I have an OpenVPN server on which clients are unable to access server ports on the LAN -- ssh, VNC, and all other LAN services are inaccessible to VPN clients.
I've looked carefully at the server/client config files, routing tables, and logs and don't see anything amiss. Strangely, the server IS able to access ports on the client -- server->client ssh/VNC etc. all work fine. I am also able to ping the server from the client. The firewall is disabled.
I'm at a loss and would appreciate any pointers.
My server is 10.0.1.3 on 10.0.1/24 interface en0. My VPN is on 10.8.0/24 on tun0.
It appears that the VPN is not returning [SYN,ACK] packets correctly from the server to the VPN client over tun0. What would prevent packets from VPN clients reaching the LAN through the tun0 interface? Packets to the VPN client are being returned on en0, not tun0, and this is breaking the connection. This illustrated with this example below using wireshark to capture port 22 packets on tun0 and en0. Here's what I see on wireshark:
server [10.0.1.3]$ ssh mobile@10.8.0.10 # Successful
tun0:
10.8.0.1 -> 10.8.0.10 ssh [SYN]
10.8.0.10 ssh -> 10.8.0.1 [SYN,ACK]
10.8.0.1 -> 10.8.0.10 ssh [ACK]
...
en0:
<No packets>
iPhone [10.8.0.10]$ ssh user@10.0.1.3 # Unsuccessful
tun0:
10.8.0.10 -> 10.0.1.3 ssh [SYN]
10.8.0.10 [TCP Retransmission] -> 10.0.1.3 ssh [SYN]
10.8.0.10 [TCP Retransmission] -> 10.0.1.3 ssh [SYN]
10.8.0.10 [TCP Retransmission] -> 10.0.1.3 ssh [SYN]
10.8.0.10 [TCP Retransmission] -> 10.0.1.3 ssh [SYN]
...
en0:
10.0.1.3 ssh -> 10.8.0.10 [SYN,ACK]
10.0.1.3 [TCP Retransmission] ssh -> 10.8.0.10 [SYN,ACK]
10.0.1.3 [TCP Retransmission] ssh -> 10.8.0.10 [SYN,ACK]
10.0.1.3 [TCP Retransmission] ssh -> 10.8.0.10 [SYN,ACK]
10.0.1.3 [TCP Retransmission] ssh -> 10.8.0.10 [SYN,ACK]
10.0.1.3 [TCP Retransmission] ssh -> 10.8.0.10 [SYN,ACK]
...
My routing tables look this this, and I can't see why this would cause problem:
server$ netstat -rn
Routing tables
Internet:
Destination Gateway Flags Refs Use Netif Expire
default 10.0.1.1 UGSc 539 42402 en0
10.0.1/24 link#4 UCS 9 0 en0
10.0.1.1 xx:xx:xx:xx:xx:xx UHLWIir 542 49727 en0 367
10.0.1.2 xx:xx:xx:xx:xx:xx UHLWI 0 1 en0 1175
10.0.1.3 127.0.0.1 UHS 40 813870 lo0
10.0.1.100 link#4 UHLWIi 4 8432 en0
10.0.1.255 ff:ff:ff:ff:ff:ff UHLWbI 0 3 en0
10.8/24 10.8.0.2 UGSc 1 28 tun0
10.8.0.2 10.8.0.1 UH 3 0 tun0
67.215.65.132/32 10.8.0.2 UGSc 0 0 tun0
127 127.0.0.1 UCS 0 0 lo0
127.0.0.1 127.0.0.1 UH 49 10089384 lo0
169.254 link#4 UCS 4 0 en0
My server.ovpn file is this:
local 10.0.1.3
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
tls-auth ta.key 0
dh dh4096.pem
server 10.8.0.0 255.255.255.0
route 10.0.1.0/255.255.255.0
route 10.8.0.0/255.255.255.0
push "route 10.0.1.0/255.255.255.0"
push "route 10.8.0.0/255.255.255.0"
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
client-to-client
keepalive 10 120
comp-lzo
max-clients 10
user nobody
group nobody
persist-key
persist-tun
ifconfig-pool-persist ipp.txt
verb 3
My client config is this:
client
dev tun
proto udp
remote server.domainname.com 1194
redirect-gateway def1
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert iPhone-cert.crt
key iPhone-cert.key
ns-cert-type server
tls-auth ta.key 1
tls-remote server-domainname
tls-cipher DHE-RSA-AES256-SHA
comp-lzo
Furthermore, if I enable the server firewall with a NAT on 10.0.1.3 from { 10.0.1/24 10.8.0/24 } to any, I
AM able to ssh/VNC etc. into other machines on the 10.0.1/24 network, except for for the server at 10.0.1.3.
Only access to services on the server itself at 10.0.1.3 is broken.
