sinaowolabi
Hi!
Please I need some assistance with my OpenVPN setup. I have an OpenVPN server which is not installed on the network router, but on a machine on a management LAN (192.168.2.0), and OpenVPN give clients IPs from the 10.9.0.0 subnet.
The OpenVPN server allows clients to reach several remote networks. The OpenVPN server host (RHEL 6.4 VM) is directly connected to 10.11.0.0 through its network gateway, but I am unable to make the clients I would like to connect to this adjacent subnet.
Please see my server.conf below, how do I allow the clients dialling in to be able to reach networks close by? I added a push and a route in the server.conf for it to allow access to the 10.11.0.0 network, and I can see it pushed in the client logs, but clients still cannot reach it.
dev tun
auth none
local 192.168.2.42
port 443
proto tcp
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
auth MD5
tls-auth tls.key 0
cipher AES-256-CBC
#ifconfig 10.9.0.1 10.9.0.2
server 10.9.0.0 255.255.255.0
route 192.168.2.0 255.255.255.0
push "route 192.168.2.0 255.255.255.0"
route 10.11.0.0 255.255.255.0
push "route 10.11.0.0 255.255.255.0"
route 10.234.249.0 255.255.255.0
push "route 10.234.249.0 255.255.255.0"
route 10.234.35.0 255.255.255.0
push "route 10.234.35.0 255.255.255.0"
verb 3
log-append openvpn.log
client-config-dir ccd
push "dhcp-option DNS 192.168.2.36"
push "dhcp-option DNS 192.168.2.40"
keepalive 10 120
comp-lzo
status openvpn-status.log
duplicate-cn
maikcat
is ip forwarding enabled on server?
can you post the output of sestatus & iptables -L on openvpn server?
Michael.
sinaowolabi
Hi!
SELinux is disabled.
[root@simulator ~]# sestatus
SELinux status: disabled
iptables:
[root@simulator ~]# iptables -L
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere multiport dports ssh,http,81,https,pptp,5666 state NEW,ESTABLISHED
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT icmp -- anywhere anywhere icmp echo-reply
ACCEPT icmp -- anywhere anywhere icmp echo-request
DROP tcp -- anywhere anywhere tcp flags:SYN,ACK/SYN,ACK state NEW
DROP tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE
DROP tcp -- anywhere anywhere tcp flags:FIN,SYN/FIN,SYN
DROP tcp -- anywhere anywhere tcp flags:SYN,RST/SYN,RST
DROP tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,ACK,URG
DROP tcp -- anywhere anywhere tcp flags:FIN,RST/FIN,RST
DROP tcp -- anywhere anywhere tcp flags:FIN,ACK/FIN
DROP tcp -- anywhere anywhere tcp flags:PSH,ACK/PSH
DROP tcp -- anywhere anywhere tcp flags:ACK,URG/URG
tcp -- anywhere anywhere state NEW recent: SET name: DEFAULT side: source
DROP tcp -- anywhere anywhere state NEW recent: UPDATE seconds: 30 hit_count: 10 name: DEFAULT side: source
ACCEPT all -- anywhere anywhere policy match dir in pol ipsec
ACCEPT udp -- anywhere anywhere policy match dir in pol ipsec udp dpt:l2tp
ACCEPT udp -- anywhere anywhere udp dpt:isakmp
ACCEPT udp -- anywhere anywhere udp dpt:ipsec-nat-t
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain FORWARD (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT all -- anywhere 10.9.0.0/24 ctstate NEW
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT all -- 10.9.0.0/24 anywhere ctstate NEW
tcp -- anywhere anywhere state NEW recent: SET name: DEFAULT side: source
DROP tcp -- anywhere anywhere state NEW recent: UPDATE seconds: 30 hit_count: 10 name: DEFAULT side: source
ACCEPT all -- anywhere anywhere policy match dir in pol ipsec
ACCEPT all -- anywhere anywhere state NEW,RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere multiport sports ssh,http,81,https,pptp,5666 state ESTABLISHED
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT icmp -- anywhere anywhere icmp echo-request
ACCEPT icmp -- anywhere anywhere icmp echo-reply
ACCEPT udp -- anywhere anywhere policy match dir out pol ipsec udp spt:l2tp
ACCEPT udp -- anywhere anywhere udp spt:isakmp
ACCEPT udp -- anywhere anywhere udp spt:ipsec-nat-t
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
maikcat
is ip forwarding enabled on server?
sinaowolabi
Sorry about the late reply! !! Yes, IP forwarding IS enabled!
[root@simulator ~]# sysctl -p
net.ipv4.ip_forward = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
maikcat
also post the output of
iptables -L -t nat
then try to disable iptables for testing,
then do a tracert from one of your vpn clients to 10.11 subnet and vice versa
and post the output here..
also a network diagram might help...
Michael.
sinaowolabi
[root@simulator ~]# iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- anywhere anywhere policy match dir out pol none
MASQUERADE all -- 10.9.0.0/24 anywhere
SNAT all -- 10.9.0.0/24 anywhere to:192.168.2.42
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
I disabled iptables and did the traceoute from my client (10.9.0.6) to 10.11.0.32..
traceroute 10.11.0.32
traceroute to 10.11.0.32 (10.11.0.32), 30 hops max, 60 byte packets
1 10.9.0.1 (10.9.0.1) 4541.046 ms 18469.835 ms 18469.883 ms
2 * * *
3 * * *
4 * * *
5 * * *
6 * * *
7 * * *
8 * * *
And from 10.11.0.32 to my client 10.9.0.6...
traceroute 10.9.0.6
traceroute to 10.9.0.6 (10.9.0.6), 30 hops max, 60 byte packets
1 gateway (192.168.2.253) 1.137 ms 1.080 ms 1.040 ms
2 * * *
3 * * *
4 * * *
5 * * *
6 * * *
7 * * *
8 * * *
9 * * *
10 * * *
Regarding a network diagram, I'll see what I can cook up for you real quick.
maikcat
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- anywhere anywhere policy match dir out pol none
MASQUERADE all -- 10.9.0.0/24 anywhere
SNAT all -- 10.9.0.0/24 anywhere to:192.168.2.42
you are perfoming NAT,
NAT invalidates plain routing rules....
Michael.
sinaowolabi
Ok.. but what to do? The openvpn server isnt on the network gateway, but the network gateway connects the openpvpn server to all the other networks that are directly attached to the network gateway. That's why I had to nat.
sinaowolabi
Not entirely certain how to upload a diagram, but I've drawn one and I wish to post.
maikcat
disable firewall rules and post a text based schema of your topology.
Michael.
