Hi!
I create an openvpn-openssl client-server config with 2 openwrt based router. The connection is ok, i can ping other side vpn interface (tun) but if i ping the other side wired interface the packets is disappear in tun. I see the packets with tcpdump on tun in the source but nothing come out the other side.
Topology:
192.168.1.0/24---192.168.1.1 Server 192.168.50.1 ---- tunnel ----192.168.50.6 client 192.168.101.1 ----192,168,101,0/24
fom server i can ping 192.168.50.6 but not ping 192.168.101.1 (the packets on server go trough tun, and nothing come out on client's tun.
Configs:
Server
port 12000
proto udp
dev tun0
ca /etc/openvpn/ca.crt
cert /etc/openvpn/openwrt.crt
key /etc/openvpn/openwrt.key
dh /etc/openvpn/dh1024.pem
server 192.168.50.0 255.255.255.0
keepalive 10 120
persist-key
persist-tun
verb 3
log /var/log/viewer.log
duplicate-cn
script-security 2
up /etc/openvpn/viewer.up
down /etc/openvpn/viewer.down
route 192.168.100.0 255.255.255.0
route 192.168.101.0 255.255.255.0
push "route 192.168.1.0 255.255.255.0"
Client:
client
dev tun
;proto tcp
proto udp
remote serverb.homelinux.org 12000
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ca /etc/openvpn/ca.crt
cert /etc/openvpn/openwrtcli.crt
key /etc/openvpn/openwrtcli.key
verb 3
mute 20
The firewalls a little complicated (openwrt specific) client side in the first time
# Generated by iptables-save v1.4.10 on Wed Feb 5 08:03:47 2014
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:nat_reflection_in - [0:0]
:nat_reflection_out - [0:0]
:postrouting_rule - [0:0]
:prerouting_lan - [0:0]
:prerouting_rule - [0:0]
:prerouting_wan - [0:0]
:zone_lan_nat - [0:0]
:zone_lan_prerouting - [0:0]
:zone_wan_nat - [0:0]
:zone_wan_prerouting - [0:0]
-A PREROUTING -j prerouting_rule
-A PREROUTING -i br-lan -j zone_lan_prerouting
-A PREROUTING -i 3g-wan -j zone_wan_prerouting
-A PREROUTING -i tun0 -j zone_lan_prerouting
-A POSTROUTING -j postrouting_rule
-A POSTROUTING -o br-lan -j zone_lan_nat
-A POSTROUTING -o 3g-wan -j zone_wan_nat
-A POSTROUTING -o tun0 -j zone_lan_nat
-A postrouting_rule -j nat_reflection_out
-A prerouting_rule -j nat_reflection_in
-A zone_lan_prerouting -j prerouting_lan
-A zone_wan_nat -j MASQUERADE
-A zone_wan_prerouting -j prerouting_wan
COMMIT
# Completed on Wed Feb 5 08:03:47 2014
# Generated by iptables-save v1.4.10 on Wed Feb 5 08:03:47 2014
*raw
:PREROUTING ACCEPT [157308:15942007]
:OUTPUT ACCEPT [155521:16733269]
:zone_lan_notrack - [0:0]
:zone_wan_notrack - [0:0]
-A PREROUTING -i br-lan -j zone_lan_notrack
-A PREROUTING -i 3g-wan -j zone_wan_notrack
-A PREROUTING -i tun0 -j zone_lan_notrack
COMMIT
# Completed on Wed Feb 5 08:03:47 2014
# Generated by iptables-save v1.4.10 on Wed Feb 5 08:03:47 2014
*mangle
:PREROUTING ACCEPT [169183:17776273]
:INPUT ACCEPT [162731:16483859]
:FORWARD ACCEPT [6452:1292414]
:OUTPUT ACCEPT [159811:17379779]
:POSTROUTING ACCEPT [166263:18672193]
:zone_wan_MSSFIX - [0:0]
-A FORWARD -j zone_wan_MSSFIX
-A zone_wan_MSSFIX -o 3g-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Wed Feb 5 08:03:47 2014
# Generated by iptables-save v1.4.10 on Wed Feb 5 08:03:47 2014
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:forward - [0:0]
:forwarding_lan - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan - [0:0]
:input - [0:0]
:input_lan - [0:0]
:input_rule - [0:0]
:input_wan - [0:0]
:nat_reflection_fwd - [0:0]
:output - [0:0]
:output_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_lan - [0:0]
:zone_lan_ACCEPT - [0:0]
:zone_lan_DROP - [0:0]
:zone_lan_REJECT - [0:0]
:zone_lan_forward - [0:0]
:zone_wan - [0:0]
:zone_wan_ACCEPT - [0:0]
:zone_wan_DROP - [0:0]
:zone_wan_REJECT - [0:0]
:zone_wan_forward - [0:0]
-A INPUT -i tun0 -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j syn_flood
-A INPUT -j input_rule
-A INPUT -j input
-A FORWARD -o tun0 -j ACCEPT
-A FORWARD -i tun0 -j ACCEPT
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -j forwarding_rule
-A FORWARD -j forward
-A FORWARD -j reject
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -j output_rule
-A OUTPUT -j output
-A forward -i br-lan -j zone_lan_forward
-A forward -i 3g-wan -j zone_wan_forward
-A forward -i tun0 -j zone_lan_forward
-A forwarding_rule -j nat_reflection_fwd
-A input -i br-lan -j zone_lan
-A input -i 3g-wan -j zone_wan
-A input -i tun0 -j zone_lan
-A output -j zone_lan_ACCEPT
-A output -j zone_wan_ACCEPT
-A reject -p tcp -j REJECT --reject-with tcp-reset
-A reject -j REJECT --reject-with icmp-port-unreachable
-A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -j RETURN
-A syn_flood -j DROP
-A zone_lan -j input_lan
-A zone_lan -j zone_lan_ACCEPT
-A zone_lan_ACCEPT -o br-lan -j ACCEPT
-A zone_lan_ACCEPT -i br-lan -j ACCEPT
-A zone_lan_ACCEPT -o tun0 -j ACCEPT
-A zone_lan_ACCEPT -i tun0 -j ACCEPT
-A zone_lan_DROP -o br-lan -j DROP
-A zone_lan_DROP -i br-lan -j DROP
-A zone_lan_DROP -o tun0 -j DROP
-A zone_lan_DROP -i tun0 -j DROP
-A zone_lan_REJECT -o br-lan -j reject
-A zone_lan_REJECT -i br-lan -j reject
-A zone_lan_REJECT -o tun0 -j reject
-A zone_lan_REJECT -i tun0 -j reject
-A zone_lan_forward -j zone_wan_ACCEPT
-A zone_lan_forward -j forwarding_lan
-A zone_lan_forward -j zone_lan_ACCEPT
-A zone_wan -p udp -m udp --dport 68 -j ACCEPT
-A zone_wan -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A zone_wan -j input_wan
-A zone_wan -j zone_wan_REJECT
-A zone_wan_ACCEPT -o 3g-wan -j ACCEPT
-A zone_wan_ACCEPT -i 3g-wan -j ACCEPT
-A zone_wan_DROP -o 3g-wan -j DROP
-A zone_wan_DROP -i 3g-wan -j DROP
-A zone_wan_REJECT -o 3g-wan -j reject
-A zone_wan_REJECT -i 3g-wan -j reject
-A zone_wan_forward -j forwarding_wan
-A zone_wan_forward -j zone_wan_REJECT
I Can't see the problem
Routing table:
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 10.64.64.64 0.0.0.0 UG 0 0 0 3g-wan
10.64.64.64 0.0.0.0 255.255.255.255 UH 0 0 0 3g-wan
192.168.1.0 192.168.50.5 255.255.255.0 UG 0 0 0 tun0
192.168.50.1 192.168.50.5 255.255.255.255 UGH 0 0 0 tun0
192.168.50.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
192.168.101.0 0.0.0.0 255.255.255.0 U 0 0 0 br-lan
