 255.255.255.0"
push "dhcp-option DNS 192.168.10.20 192.168.10.23"
push "dhcp-option WINS 192.168.10.20"
push "dhcp-option DOMAIN mydomain.local"

Here is the config from Site B:

client
proto udp
dev tun
ca site_b/ca.crt
dh site_b/dh2048.pem
cert site_b/site_b.crt
key site_b/site_b.key
remote remote.mydomain.com 1194
cipher
user nobody
group nogroup
verb 2
mute 20
comp-lzo
persist-key
persist-tun
float
resolv-retry infinite
ping 15
ping-restart 45
nobind
comp-lzo
persist-key
persist-tun
float
resolv-retry infinite
ping 15
ping-restart 45
nobind
comp-lzo
tls-client
pull

One thing you will notice is that it is configured in a server-client configuration, as opposed to a more "traditional" site-to-site configuration with a shared key. This is because there are other sites that were also connected, and will still need to be, but I am just concentrating on this one site right now to keep things simple. I set them all up in a server-client configuration to keep the number of ports I need to open to a minimum. Also, I have configured this site and the OpenVPN server with the more traditional site-to-site configuration but had the same issue.

There is nothing currently in the "ccd" files.

-SilkBC

mwandelaar

I triggered on this one single line:

The OpenVPN server at Site A has routing enabled and one IPTables command to masquerade the VPN subnet.

What does this rule look like? If it is indeed doing an outbound masquerade, it might mess-up the traffic on it's way back to you, as the response of your traceroute/ping is masqueraded.

Can you try to make this work without the masq-option? All the subnets are unique in your setup so i don't think you need the masquerading anyway.

SilkBC

mwandelaar wroteWhat does this rule look like?

iptables -A POSTROUTING -s 192.168.254.0/24 -j MASQUERADE

I got that from a couple of howtos I came across for configuring an OpenVPN server behind a NAT firewall. It would not work until I put that rule in.

-SilkBC

SilkBC

I guess I have stumped everyone? :-(