[Solved] Routing or config problem??

jruiseco

Hi guys,

This is my first time using openvpn and I can't seem to get the routing right. The client can ping the server and the server's LAN. The server can't access the client's LAN, but can ping the client's virtual interface (tun0), it can't ping the far interface of the client either (10.10.1.1). Also, although the client can ping all machines on the server's LAN, other machines on the client LAN can't ping even the virtual ip of the server.

The network looks like this:

10.100.1.0 --------10.100.3.0-----------10.10.1.0----------------10.10.1.10
Openvpn              Virtual Net        Client network 1          machine on client LAN
10.100.1.1,                                               10.10.1.1,
10.100.3.1                                                10.100.3.12

Routing table on server:
(Public IP)        *             255.255.255.248 U     0      0        0 eth1
10.10.1.0       10.100.3.12      255.255.255.0   UG    0      0        0 tun0
10.100.1.0      *                255.255.255.0   U     0      0        0 eth0
10.100.3.0      *                255.255.255.0   U     0      0        0 tun0
default         ( Public IP)      0.0.0.0    UG    0      0        0 eth1

Routing table on client 1 network gateway (10.10.1.1)
(Public IP)     *                  255.255.255.0   U      0      0        0 eth0
10.10.1.0        *                 255.255.255.0   U     0      0        0 eth1
10.100.1.0      10.100.3.1         255.255.255.0   UG    0      0        0 tun0
10.100.3.0      *                  255.255.255.0   U     0      0        0 tun0
default         (Public IP)         0.0.0.0            UG    0      0        0 eth0

The relevant rules on iptables are:

Server iptables:

Chain INPUT (policy DROP)
 pkts bytes target     prot opt in     out     source               destination     
  136  9000 ACCEPT     all  --  tun0   any     anywhere             anywhere 

Chain FORWARD (policy ACCEPT)
 pkts bytes target     prot opt in     out     source               destination         
    9     756 ACCEPT     all  --  any    tun0    anywhere             anywhere

Client iptables:

Chain INPUT (policy ACCEPT)
 pkts bytes target      prot opt  in     out       source               destination         
 154 12544 ACCEPT     all  --  tun0   any     anywhere             anywhere         

Chain FORWARD (policy ACCEPT 43227 packets, 13M bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  any    any     10.100.3.0/24        10.10.1.0/24

server ~]#ping 10.100.3.12
PING 10.100.3.12 (10.100.3.12) 56(84) bytes of data.
64 bytes from 10.100.3.12: icmp_seq=1 ttl=64 time=8197 ms

the 8197 ms isn't true, it's pinging much faster than that

server ~]#ping 10.10.1.1
PING 10.10.1.1 (10.10.1.1) 56(84) bytes of data.

client ~]# ping 10.100.3.1
PING 10.100.3.1 (10.100.3.1) 56(84) bytes of data.
64 bytes from 10.100.3.1: icmp_seq=1 ttl=64 time=18.1 ms

client ~]# ping 10.100.1.2
PING 10.100.1.2 (10.100.1.2) 56(84) bytes of data.
64 bytes from 10.100.1.2: icmp_seq=1 ttl=127 time=54.5 ms

The relevant config file of the server is as follows (running centos 5 final, rpm is openvpn-2.2.2-1.el5.rf)

local (Public IP)
port 1194 #- port
proto udp #- protocol
comp-lzo
ping 60
ping-restart 300
verb 3
log-append /var/log/openvpn.log
daemon
dev tun
persist-tun
topology subnet
ifconfig-pool-persist ip.txt
persist-key
server 10.100.3.0 255.255.255.0
route 10.10.1.0 255.255.255.0
route 10.100.2.0 255.255.255.0
push "route 10.100.1.0 255.255.255.0"
push "route 10.100.2.0 255.255.255.0"
client-to-client

The relevant config of the client is as follows (client is centos 6, rpm is openvpn-2.3.2-2.el6.i686):

client
dev tun
proto udp
remote ServerPublicIP 1194
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo
ping 60
ping-restart 300
verb 3

Thanks a million in advance.

Joaquin

jruiseco

I upgraded the server to openvpn-2.3.2-2.el5 and added route-gateway 10.100.3.12. The thinking behind it is that the client machine has ip 10.100.3.12 and 10.10.1.1. Since the server has 10.100.3.1 it is in the same subnet as 10.100.3.12 so it should be reachable (and is). However still with this change in the configuration, ping 10.10.1.1 just drops the pings off the face of the earth. 🙁

jruiseco

Nobody can help? I need the client LAN to be able to talk to the server's LAN, or at least to 2 machines on the server LAN. I've really tried everything. When I ping the server LAN from the client machine it pings fine, but when I ping from a different machine on the client LAN, nothing goes through.

jruiseco

The client machines are network routers with 2 NICs. They route internet through their local internet connections and route VPN traffic through tun0. At this point I agree with your comment, it's a problem on the client machines. Here's more info:

[root@client ~]# cat /proc/sys/net/ipv4/ip_forward
1

[root@client ~]# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
(Public IP)     *               255.255.255.0   U     0      0        0 eth0
10.10.1.0       *               255.255.255.0   U     0      0        0 eth1
10.100.1.0      10.100.3.12     255.255.255.0   UG    0      0        0 tun0
10.100.3.0      *               255.255.255.0   U     0      0        0 tun0
default         (Public IP)      0.0.0.0        UG    0      0        0 eth0

[root@client ~]# iptables -vL
Chain INPUT (policy DROP 21959 packets, 9115K bytes)
 pkts bytes target     prot opt in     out     source               destination         
60217   31M ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:ssh 
  884 73816 ACCEPT     all  --  tun0   any     anywhere             anywhere            
66134   31M ACCEPT     all  --  lo     any     anywhere             anywhere            
3775K  239M ACCEPT     all  --  eth1   any     anywhere             anywhere            
14992 3156K ACCEPT     all  --  eth0   any     anywhere             anywhere            state RELATED,ESTABLISHED 

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  488 40480 ACCEPT     all  --  any    tun0    anywhere             anywhere            
    0     0 ACCEPT     all  --  tun0   any     anywhere             anywhere            
1161K   96M ACCEPT     all  --  any    eth0    anywhere             anywhere            
1168K  435M ACCEPT     all  --  any    eth1    anywhere             anywhere

What I can't figure out is why if the client machine is routing (internet is working), and the client machine can ping machines on the server subnet, why can't another machine on the client subnet ping the server's subnet?

jruiseco

Ok issue solved!!!! Thanks!

Several things had to be done to fix my problem:
1) Added a ccd, or client configuration directory, on the server config directory.
2) Added a file for the client machine that needed to be connected with a proper iroute command (iroute 10.10.1.0 255.255.255.0).
3) Added an equivalent route line on the server config (route 10.10.1.0 255.255.255.0)

restarted the server and the server complaints that no gateway was declared (not in the documentation btw).

4) Added a route-gateway line to the server configuration (route-gateway 10.100.3.12).

Which brings up the next question...

I have several subnets that need to be connected to the main server. Is there a way to declare a vpn gateway for each network? For example I need the server network (10.100.1.0/24) to talk to 10.100.2.0/24 through 10.100.3.8, just like 10.100.1.0/24 talks to 10.10.1.0/24 through 10.100.3.0/24.

jruiseco

Got it. The route line in the server.conf can accept a gateway so this did the trick:

route 10.10.1.0 255.255.255.0 10.100.3.12
route 10.100.2.0 255.255.255.0 10.100.3.8

Awesome!