Physical Subnet Resources not Accessible from VPN Subnet

illyb

This thread provides an overview of my OpenVPN setup: https://forums.openvpn.net/topic14863.html

Everything is working (quite well, I might add) with my setup for internet access. However, I cannot access resources on my 10.0.1.0 subnet (my local LAN) from the 10.0.2.0 VPN subnet when remotely accessing my OpenVPN server.

My iptables configuration is below.

iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT
iptables -I FORWARD 1 --source 10.0.1.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT

Is this an iptables issue? A subnet provisioning issue? I don't think its much of an issue directly attributable to OpenVPN, though I am attempting to access subnet resources via an OpenVPN tunnel.

Any help would be most appreciated. Thanks!

illyb

Here are my current configs.

Server (running on my DD-WRT router):

dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
keepalive 10 120
mute 5
log /var/log/openvpn
writepid /var/log/openvpnd.pid
management 127.0.0.1 5002
management-log-cache 50
mtu-disc yes
topology subnet
client-config-dir /tmp/openvpn/ccd
script-security 2
port 1194
proto udp
cipher aes-256-cbc
auth sha512
tls-server
ifconfig-pool-persist /tmp/openvpn/ip-pool 86400
comp-lzo no
client-to-client
push "redirect-gateway def1"
tls-cipher AES256-SHA
fast-io
tun-mtu 1500
server 10.0.2.0 255.255.255.0
dev tun0
tls-auth /tmp/openvpn/ta.key 0
verb 5

Client:

remote qwerty.com 1194 
proto udp
pull
tls-client
tls-auth ta.key 1
persist-key
ca ca.crt
redirect-gateway def1
dev tun
persist-tun
cert cert.crt
comp-lzo no
nobind
key key.key
tun-mtu 1500
tls-cipher AES256-SHA
cipher aes-256-cbc
auth sha512

And this is my iptables setup:

iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT
iptables -I FORWARD 1 --source 10.0.1.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT

As I started in my first post, I have two objectives with my VPN setup:
1) to access the Internet through the VPN
2) to access resources on my 10.0.1.0 subnet

I can access the internet through the VPN, but I cannot access 10.0.1.0 subnet resources. What do I have wrong in my config?

Thanks!

illyb

Thanks for the tips. The mtu-disc config keeps creeping in due the GUI config generator I am using. It hasn't caused problems for me yet, but I went ahead and removed it. I also added the dhcp-bypass option to my default gateway redirect. I have added:

push "route 10.0.1.0 255.255.248.0"

To my server config. I will test the config later today. Here's hoping it works.

illyb

illyb wrote

push "route 10.0.1.0 255.255.248.0"

No dice. Maybe

push "route 10.0.1.0 255.255.248.0 10.0.1.1"

would work?

Or would it be:

push "route 10.0.1.0 255.255.248.0 10.0.2.1"

10.0.2.1 is my VPN gateway, 10.0.1.1 is my physical LAN gateway. These interfaces both reside on the same DD-WRT router. All LAN resources sit on the other side of an Apple Airport (10.0.1.100) connected to one of the LAN interfaces of the DD-WRT router. The routing I want is as follows (please excuse the crudity of the model 😉 )

10.0.2.x <---> 10.0.2.1 <---> 10.0.1.1 <---> 10.0.1.100 <---> 10.0.1.xxx
(VPN Client)   (VPN GW)       (LAN GW)        (Airport)     (LAN Resource)

I have been reading over the post at http://nuuage.com/?p=286 few times, but the author's explanation of what config lines go in what files, along with a description of the network architecture, is atrocious. I am a bit confused.

illyb

Client (relevant portions only; I did not include the portions pertaining to the current LAN I am on or the IPv6 tables):

Routing tables

Internet:
Destination        Gateway            Flags        Refs      Use   Netif Expire
0/1                10.0.2.1           UGSc            1        0    tun0
default            192.168.3.1        UGSc           19        0     en0
10.0.2/24          10.0.2.2           UGSc            3        0    tun0
10.0.2.2           10.0.2.2           UH              1        0    tun0
xx.xxx.xxx.xxx/32  192.168.3.1        UGSc            1        0     en0
127                127.0.0.1          UCS             0        0     lo0
127.0.0.1          127.0.0.1          UH              9     1554     lo0
128.0/1            10.0.2.1           UGSc            0        0    tun0

Server:

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
10.0.2.0        0.0.0.0         255.255.255.0   U         0 0          0 tun0
10.0.0.0        0.0.0.0         255.255.248.0   U         0 0          0 br0
xx.xxx.yyy.0    0.0.0.0         255.255.248.0   U         0 0          0 vlan1
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 br0
127.0.0.0       0.0.0.0         255.0.0.0       U         0 0          0 lo
0.0.0.0         xx.xxx.yyy.1    0.0.0.0         UG        0 0          0 vlan1

I also noted that I could not access the internet when I remoted in just now ... but I could yesterday. :?

illyb

debbie10t wroteDid you add routing to you LAN gateways ?

No, and that would be one of the issues. However, it seems that I have taken a step back. I cannot access the internet through my VPN tunnel now ... any idea why that would be? I keep getting

N read UDPv4 [ECONNREFUSED]: Connection refused (code=146)

Errors in my server log once a client connects to the server. I am unable to ping my VPN gateway (10.0.2.1) ... so it appears that no traffic is traversing the VPN tunnel once it's established. The VPN tunnel does get established successfully.

Current client config file:

remote qwerty.com 1194 
proto udp
pull
tls-client
tls-auth ta.key 1
persist-key
ca ca.crt
redirect-gateway def1
dev tun
persist-tun
cert cert.crt
comp-lzo no
nobind
key key.key
tun-mtu 1500
tls-cipher AES256-SHA
cipher aes-256-cbc
auth sha512

Current Server Config:

dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
mode server
keepalive 10 120
mute 5
log /var/log/openvpn
writepid /var/log/openvpnd.pid
management 127.0.0.1 5002
management-log-cache 50
topology subnet
client-config-dir /tmp/openvpn/ccd
script-security 2
port 1194
proto udp
cipher aes-256-cbc
auth sha512
tls-server
ifconfig-pool-persist /tmp/openvpn/ip-pool 86400
comp-lzo no
client-to-client
push "redirect-gateway def1 bypass-dhcp"
tls-cipher AES256-SHA
fast-io
tun-mtu 1500
server 10.0.2.0 255.255.255.0
dev tun0
tls-auth /tmp/openvpn/ta.key 0
verb 5

Has something inadvertently gotten tweaked? I've scanned the configs a few times and haven't found anything. I am not sure why all of the sudden my VPN connection to the internet would stop working.

I'm sure I am missing something basic...

illyb

Once the VPN connection is established, this is the sequence of log entries the server generates. Hopefully this provides some more fidelity...

Wed Mar  5 20:52:10 2014 us=821040 xx.xx.xx.xxx:64507 [user] Peer Connection Initiated with xx.xx.xx.xxx:64507
Wed Mar  5 20:52:10 2014 us=825216 user/xx.xx.xx.xxx:64507 MULTI: Learn: 10.0.2.2 -> user/xx.xx.xx.xxx:64507
Wed Mar  5 20:52:10 2014 us=826119 user/xx.xx.xx.xxx:64507 MULTI: primary virtual IP for user/xx.xx.xx.xxx:64507: 10.0.2.2
Wed Mar  5 20:52:13 2014 us=322660 user/xx.xx.xx.xxx:64507 PUSH: Received control message: 'PUSH_REQUEST'
Wed Mar  5 20:52:13 2014 us=324932 user/xx.xx.xx.xxx:64507 SENT CONTROL [user]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,route-gateway 10.0.2.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.0.2.2 255.255.255.0' (status=1)
Wed Mar  5 20:53:53 2014 us=194535 read UDPv4 [ECONNREFUSED]: Connection refused (code=146)

illyb

Bump...

After resetting the router I can ping both my VPN gateway (10.0.2.1) and physical gateway (10.0.1.1), and can view the DD-WRT router admin page on the physical gateway (https://10.0.1.1), but I cannot reach any internet resource through the VPN tunnel. My routing tables on the client are still as I posted on Tue Mar 04, 2014 4:05 pm.

Any help that can be provided will be most helpful. I am at a loss.