Openvpn connected. However, I cant access LAN

sanldm

I connected successful to the openvpn server. I can remote desktop and ssh the openvpn server by LAN ip (210.10.10.50). However, I can not ping/remotedesktop with other servers in LAN.

This is my configure:
================ server.conf
local 23.25.189.38
port 1723
proto udp
dev tun
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key # This file should be kept secret
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 210.10.10.0 255.255.255.0"
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

================ client.ovpn
client
dev tun
proto udp
remote 23.25.189.38
port 1723
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert sle.crt
key sle.key
ns-cert-type server
comp-lzo
verb 3

======================= client log
Mon Dec 16 15:06:17 2013 OpenVPN 2.3.2 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug 22 2013
Mon Dec 16 15:06:17 2013 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Mon Dec 16 15:06:17 2013 Need hold release from management interface, waiting...
Mon Dec 16 15:06:17 2013 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Mon Dec 16 15:06:18 2013 MANAGEMENT: CMD 'state on'
Mon Dec 16 15:06:18 2013 MANAGEMENT: CMD 'log all on'
Mon Dec 16 15:06:18 2013 MANAGEMENT: CMD 'hold off'
Mon Dec 16 15:06:18 2013 MANAGEMENT: CMD 'hold release'
Mon Dec 16 15:06:18 2013 Socket Buffers: R=[65536->65536] S=[65536->65536]
Mon Dec 16 15:06:18 2013 UDPv4 link local: [undef]
Mon Dec 16 15:06:18 2013 UDPv4 link remote: [AF_INET]23.25.189.38:1723
Mon Dec 16 15:06:18 2013 MANAGEMENT: >STATE:1387224378,WAIT,,,
Mon Dec 16 15:06:18 2013 MANAGEMENT: >STATE:1387224378,AUTH,,,
Mon Dec 16 15:06:18 2013 TLS: Initial packet from [AF_INET]23.25.189.38:1723, sid=5068cedc 69b5c528
Mon Dec 16 15:06:18 2013 VERIFY OK: depth=1, C=US, ST=VA, L=Arlington, O=Solentus, OU=changeme, CN=changeme, name=changeme, emailAddress=sle@solentus.com
Mon Dec 16 15:06:18 2013 VERIFY OK: nsCertType=SERVER
Mon Dec 16 15:06:18 2013 VERIFY OK: depth=0, C=US, ST=VA, L=Arlington, O=Solentus, OU=changeme, CN=server, name=changeme, emailAddress=sle@solentus.com
Mon Dec 16 15:06:19 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Dec 16 15:06:19 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Dec 16 15:06:19 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Dec 16 15:06:19 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Dec 16 15:06:19 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Mon Dec 16 15:06:19 2013 [server] Peer Connection Initiated with [AF_INET]23.25.189.38:1723
Mon Dec 16 15:06:20 2013 MANAGEMENT: >STATE:1387224380,GET_CONFIG,,,
Mon Dec 16 15:06:22 2013 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Mon Dec 16 15:06:22 2013 PUSH: Received control message: 'PUSH_REPLY,route 210.10.10.0 255.255.255.0,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Mon Dec 16 15:06:22 2013 OPTIONS IMPORT: timers and/or timeouts modified
Mon Dec 16 15:06:22 2013 OPTIONS IMPORT: --ifconfig/up options modified
Mon Dec 16 15:06:22 2013 OPTIONS IMPORT: route options modified
Mon Dec 16 15:06:22 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Dec 16 15:06:22 2013 MANAGEMENT: >STATE:1387224382,ASSIGN_IP,,10.8.0.6,
Mon Dec 16 15:06:22 2013 open_tun, tt->ipv6=0
Mon Dec 16 15:06:22 2013 TAP-WIN32 device [Local Area Connection] opened: \\.\Global\{14E88AE1-ABB3-405D-9C71-370CA888F54D}.tap
Mon Dec 16 15:06:22 2013 TAP-Windows Driver Version 9.9
Mon Dec 16 15:06:22 2013 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {14E88AE1-ABB3-405D-9C71-370CA888F54D} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Mon Dec 16 15:06:22 2013 Successful ARP Flush on interface [9] {14E88AE1-ABB3-405D-9C71-370CA888F54D}
Mon Dec 16 15:06:27 2013 TEST ROUTES: 2/2 succeeded len=2 ret=1 a=0 u/d=up
Mon Dec 16 15:06:27 2013 MANAGEMENT: >STATE:1387224387,ADD_ROUTES,,,
Mon Dec 16 15:06:27 2013 C:\Windows\system32\route.exe ADD 210.10.10.0 MASK 255.255.255.0 10.8.0.5
Mon Dec 16 15:06:27 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Mon Dec 16 15:06:27 2013 Route addition via IPAPI succeeded [adaptive]
Mon Dec 16 15:06:27 2013 C:\Windows\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.5
Mon Dec 16 15:06:27 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Mon Dec 16 15:06:27 2013 Route addition via IPAPI succeeded [adaptive]
Mon Dec 16 15:06:27 2013 Initialization Sequence Completed
Mon Dec 16 15:06:27 2013 MANAGEMENT: >STATE:1387224387,CONNECTED,SUCCESS,10.8.0.6,23.25.189.38

================ client route after connecting to openvpn server
Interface List
9...00 ff 14 e8 8a e1 ......TAP-Windows Adapter V9
5...88 53 2e e4 78 01 ......Bluetooth Device (Personal Area Network)
4...84 8f 69 cc ef 63 ......Qualcomm Atheros AR8151 PCI-E Gigabit Ethernet Con
troller (NDIS 6.30)
3...88 53 2e e4 77 fd ......Intel(R) Centrino(R) Advanced-N 6230
1...........................Software Loopback Interface 1
8...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
11...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
28...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 172.20.10.1 172.20.10.3 25
10.8.0.0 255.255.255.0 10.8.0.5 10.8.0.6 30
10.8.0.4 255.255.255.252 On-link 10.8.0.6 286
10.8.0.6 255.255.255.255 On-link 10.8.0.6 286
10.8.0.7 255.255.255.255 On-link 10.8.0.6 286
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
172.20.10.0 255.255.255.240 On-link 172.20.10.3 281
172.20.10.3 255.255.255.255 On-link 172.20.10.3 281
172.20.10.15 255.255.255.255 On-link 172.20.10.3 281
210.10.10.0 255.255.255.0 10.8.0.5 10.8.0.6 30
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.8.0.6 286
224.0.0.0 240.0.0.0 On-link 172.20.10.3 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 10.8.0.6 286
255.255.255.255 255.255.255.255 On-link 172.20.10.3 281
===========================================================================
Persistent Routes:
None

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
8 306 ::/0 On-link
1 306 ::1/128 On-link
8 306 2001::/32 On-link
8 306 2001:0:9d38:90d7:38ef:dc6d:53c7:fcbe/128
On-link
9 286 fe80::/64 On-link
3 281 fe80::/64 On-link
8 306 fe80::/64 On-link
9 286 fe80::2509:e65a:4435:fd25/128
On-link
8 306 fe80::38ef:dc6d:53c7:fcbe/128
On-link
3 281 fe80::7885:4f56:d759:83e9/128
On-link
1 306 ff00::/8 On-link
9 286 ff00::/8 On-link
8 306 ff00::/8 On-link
3 281 ff00::/8 On-link
===========================================================================
Persistent Routes:
None

======================= server log
[root@localhost openvpn]# openvpn server.conf
Mon Dec 16 15:05:05 2013 OpenVPN 2.2.2 x86_64-unknown-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] built on Apr 5 2012
Mon Dec 16 15:05:05 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Dec 16 15:05:05 2013 Diffie-Hellman initialized with 1024 bit key
Mon Dec 16 15:05:05 2013 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Dec 16 15:05:05 2013 Socket Buffers: R=[124928->131072] S=[124928->131072]
Mon Dec 16 15:05:05 2013 ROUTE default_gateway=210.10.10.1
Mon Dec 16 15:05:05 2013 TUN/TAP device tun0 opened
Mon Dec 16 15:05:05 2013 TUN/TAP TX queue length set to 100
Mon Dec 16 15:05:05 2013 /sbin/ip link set dev tun0 up mtu 1500
Mon Dec 16 15:05:05 2013 /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
Mon Dec 16 15:05:05 2013 /sbin/ip route add 10.8.0.0/24 via 10.8.0.2
Mon Dec 16 15:05:05 2013 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Dec 16 15:05:05 2013 UDPv4 link local (bound): 210.10.10.50:1723
Mon Dec 16 15:05:05 2013 UDPv4 link remote: [undef]
Mon Dec 16 15:05:05 2013 MULTI: multi_init called, r=256 v=256
Mon Dec 16 15:05:05 2013 IFCONFIG POOL: base=10.8.0.4 size=62
Mon Dec 16 15:05:05 2013 IFCONFIG POOL LIST
Mon Dec 16 15:05:05 2013 sle,10.8.0.4
Mon Dec 16 15:05:05 2013 osekhar,10.8.0.8
Mon Dec 16 15:05:05 2013 Initialization Sequence Completed
Mon Dec 16 15:06:13 2013 MULTI: multi_create_instance called
Mon Dec 16 15:06:13 2013 172.56.3.65:4464 Re-using SSL/TLS context
Mon Dec 16 15:06:13 2013 172.56.3.65:4464 LZO compression initialized
Mon Dec 16 15:06:13 2013 172.56.3.65:4464 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Dec 16 15:06:13 2013 172.56.3.65:4464 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Dec 16 15:06:13 2013 172.56.3.65:4464 Local Options hash (VER=V4): '530fdded'
Mon Dec 16 15:06:13 2013 172.56.3.65:4464 Expected Remote Options hash (VER=V4): '41690919'
Mon Dec 16 15:06:13 2013 172.56.3.65:4464 TLS: Initial packet from 172.56.3.65:4464, sid=819cfe81 a2856b20
Mon Dec 16 15:06:14 2013 172.56.3.65:4464 VERIFY OK: depth=1, /C=US/ST=VA/L=Arlington/O=Solentus/OU=changeme/CN=changeme/name=changeme/emailAddress=sle@solentus.com
Mon Dec 16 15:06:14 2013 172.56.3.65:4464 VERIFY OK: depth=0, /C=US/ST=VA/L=Arlington/O=Solentus/OU=changeme/CN=sle/name=changeme/emailAddress=sle@solentus.com
Mon Dec 16 15:06:14 2013 172.56.3.65:4464 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Dec 16 15:06:14 2013 172.56.3.65:4464 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Dec 16 15:06:14 2013 172.56.3.65:4464 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Dec 16 15:06:14 2013 172.56.3.65:4464 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Dec 16 15:06:15 2013 172.56.3.65:4464 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Mon Dec 16 15:06:15 2013 172.56.3.65:4464 [sle] Peer Connection Initiated with 172.56.3.65:4464
Mon Dec 16 15:06:15 2013 sle/172.56.3.65:4464 MULTI: Learn: 10.8.0.6 -> sle/172.56.3.65:4464
Mon Dec 16 15:06:15 2013 sle/172.56.3.65:4464 MULTI: primary virtual IP for sle/172.56.3.65:4464: 10.8.0.6
Mon Dec 16 15:06:17 2013 sle/172.56.3.65:4464 PUSH: Received control message: 'PUSH_REQUEST'
Mon Dec 16 15:06:17 2013 sle/172.56.3.65:4464 SENT CONTROL [sle]: 'PUSH_REPLY,route 210.10.10.0 255.255.255.0,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Mon Dec 16 15:06:17 2013 sle/172.56.3.65:4464 IPv6 in tun mode is not supported in OpenVPN 2.2
Mon Dec 16 15:09:36 2013 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)

[root@localhost openvpn]# cat /proc/sys/net/ipv4/ip_forward
1

Thank for you help
Have a good day.

maikcat

post the output of

iptables -L -v
iptables -L -v -t nat

on your openvpn server,

also the other servers ,

in which ip segment they belong?
what default gateway they have?

Michael.

sanldm

I would like to confirm that I disabled firewall in all servers.

=============================OpenVPN Server:
[root@zabbix /]# ifconfig
eth0 Link encap:Ethernet HWaddr F0:4D:A2:EE:24:6B
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
Interrupt:18

eth1 Link encap:Ethernet HWaddr 00:02:B3:21:C9:E8
inet addr:210.10.10.50 Bcast:210.10.10.255 Mask:255.255.255.0
inet6 addr: fe80::202:b3ff:fe21:c9e8/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:320 errors:0 dropped:0 overruns:0 frame:0
TX packets:200 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:38196 (37.3 KiB) TX bytes:20644 (20.1 KiB)

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:32 errors:0 dropped:0 overruns:0 frame:0
TX packets:32 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1961 (1.9 KiB) TX bytes:1961 (1.9 KiB)

=============================================================
[root@zabbix /]# iptables -L -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

======================================================
[root@zabbix /]# iptables -L -v -t nat
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

============================= Server 1:
[root@localhost /]# ifconfig
eth0 Link encap:Ethernet HWaddr 52:54:00:78:B8:19
inet addr:210.10.10.54 Bcast:210.10.10.255 Mask:255.255.255.0
inet6 addr: fe80::5054:ff:fe78:b819/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:256804 errors:0 dropped:0 overruns:0 frame:0
TX packets:35468 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:83958831 (80.0 MiB) TX bytes:11685621 (11.1 MiB)
Interrupt:11 Base address:0xe000

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:23792 errors:0 dropped:0 overruns:0 frame:0
TX packets:23792 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:52102930 (49.6 MiB) TX bytes:52102930 (49.6 MiB)

==============================================================
[root@localhost /]# iptables -L -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
75012 76M ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
1 84 ACCEPT icmp -- any any anywhere anywhere
1083 64980 ACCEPT all -- lo any anywhere anywhere
2 104 ACCEPT tcp -- any any anywhere anywhere state NEW tcp dpt:ssh
0 0 ACCEPT tcp -- any any anywhere anywhere state NEW tcp dpt:vnc-server
18064 1760K REJECT all -- any any anywhere anywhere reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 REJECT all -- any any anywhere anywhere reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT 50130 packets, 13M bytes)
pkts bytes target prot opt in out source destination

========================================================================================
[root@localhost /]# iptables -L -v -t nat
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

sanldm

Nobody has any ideas about this issue??? hixxx.x... please help me

maikcat

you didnt answer to this...

what default gateway they have?

Michael.

sanldm

It is 210.10.10.1

maikcat

210.10.10.1 is not openvpn server,

so, can you add a static route to it regarding the vpn subnet forwarding
packets to your openvpn servers lan ip like

route add -net 10.8.0.0 255.255.255.0 gw 210.10.10.50

Michael.

sanldm

@maikcat
you mean that I need to add this row " route add -net 10.8.0.0 255.255.255.0 gw 210.10.10.50 " into server.conf? I did. However, it does not work. hicc.... the issue is still there.

This is my updated configure:
================ server.conf
local 23.25.189.38
port 1723
proto udp
dev tun
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key # This file should be kept secret
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 210.10.10.0 255.255.255.0"
route add -net 10.8.0.0 255.255.255.0 gw 210.10.10.50
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

maikcat

let me clear things up...

210.10.10.1 is not openvpn server,

so, can you add a static route to it

i was referring to 210.10.10.1 🙂

Michael.