Could not Ping Client

Hexcode

Hey,
I'm using a OpenVPN-Server on my raspberry Pi to connect to my home network from outside with multiple devices (Tablet (windows), Smartphone (Android) etc.)
For this usage I've set up 4 config-files:

UDP-TUN (Port 1194) -> using IP's from 10.8.0.0 range, device tun0 (Config: http://tny.cz/cbf66a5d)
TCP-TUN (Port 1194) -> using IP's from 10.8.1.0 range, device tun1 (Config: http://tny.cz/16b91f08)
UDP-TAP (Port 1195) -> bridged using DHCP from my normal home network, device tap1 (Config: http://tny.cz/46068087)
TCP-TAP (Port 1195) -> bridged using DHCP from my normal home network, device tap0 (Config: http://tny.cz/1ad053fd)

Eth0, tap0 and tap1 were bridged under br0. (ifconfig-output: http://tny.cz/a861df46)

brctl show
bridge name     bridge id               STP enabled     interfaces
br0             8000.1e13787176ff       no              eth0
                                                        tap0
                                                        tap1

Connecting on any of these configs and connecting to servers at my local lan is no problem - for example my Router (fritz.box) is no Problem or the DHCP is working proberbly.

But I'm facing some problems:
- When I connect via UDP-TUN and TCP-TUN two devices could get the same IP.
- I can't ping any of the devices connected via OpenVPN - even the one on the tap-bridge
- Is there a way to route IPTV (Multicast etc.) via the bridged device?

Anyone know how to solve this problems?
Greetings Hexcode

Hexcode

udp_tun.conf

dev tun0
proto udp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
user nobody
group nogroup
server 10.8.0.0 255.255.255.0
persist-key
persist-tun
status /var/log/openvpn/openvpn-status_udp_tun.log
verb 3
client-to-client
push "redirect-gateway def1"
#set the dns servers
push "dhcp-option DNS 192.168.2.1"
log-append /var/log/openvpn/openvpn_udp_tun
comp-lzo
mute 10

tcp_tun.conf

dev tun1
proto tcp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
user nobody
group nogroup
server 10.8.1.0 255.255.255.0
persist-key
persist-tun
status /var/log/openvpn/openvpn-status_tcp_tun.log
verb 3
client-to-client
push "redirect-gateway def1"
#set the dns servers
push "dhcp-option DNS 192.168.2.1"
log-append /var/log/openvpn/openvpn_tcp_tun
comp-lzo
mute 10

udp_tap.conf

float
port 1195
proto udp
dev tap1
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
#server-bridge 192.168.2.2 255.255.255.0 192.168.2.200 192.168.2.254
server-bridge
client-to-client
user nobody
group nogroup
comp-lzo
persist-key
persist-tun
status /var/log/openvpn/openvpn-status_udp_tap.log
verb 3
log-append /var/log/openvpn/openvpn_udp_tap
push "dhcp-option DNS 192.168.2.1"
mute 10

tcp_tap.conf

float
port 1195
proto tcp
dev tap0
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
#server-bridge 192.168.2.2 255.255.255.0 192.168.2.200 192.168.2.254
server-bridge
client-to-client
user nobody
group nogroup
comp-lzo
persist-key
persist-tun
status /var/log/openvpn/openvpn-status_tcp_tap.log
verb 3
log-append /var/log/openvpn/openvpn_tcp_tap
push "dhcp-option DNS 192.168.2.1"
mute 10

ifconfig-log:

br0       Link encap:Ethernet  Hardware Adresse 1e:13:78:71:76:ff
          inet Adresse:192.168.2.2  Bcast:192.168.2.255  Maske:255.255.255.0
          inet6-Adresse: fe80::1c13:78ff:fe71:76ff/64 GÃ¼ltigkeitsbereich:Verbindung
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metrik:1
          RX packets:36382 errors:0 dropped:0 overruns:0 frame:0
          TX packets:17868 errors:0 dropped:0 overruns:0 carrier:0
          Kollisionen:0 SendewarteschlangenlÃ¤nge:0
          RX bytes:25805118 (24.6 MiB)  TX bytes:7101746 (6.7 MiB)

eth0      Link encap:Ethernet  Hardware Adresse b8:27:eb:d5:5e:be
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metrik:1
          RX packets:32380 errors:0 dropped:0 overruns:0 frame:0
          TX packets:22042 errors:0 dropped:0 overruns:0 carrier:0
          Kollisionen:0 SendewarteschlangenlÃ¤nge:1000
          RX bytes:25095107 (23.9 MiB)  TX bytes:8128883 (7.7 MiB)

lo        Link encap:Lokale Schleife
          inet Adresse:127.0.0.1  Maske:255.0.0.0
          inet6-Adresse: ::1/128 GÃ¼ltigkeitsbereich:Maschine
          UP LOOPBACK RUNNING  MTU:65536  Metrik:1
          RX packets:2046 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2046 errors:0 dropped:0 overruns:0 carrier:0
          Kollisionen:0 SendewarteschlangenlÃ¤nge:0
          RX bytes:311665 (304.3 KiB)  TX bytes:311665 (304.3 KiB)

tap0      Link encap:Ethernet  Hardware Adresse 1e:13:78:71:76:ff
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metrik:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4620 errors:0 dropped:0 overruns:0 carrier:0
          Kollisionen:0 SendewarteschlangenlÃ¤nge:100
          RX bytes:0 (0.0 B)  TX bytes:361090 (352.6 KiB)

tap1      Link encap:Ethernet  Hardware Adresse fe:98:65:4e:4c:d7
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metrik:1
          RX packets:4002 errors:0 dropped:0 overruns:0 frame:0
          TX packets:8274 errors:0 dropped:8 overruns:0 carrier:0
          Kollisionen:0 SendewarteschlangenlÃ¤nge:100
          RX bytes:778764 (760.5 KiB)  TX bytes:4131092 (3.9 MiB)

tun0      Link encap:UNSPEC  Hardware Adresse 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet Adresse:10.8.0.1  P-z-P:10.8.0.2  Maske:255.255.255.255
          UP PUNKTZUPUNKT RUNNING NOARP MULTICAST  MTU:1500  Metrik:1
          RX packets:1548 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1527 errors:0 dropped:1 overruns:0 carrier:0
          Kollisionen:0 SendewarteschlangenlÃ¤nge:100
          RX bytes:171058 (167.0 KiB)  TX bytes:1353793 (1.2 MiB)

tun1      Link encap:UNSPEC  Hardware Adresse 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet Adresse:10.8.1.1  P-z-P:10.8.1.2  Maske:255.255.255.255
          UP PUNKTZUPUNKT RUNNING NOARP MULTICAST  MTU:1500  Metrik:1
          RX packets:151 errors:0 dropped:0 overruns:0 frame:0
          TX packets:140 errors:0 dropped:0 overruns:0 carrier:0
          Kollisionen:0 SendewarteschlangenlÃ¤nge:100
          RX bytes:25945 (25.3 KiB)  TX bytes:54352 (53.0 KiB)

Hexcode

Why? On each port there is only one udp and one tcp instance - following the howto of openvpn this should work.

Hexcode

Not according to your configs: TCP:TUN 10.8.1.0/24 / UDP:TUN 10.8.0.0/24

Yep - I have tested it the wrong way - Now it works 😉

If you cannot ping Server->Client then Check the firewall on your client. If you cannot ping Client->Client check firewall and create routing between Networks on server (EI. server config: route network mask gateway).

I've set up the route from 10.8.1.0 (255.255.255.0) and 10.8.0.0 (255.255.255.0) to the pi under 192.168.2.2, which seems to work, because a simple "tracert 10.8.1.10" results in:

C:\Users\>tracert 10.8.1.10

Routenverfolgung zu 10.8.1.10 über maximal 30 Hops

  1     1 ms     1 ms    <1 ms  pi.fritz.box [192.168.2.2]
  2     *        1 ms     *     pi.fritz.box [192.168.2.2]
  3     *        *        *     Zeitüberschreitung der Anforderung. (timeout)
  4     *        *        *     Zeitüberschreitung der Anforderung.
  5     *        *        *     Zeitüberschreitung der Anforderung.

But a ping doesn't work either.
Same result when I try to ping a device connected via the tap device - for example the Tablet was assigned to the IP 192.168.2.35 from the DHCP under 192.168.2.2. The Tablet can connect to websites and can ping devices in the local network. But when I try to ping from local network to the tablet, there is only a timeout 🙁 The firewall on the tablet is disabled.
When I run wireshark on the tablet, there are ICMP-Packages called "74 echo (ping) request", so it seems the packages from the server where reaching the client but he couldn't answer to them, because there is no "ping (reply)"-package.

Hexcode

I've sorted out the problems on the TAP-Devices -> The firewall was active even if I disabled it :twisted:
The link from the gateway is defined as a route from 10.8.0.0 (mask: 255.255.0.0) to the OpvenVPN-Server under 192.168.2.2, when I run tracert on windows the route works correctly, but there is no ping answer.