adding server's LAN route to client: HOW?

KBerger

Hi, everyone.

It's been sometime since I installed my openvpn server and clients. It was configured to add VPN server's local LAN (192.168.0.0/24) route to the client, in addition to the VPN server network (10.0.0.0).
So, in my ccd/client3, for example, it says:

ifconfig-push 10.0.0.9 10.0.0.10
iroute 192.168.0.0 255.255.255.224

while in server.conf it says:

server 10.0.0.0 255.255.255.0
route 192.168.0.0 255.255.255.224

Now what I expected was, once connected client3 machine, the server's LAN 192.168.0.0/24 would became available via 10.0.0.1. But now it doesn't, so I have to manually add route on client3 machine and THEN it works.

In the server log there is:

Sun Dec 15 01:50:40 2013 client3/188.32.0.91:39893 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/client3
Sun Dec 15 01:50:40 2013 client3/188.32.0.91:39893 MULTI: Learn: 10.0.0.9 -> client3/188.32.0.91:39893
Sun Dec 15 01:50:40 2013 client3/188.32.0.91:39893 MULTI: primary virtual IP for client3/188.32.0.91:39893: 10.0.0.9
Sun Dec 15 01:50:40 2013 client3/188.32.0.91:39893 MULTI: internal route 192.168.0.0/27 -> client3/188.32.0.91:39893
Sun Dec 15 01:50:40 2013 client3/188.32.0.91:39893 MULTI: Learn: 192.168.0.0/27 -> client3/188.32.0.91:39893
Sun Dec 15 01:50:43 2013 client3/188.32.0.91:39893 PUSH: Received control message: 'PUSH_REQUEST'
Sun Dec 15 01:50:43 2013 client3/188.32.0.91:39893 SENT CONTROL [client3]: 'PUSH_REPLY,route 10.0.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.0.0.9 10.0.0.10' (status=1)

But on the client side there is only:

Sat Dec 14 22:26:22 2013 /sbin/route add -net 10.0.0.1 10.0.0.10 255.255.255.255

as much as adding routes is concerned, which is the VPN connection network.

What's the right way to "push" to client that additional route?
Or should it be done by local post-connect (custom) scripts?

Great thanks for everyone's help 🙂

KBerger

Thanks for your reply 🙂

The option --topology subnet (whether used on both sides or server-only) doesnt' work at all: now I cannot connect even to the server.
The order of the given addresses I have fixed, it must have been a "typo" since for other clients it was the way you say.

My client.conf so far:

client
dev tun
port 22345
proto udp
remote 82.198.182.82 22345
;resolv-retry infinite

# Most clients don't need to bind to
# a specific local port number.
nobind

# Downgrade privileges after initialization (non-Windows only)
;user nobody
;group nogroup

# Try to preserve some state across restarts.
persist-key
persist-tun

# SSL/TLS parms.
# See the server config file for more
# description.  It's best to use
# a separate .crt/.key file pair
# for each client.  A single ca
# file can be used for all clients.
ca /usr/local/etc/openvpn/keys/ca.crt
cert /usr/local/etc/openvpn/keys/client3.crt
key /usr/local/etc/openvpn/keys/client3.key
tls-auth /usr/local/etc/openvpn/ta.key 1

remote-cert-tls server

# If a tls-auth key is used on the server
# then every client must also have the key.

# Select a cryptographic cipher.
# If the cipher option is used on the server
# then you must also specify it here.
;cipher x

# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
comp-lzo

# Set log file verbosity.
verb 3

# Silence repeating messages
;mute 20

Will post server.conf once I get to the office, for the link is lost now 😉.

Other info: the server is Linux Fedora 12, the client is FreeBSD 9.2.
I may be mistaken, but it seems to me the thing used to work before... cause this openvpn setup on the server was done some 2 years ago. Back then I had questions on how to connect to the remote SMB share... Now I pretty much know all the ways how to do that (smbclient is a powerful tool, indeed), but now this routing little problem -- that the server's LAN isn't added automatically.

maikcat

Now what I expected was, once connected client3 machine, the server's LAN 192.168.0.0/24 would became available via 10.0.0.1. But now it doesn't, so I have to manually add route on client3 machine and THEN it works.

your iroute file

ifconfig-push 10.0.0.9 10.0.0.10
iroute 192.168.0.0 255.255.255.224

which network do you want to access: 192.168.0.0/24 or 192.168.168.0.0/27?

Michael.

KBerger

maikcat wrote which network do you want to access: 192.168.0.0/24 or 192.168.168.0.0/27?

Sure, it is 192.168.0.0/27, thanks for the correction 🙂. That's what shows up in the log, but it never gets added on the client side. And so it says in the logs:"NOT adding 192.186.0.0/27". So I was just wandering why "not adding" it when I explicitly mentioned to add it.

KBerger

debbie10t wrote
KBerger wrote...
Post ALL CURRENT MATCHING (IE. the ones you actually use) configs (Without Comments) And Logs please.

Right, I'll add them -- as soon as I get to the office, as the connection is lost after having added the "--topology ..." option to the server's startup script 😉.

KBerger

OK, here is my server.conf:

local 82.198.182.82
port 22345
proto udp
dev tun0
;tls-server
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key  # This file should be kept secret
dh /etc/openvpn/keys/dh1024.pem
tls-auth /etc/openvpn/ta.key 0
server 10.0.0.0 255.255.255.0
route 192.168.0.0 255.255.255.224
;push "route 192.168.0.0 255.255.255.224"
client-config-dir /etc/openvpn/ccd
keepalive 10 120
comp-lzo
max-clients 3
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log         openvpn.log
log-append  openvpn.log
verb 3

The "route" and "push route" directives for 192.168.0.0/27 were tried alternatively to achieve my goal. The above is my present form of server.config.

maikcat

iroute directive combined with route inside server.conf is for server side pcs
access the network behind specific vpn client...

if you simply want your client to access server lan you ONLY need to push the necessary
route (for your server lan) to your client...

also you MUST enable ip forwarding on your server and configure its firewall (if any) accordingly
to allow traffic.

Michael.

KBerger

So do you mean I only need

KBerger wrote push "route 192.168.0.0 255.255.255.224"

in server.conf? And no routing directives in client configs on server side, right?

maikcat

yeap....

your clients should pick this route from server.

Michael.

KBerger

Yes, it works!!

Thanks a lot maikcat and thanks a lot to everyone on this forum for the nice job you're doing 🙂.
So this is why it stopped working for me at some point: I added this iroute directive to the server-side client config, don't remember why.