[Resolved] Can't Ping LAN device - Tap

doodoo

Hello,

I have an issue with my open VPN.
I can connect to VPNServer but I can't ping the device in my remote LAN

My computer (10.0.0.80) --> WAN --> My ADSL BOX (192.168.0.254) --> OpenVPN (eth0 : 192.168.0.50 | tap0 : 192.168.0.1)

When the client is connected I can ping eth0 and tap0 of my openvpn server, but now way to ping the BOX (192.168.0.254 (freebox))

During the ping if I run a tcpdump on the openvpn server I see the echo request but no reply...

root@lune:/home/pi# tcpdump -i tap0 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tap0, link-type EN10MB (Ethernet), capture size 65535 bytes
17:31:35.323951 IP 192.168.0.2 > Freebox: ICMP echo request, id 1, seq 872, length 40
17:31:39.992502 IP 192.168.0.2 > Freebox: ICMP echo request, id 1, seq 875, length 40

Could you please find bellow the server.conf :

mode server
proto tcp
port 443
dev tap0

ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
tls-auth ta.key 1
key-direction 0
cipher AES-256-CBC

server 192.168.0.0 255.255.255.248
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 192.186.0.254"
keepalive 10 120

user nobody
group nogroup
chroot /etc/openvpn/jail
persist-key
persist-tun
comp-lzo

verb 3
mute 20
status openvpn-status.log
; log-append /var/log/openvpn.log

Client conf :

# Client
client
dev tap
proto tcp-client
remote 88.XXX.XXX.XXX 443
resolv-retry infinite
cipher AES-256-CBC

# Cles
ca ca.crt
cert doodoo.crt
key doodoo.key
tls-auth ta.key 1

# Securite
nobind
persist-key
persist-tun
comp-lzo
verb 5
auth-user-pass

#tun-mtu 1400

iptable

root@lune:/home/pi# iptables -L -v
Chain INPUT (policy ACCEPT 4874 packets, 3016K bytes)
 pkts bytes target     prot opt in     out     source               destination
  704 65278 ACCEPT     all  --  tap+   any     anywhere             anywhere
    0     0 ACCEPT     all  --  tap0   any     anywhere             anywhere
    0     0 ACCEPT     all  --  br0    any     anywhere             anywhere

Chain FORWARD (policy ACCEPT 1013 packets, 63360 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  br0    any     anywhere             anywhere

Chain OUTPUT (policy ACCEPT 3468 packets, 336K bytes)
 pkts bytes target     prot opt in     out     source               destination
root@lune:/home/pi#

Ifconfig:

root@lune:/home/pi# ifconfig
eth0      Link encap:Ethernet  HWaddr b8:27:eb:0c:3a:6e
          inet addr:192.168.0.50  Bcast:192.168.0.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:32692885 errors:0 dropped:0 overruns:0 frame:0
          TX packets:33334049 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:2152482040 (2.0 GiB)  TX bytes:2065089876 (1.9 GiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:13 errors:0 dropped:0 overruns:0 frame:0
          TX packets:13 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:1544 (1.5 KiB)  TX bytes:1544 (1.5 KiB)

tap0      Link encap:Ethernet  HWaddr 9e:15:f6:1b:3b:4d
          inet addr:192.168.0.1  Bcast:192.168.0.7  Mask:255.255.255.248
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:863 errors:0 dropped:42 overruns:0 frame:0
          TX packets:9 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:80436 (78.5 KiB)  TX bytes:378 (378.0 B)

NetStat:

root@lune:/home/pi# netstat -nr
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         192.168.0.254   0.0.0.0         UG        0 0          0 eth0
192.168.0.0     0.0.0.0         255.255.255.248 U         0 0          0 tap0
192.168.0.0     0.0.0.0         255.255.255.0   U         0 0          0 eth0

Thanks in advance for your help.

Have a nice day.

Damien

doodoo

Hello,

Thanks for your answer but it doesn't solve my issue, still not possible to ping other host on my remote site...

doodoo

Hello,

Could you please find bellow :

Client Log :

Thu Jan 23 15:16:34 2014 us=193000 [openvpn] Peer Connection Initiated with 88.XXX.XXX.XXX:443
Thu Jan 23 15:16:36 2014 us=642000 SENT CONTROL [openvpn]: 'PUSH_REQUEST' (status=1)
Thu Jan 23 15:16:36 2014 us=939000 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 192.186.0.254,route-gateway 192.168.0.1,ping 10,ping-restart 120,ifconfig 192.168.0.2 255.255.255.248'
Thu Jan 23 15:16:36 2014 us=939000 OPTIONS IMPORT: timers and/or timeouts modified
Thu Jan 23 15:16:36 2014 us=939000 OPTIONS IMPORT: --ifconfig/up options modified
Thu Jan 23 15:16:36 2014 us=939000 OPTIONS IMPORT: route options modified
Thu Jan 23 15:16:36 2014 us=939000 OPTIONS IMPORT: route-related options modified
Thu Jan 23 15:16:36 2014 us=939000 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu Jan 23 15:16:36 2014 us=939000 ROUTE default_gateway=10.0.0.10
Thu Jan 23 15:16:36 2014 us=970000 TAP-WIN32 device [Connexion au réseau local 2] opened: \\.\Global\{D845677D-0625-4F5E-A669-4ED7D054E7A4}.tap
Thu Jan 23 15:16:36 2014 us=970000 TAP-Win32 Driver Version 9.9 
Thu Jan 23 15:16:36 2014 us=970000 TAP-Win32 MTU=1500
Thu Jan 23 15:16:36 2014 us=970000 Notified TAP-Win32 driver to set a DHCP IP/netmask of 192.168.0.2/255.255.255.248 on interface {D845677D-0625-4F5E-A669-4ED7D054E7A4} [DHCP-serv: 192.168.0.0, lease-time: 31536000]
Thu Jan 23 15:16:36 2014 us=970000 DHCP option string: 0604c0ba 00fe
Thu Jan 23 15:16:36 2014 us=970000 Successful ARP Flush on interface [60] {D845677D-0625-4F5E-A669-4ED7D054E7A4}
Thu Jan 23 15:16:41 2014 us=104000 TEST ROUTES: 1/1 succeeded len=0 ret=1 a=0 u/d=up
Thu Jan 23 15:16:41 2014 us=104000 C:\WINDOWS\system32\route.exe ADD 88.176.178.52 MASK 255.255.255.255 10.0.0.10
Thu Jan 23 15:16:41 2014 us=104000 Warning: route gateway is ambiguous: 10.0.0.10 (2 matches)
Thu Jan 23 15:16:41 2014 us=104000 Route addition via IPAPI failed [adaptive]
Thu Jan 23 15:16:41 2014 us=104000 Route addition fallback to route.exe
 OK!
Thu Jan 23 15:16:41 2014 us=166000 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 192.168.0.1
Thu Jan 23 15:16:41 2014 us=182000 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Jan 23 15:16:41 2014 us=182000 Route addition via IPAPI succeeded [adaptive]
Thu Jan 23 15:16:41 2014 us=182000 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 192.168.0.1
Thu Jan 23 15:16:41 2014 us=182000 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Jan 23 15:16:41 2014 us=182000 Route addition via IPAPI succeeded [adaptive]
Thu Jan 23 15:16:41 2014 us=182000 Initialization Sequence Completed

Server log :

root@lune:~# vim /var/log/openvpn.log
Thu Jan 23 14:50:01 2014 us=388810 Current Parameter Settings:
Thu Jan 23 14:50:01 2014 us=389894   config = '/etc/openvpn/server.conf'
Thu Jan 23 14:50:01 2014 us=390120   mode = 1
Thu Jan 23 14:50:01 2014 us=390312   persist_config = DISABLED
Thu Jan 23 14:50:01 2014 us=390482   persist_mode = 1
Thu Jan 23 14:50:01 2014 us=390643   show_ciphers = DISABLED
Thu Jan 23 14:50:01 2014 us=390801   show_digests = DISABLED
Thu Jan 23 14:50:01 2014 us=390957   show_engines = DISABLED
Thu Jan 23 14:50:01 2014 us=391109   genkey = DISABLED
Thu Jan 23 14:50:01 2014 us=391271   key_pass_file = '[UNDEF]'
Thu Jan 23 14:50:01 2014 us=391428   show_tls_ciphers = DISABLED
Thu Jan 23 14:50:01 2014 us=391585 Connection profiles [default]:
Thu Jan 23 14:50:01 2014 us=391745   proto = tcp-server
Thu Jan 23 14:50:01 2014 us=391901   local = '[UNDEF]'
Thu Jan 23 14:50:01 2014 us=392055   local_port = 443
Thu Jan 23 14:50:01 2014 us=392208   remote = '[UNDEF]'
Thu Jan 23 14:50:01 2014 us=392369   remote_port = 443
Thu Jan 23 14:50:01 2014 us=392524   remote_float = DISABLED
Thu Jan 23 14:50:01 2014 us=392679   bind_defined = DISABLED
Thu Jan 23 14:50:01 2014 us=392836   bind_local = ENABLED
Thu Jan 23 14:50:01 2014 us=393089 NOTE: --mute triggered...
Thu Jan 23 14:50:01 2014 us=393368 258 variation(s) on previous 20 message(s) suppressed by --mute
Thu Jan 23 14:50:01 2014 us=393550 OpenVPN 2.2.1 arm-linux-gnueabihf [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Oct 12 2013
Thu Jan 23 14:50:01 2014 us=395403 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Thu Jan 23 14:50:01 2014 us=395674 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu Jan 23 14:50:01 2014 us=436260 Diffie-Hellman initialized with 1024 bit key
Thu Jan 23 14:50:01 2014 us=450020 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Thu Jan 23 14:50:01 2014 us=450444 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Jan 23 14:50:01 2014 us=450680 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Jan 23 14:50:01 2014 us=450970 TLS-Auth MTU parms [ L:1592 D:168 EF:68 EB:0 ET:0 EL:0 ]
Thu Jan 23 14:50:01 2014 us=451338 Socket Buffers: R=[87380->131072] S=[16384->131072]
Thu Jan 23 14:50:01 2014 us=452279 WARNING: potential TUN/TAP adapter subnet conflict between local LAN [192.168.0.0/255.255.255.0] and remote VPN [192.168.0.0/255.255.255.248]
Thu Jan 23 14:50:01 2014 us=460570 TUN/TAP device tap0 opened
Thu Jan 23 14:50:01 2014 us=460921 TUN/TAP TX queue length set to 100
Thu Jan 23 14:50:01 2014 us=461158 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Jan 23 14:50:01 2014 us=461595 /sbin/ifconfig tap0 192.168.0.1 netmask 255.255.255.248 mtu 1500 broadcast 192.168.0.7
Thu Jan 23 14:50:01 2014 us=485639 Data Channel MTU parms [ L:1592 D:1450 EF:60 EB:135 ET:32 EL:0 AF:3/1 ]
Thu Jan 23 13:50:01 2014 us=503412 chroot to '/etc/openvpn/jail' and cd to '/' succeeded
Thu Jan 23 13:50:01 2014 us=503995 GID set to nogroup
Thu Jan 23 13:50:01 2014 us=504315 UID set to nobody
Thu Jan 23 13:50:01 2014 us=504628 Listening for incoming TCP connection on [undef]
Thu Jan 23 13:50:01 2014 us=505077 TCPv4_SERVER link local (bound): [undef]
Thu Jan 23 13:50:01 2014 us=505288 TCPv4_SERVER link remote: [undef]
Thu Jan 23 13:50:01 2014 us=505527 MULTI: multi_init called, r=256 v=256
Thu Jan 23 13:50:01 2014 us=506498 IFCONFIG POOL: base=192.168.0.2 size=5, ipv6=0
Thu Jan 23 13:50:01 2014 us=506931 MULTI: TCP INIT maxclients=1024 maxevents=1028
Thu Jan 23 13:50:01 2014 us=507397 Initialization Sequence Completed
Thu Jan 23 13:50:38 2014 us=746685 MULTI: multi_create_instance called
Thu Jan 23 13:50:38 2014 us=747215 Re-using SSL/TLS context
Thu Jan 23 13:50:38 2014 us=747723 LZO compression initialized
Thu Jan 23 13:50:38 2014 us=750380 Control Channel MTU parms [ L:1592 D:168 EF:68 EB:0 ET:0 EL:0 ]
Thu Jan 23 13:50:38 2014 us=750803 Data Channel MTU parms [ L:1592 D:1450 EF:60 EB:135 ET:32 EL:0 AF:3/1 ]
Thu Jan 23 13:50:38 2014 us=751576 Local Options String: 'V4,dev-type tap,link-mtu 1592,tun-mtu 1532,proto TCPv4_SERVER,comp-lzo,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Thu Jan 23 13:50:38 2014 us=751773 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1592,tun-mtu 1532,proto TCPv4_CLIENT,comp-lzo,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Thu Jan 23 13:50:38 2014 us=752228 Local Options hash (VER=V4): 'ad144f1c'
Thu Jan 23 13:50:38 2014 us=752501 Expected Remote Options hash (VER=V4): '88107939'
Thu Jan 23 13:50:38 2014 us=752868 TCP connection established with [AF_INET]82.127.107.168:45137
Thu Jan 23 13:50:38 2014 us=753086 TCPv4_SERVER link local: [undef]
Thu Jan 23 13:50:38 2014 us=753281 TCPv4_SERVER link remote: [AF_INET]82.127.107.168:45137
Thu Jan 23 13:50:38 2014 us=755091 82.127.107.168:45137 TLS: Initial packet from [AF_INET]82.127.107.168:45137, sid=984f2a70 aeb9bada
Thu Jan 23 13:50:40 2014 us=567460 82.127.107.168:45137 VERIFY OK: depth=1, /C=FR/ST=IDF/L=Nanterre/O=Doodoos/OU=IT/CN=openvpn/name=raspberryvpn/emailAddress=mail@host.domain

Thanks for your help.

Damien

doodoo

I change to tun (server and client) but I have the same issue, I can't ping remote LAN device...

Regarding the overlap what's your advice?

Thanks for your help.

doodoo

Hello,

This is my new conf file :

Server.conf

mode server
proto tcp
port 443
dev tun

ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
tls-auth ta.key 1
key-direction 0
cipher AES-256-CBC

server 192.168.0.0 255.255.255.248
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 192.186.0.254"
keepalive 10 120

user nobody
group nogroup
chroot /etc/openvpn/jail
persist-key
persist-tun
comp-lzo

verb 4
mute 20
status openvpn-status.log
;log-append /var/log/openvpn.log

Client

# Client
client
dev tun
proto tcp-client
remote 88.176.178.52 443
resolv-retry infinite
cipher AES-256-CBC


ca ca.crt
cert doodoo.crt
key doodoo.key
tls-auth ta.key 1


nobind
persist-key
persist-tun
comp-lzo
verb 4
auth-user-pass

I have the same issue.

Thanks for your help.

Regards,

Damien

doodoo

Hello,

in fact it was an iptables issue...

Thanks for your help.

Regards,

Damien