Yello,
I'm trying to get a VPN network setup between our two web based servers, and our telemetry outstations which have IP Cameras on there local networks that one of the servers needs direct access to as it's running a CCTV services. The setup I'm trying to get to work looks a bit like this:
The test system I'm trying to setup has both servers, with the Master Server being the host and running on Linux with the rest of our database software for the telemetry system. The CCTV server is running Windows Server 2012 and is currently configured as a client, and I have one telemetry unit which also runs linux as a vpn client with a single IP camera behind it, the telemetry unit connects to the internet and then the server by way of a 3G modem. Currently every device can ping the master server, and the master server can ping every device (including the IP camera) but the CCTV server can't ping the telemetry unit or the IP camera.
The linux server and telemetry unit have net.ipv4.ip_forward set to 1.
The windows system has IPEnableRouter set to 1.
iptables has been fushed on both the server and the unit.
Firewall is disabled on the windows server.
Any advice on what I'm missing or what needs changing to get all the devices to be able to contact each other, or is there just a better way to setup what I'm trying to do, IE would it be better to have a pair of VPNs with the units connecting to both servers, as the server don't need to directly talk to each other.
Master Server, Linux VPN Server:
server.conf
mode server
tls-server
#local 192.168.1.151 ## ip/hostname of server
local myserver.com
port 1194 ## default openvpn port
proto udp
#bridging directive
dev tap ## If you need multiple tap devices, add them here
persist-key
persist-tun
#certificates and encryption
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh1024.pem
tls-auth ta.key 0 # This file is secret
duplicate-cn
cipher BF-CBC # Blowfish (default)
comp-lzo
#DHCP Information
ifconfig-pool-persist ipp.txt
server 10.0.0.0 255.255.0.0
push "route 10.0.0.0 255.255.0.0"
route 10.0.0.0 255.255.0.0 10.0.0.1
;push "dhcp-option DNS your.dns.ip.here"
;push "dhcp-option DOMAIN yourdomain.com"
max-clients 200 ## set this to the max number of clients that should be connected at a time
#log and security
user nobody
group nogroup
keepalive 10 120
status openvpn-status.log
verb 3
route, first 2 lines are the servers ip internet ip and it's route so I've removed them.
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
?.?.?.? ?.?.?.? 255.255.255.224 UG 0 0 0 eth0
?.?.?.? * 255.255.255.224 U 0 0 0 eth0
10.0.0.0 10.0.0.1 255.255.0.0 UG 0 0 0 tap0
10.0.0.0 * 255.255.0.0 U 0 0 0 tap0
default static.161.31.9 0.0.0.0 UG 0 0 0 eth0
CCTV Server, Windows VPN Client:
client.ovpn
### Client configuration file for OpenVPN
# Specify that this is a client
client
# Bridge device setting
dev tap
# Host name and port for the server (default port is 1194)
# note: replace with the correct values your server set up
remote myserver.com 1194
push "route 10.0.0.0 255.255.0.0"
route 10.0.0.0 255.255.0.0 10.0.0.1
# Client does not need to bind to a specific local port
nobind
# Keep trying to resolve the host name of OpenVPN server.
## The windows GUI seems to dislike the following rule.
##You may need to comment it out.
resolv-retry infinite
# Preserve state across restarts
persist-key
persist-tun
# SSL/TLS parameters - files created previously
ca ca.crt
cert client.crt
key client.key
# Since we specified the tls-auth for server, we need it for the client
# note: 0 = server, 1 = client
tls-auth ta.key 1
# Specify same cipher as server
cipher BF-CBC
# Use compression
comp-lzo
# Log verbosity (to help if there are problems)
verb 3
netstat -rn, same deal I've put ? marks where the servers internet IP would be.
===========================================================================
Interface List
17...00 ff 4e 59 e5 83 ......TAP-Windows Adapter V9
12...d4 3d 7e f8 ec fb ......Realtek PCIe GBE Family Controller
1...........................Software Loopback Interface 1
14...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
15...00 00 00 00 00 00 00 e0 Microsoft 6to4 Adapter
16...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
18...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 ?.?.?.? ?.?.?.? 11
10.0.0.0 255.255.0.0 On-link 10.0.0.2 286
10.0.0.0 255.255.0.0 10.0.0.1 10.0.0.2 30
10.0.0.2 255.255.255.255 On-link 10.0.0.2 286
10.0.255.255 255.255.255.255 On-link 10.0.0.2 286
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
?.?.?.? 255.255.255.224 On-link ?.?.?.? 266
?.?.?.? 255.255.255.255 On-link ?.?.?.? 266
?.?.?.? 255.255.255.255 On-link ?.?.?.? 266
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.0.0.2 286
224.0.0.0 240.0.0.0 On-link ?.?.?.? 266
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 10.0.0.2 286
255.255.255.255 255.255.255.255 On-link ?.?.?.? 266
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.0.0 0.0.0.0 ?.?.?.? 1
===========================================================================
IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 306 ::1/128 On-link
15 1010 2002::/16 On-link
15 266 2002:94fb:2a42::94fb:2a42/128
On-link
17 286 fe80::/64 On-link
12 266 fe80::/64 On-link
17 286 ?::?:?:?:?/128
On-link
12 266 ?::?:?:?:?/128
On-link
1 306 ff00::/8 On-link
17 286 ff00::/8 On-link
12 266 ff00::/8 On-link
===========================================================================
Persistent Routes:
None
Telemetry unit, Linux VPN Client:
client.conf
### Client configuration file for OpenVPN
# Specify that this is a client
client
# Bridge device setting
dev tap0
up "/etc/openvpn/up.sh br0 tap0 1500"
down "/etc/openvpn/down.sh br0 tap0"
# Host name and port for the server (default port is 1194)
# note: replace with the correct values your server set up
proto udp
remote myserver.com 1194
push "route 10.0.0.0 255.255.0.0"
route 10.0.0.0 255.255.0.0 10.0.0.1
# Client does not need to bind to a specific local port
nobind
# Keep trying to resolve the host name of OpenVPN server.
## The windows GUI seems to dislike the following rule.
##You may need to comment it out.
resolv-retry infinite
# Preserve state across restarts
persist-key
persist-tun
# SSL/TLS parameters - files created previously
ca ca.crt
cert client.crt
key client.key
# Since we specified the tls-auth for server, we need it for the client
# note: 0 = server, 1 = client
tls-auth ta.key 1
# Specify same cipher as server
cipher BF-CBC
# Use compression
comp-lzo
# Log verbosity (to help if there are problems)
verb 3
interface
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
# The loopback network interface
auto lo
iface lo inet loopback
# Start and configure the bridge interfaces
auto br0
iface br0 inet static
address 10.0.0.3
netmask 255.255.0.0
# gateway 10.0.0.1
bridge_ports em1
# The primary network interface
#auto em1
#iface em1 inet dhcp
iface em1 inet manual
up ip link set $IFACE up promisc on
down ip link set $IFACE down promisc off
# Debug network interface
auto p1p1
iface p1p1 inet static
address 192.168.0.2
netmask 255.255.255.0
# Loads the iptable rules
post-up /sbin/iptables-restore < /etc/network/default-iptables
route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default * 0.0.0.0 U 0 0 0 ppp0
10.0.0.0 10.0.0.1 255.255.0.0 UG 0 0 0 br0
10.0.0.0 * 255.255.0.0 U 0 0 0 br0
10.0.0.0 * 255.255.0.0 U 0 0 0 tap0
10.64.64.64 * 255.255.255.255 UH 0 0 0 ppp0
192.168.0.0 * 255.255.255.0 U 0 0 0 p1p1
192.168.0.0 * 255.255.255.0 U 0 0 0 em1
Thanks in advance for any help, if I'm missing some information let me know and I'll try and grab it for you.
