Connect to client behind the router - Inactivity timeout

tmolko

I have such topology:

I want to make a VPN connection from client in subnet 192.x.x.x to my OpenVPN server. But still getting such messages:

Mon Mar 10 16:24:00 2014 Initialization Sequence Completed
Mon Mar 10 16:26:00 2014 [OpenVPNServerTEST] Inactivity timeout (--ping-restart), restarting
Mon Mar 10 16:26:00 2014 TCP/UDP: Closing socket
Mon Mar 10 16:26:00 2014 SIGUSR1[soft,ping-restart] received, process restarting
Mon Mar 10 16:26:00 2014 Restart pause, 2 second(s)
Mon Mar 10 16:26:02 2014 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Mon Mar 10 16:26:02 2014 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Mar 10 16:26:02 2014 Re-using SSL/TLS context
Mon Mar 10 16:26:02 2014 LZO compression initialized
Mon Mar 10 16:26:02 2014 Control Channel MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]
Mon Mar 10 16:26:02 2014 Socket Buffers: R=[229376->131072] S=[229376->131072]
Mon Mar 10 16:26:02 2014 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Mar 10 16:26:02 2014 Local Options hash (VER=V4): '9e7066d2'
Mon Mar 10 16:26:02 2014 Expected Remote Options hash (VER=V4): '162b04de'
Mon Mar 10 16:26:02 2014 UDPv4 link local: [undef]
Mon Mar 10 16:26:02 2014 UDPv4 link remote: [AF_INET]172.16.1.111:1194
Mon Mar 10 16:27:02 2014 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mon Mar 10 16:27:02 2014 TLS Error: TLS handshake failed
Mon Mar 10 16:27:02 2014 TCP/UDP: Closing socket
Mon Mar 10 16:27:02 2014 SIGUSR1[soft,tls-error] received, process restarting
Mon Mar 10 16:27:02 2014 Restart pause, 2 second(s)
Mon Mar 10 16:27:04 2014 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Mon Mar 10 16:27:04 2014 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Mar 10 16:27:04 2014 Re-using SSL/TLS context
Mon Mar 10 16:27:04 2014 LZO compression initialized
Mon Mar 10 16:27:04 2014 Control Channel MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]
Mon Mar 10 16:27:04 2014 Socket Buffers: R=[229376->131072] S=[229376->131072]
Mon Mar 10 16:27:04 2014 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Mar 10 16:27:04 2014 Local Options hash (VER=V4): '9e7066d2'
Mon Mar 10 16:27:04 2014 Expected Remote Options hash (VER=V4): '162b04de'
Mon Mar 10 16:27:04 2014 UDPv4 link local: [undef]
Mon Mar 10 16:27:04 2014 UDPv4 link remote: [AF_INET]172.16.1.111:1194
^C (CTRL+C)
Mon Mar 10 16:27:20 2014 event_wait : Interrupted system call (code=4)
Mon Mar 10 16:27:20 2014 TCP/UDP: Closing socket
Mon Mar 10 16:27:20 2014 /sbin/route del -net 10.8.0.1 netmask 255.255.255.255
Mon Mar 10 16:27:20 2014 /sbin/route del -net 172.16.1.0 netmask 255.255.255.0
Mon Mar 10 16:27:20 2014 /sbin/route del -net 172.16.254.0 netmask 255.255.255.0
Mon Mar 10 16:27:20 2014 Closing TUN/TAP interface
Mon Mar 10 16:27:20 2014 /sbin/ifconfig tun0 0.0.0.0

My clients (all of them) are Xubuntu 13.10 with iptables rules:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination        
ACCEPT     udp  --  anywhere             anywhere             state NEW udp dpt:openvpn
ACCEPT     all  --  anywhere             anywhere           

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination        
ACCEPT     all  --  anywhere             anywhere           
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination        
ACCEPT     all  --  anywhere             anywhere

1. My client from the subnet 192.x.x.x is client3 - it cant connect to vpn server
2. Clients from subnet 172.x.x.x are client1 and client2 - they can connect with OpenVPN server with no problems.
3. My router is JSRX 210 H with out of the box configuration - without VPN client3 (192.x.x.x) can ping client1, client2 and server from subnet 172.x.x.x. (everyone can ping everyone without vpn = full connectivity)

My cliennt3 (192.x.x.x) config file:

client
dev tun0
proto udp
remote 172.16.1.111 1194
resolv-retry infinite
nobind
# Downgrade privileges after initialization (non-Windows only)
;user nobody
;group nobody
persist-key
persist-tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/client3test.crt
key /etc/openvpn/client3test.key
tls-auth /etc/openvpn/ta.key 1
cipher AES-256-CBC
keepalive 10 120
comp-lzo
verb 3

Config files for client1 and client2 are the same (despite the tun, client1 uses tun0, client2 uses tun1), my every client uses its own key and certificate.

My server config file:

port 1194
proto udp
dev tun0
ca ca.crt
cert OpenVPNServerTEST.crt
key OpenVPNServerTEST.key  
dh dh.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 172.16.254.0 255.255.255.0"
push "route 172.16.1.0 255.255.255.0"
keepalive 10 120
tls-auth ta.key 0
cipher AES-256-CBC   # AES
comp-lzo
;user nobody
;group nobody
persist-key
persist-tun
status openvpn-status.log
log         openvpn.log
log-append  openvpn.log

verb 3

maikcat

tell us more about the juniper device setup,
how many interfaces?firewall rules?ip address per interface?

Michael.

tmolko

Thanks for help. Tried to change the IP address of one of the clients that are able to connect to be the IP address from different subnet - client could not connect so I guess its SRX issue because when I connect clients from same subnet as server, thay can connect. Heres my JSRX config file:


version 10.3R2.11;
system {
    host-name J-SRX210H;
    root-authentication {
        encrypted-password  ## SECRET-DATA
    }
    name-server {
        208.67.222.222;
        208.67.220.220;
    }
    services {
        ssh;
        telnet;
        xnm-clear-text;
        web-management {
            http {
                interface vlan.0;
            }
            https {
                system-generated-certificate;
                interface vlan.0;
            }
        }
        dhcp {
            router {
                192.168.1.1;
            }
            pool 192.168.1.0/24 {
                address-range low 192.168.1.2 high 192.168.1.254;
            }
            propagate-settings ge-0/0/0.0;
        }
    }
    syslog {
        archive size 100k files 3;
        user * {
            any emergency;
        }
        file messages {
            any critical;
            authorization info;
        }
        file interactive-commands {
            interactive-commands error;
        }
    }
    max-configurations-on-flash 5;
    max-configuration-rollbacks 5;
    license {
        autoupdate {
            url https://ae1.juniper.net/junos/key_retrieval;
        }
    }
}
interfaces {
    ge-0/0/0 {
        unit 0 {
            family inet {
                dhcp;
            }
        }
    }
    ge-0/0/1 {
        unit 0 {
            family ethernet-switching {
                port-mode trunk;
                vlan {
                    members [ vlan-trust LAN Management ];
                }
            }
        }
    }
    fe-0/0/2 {
        unit 0 {
            family ethernet-switching {
                port-mode access;
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    fe-0/0/3 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    fe-0/0/4 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    fe-0/0/5 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    fe-0/0/6 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    fe-0/0/7 {
        unit 0 {
            family ethernet-switching {
                port-mode access;
                vlan {
                    members vlan-trust;
                }
            }
        }
    }
    vlan {
        unit 0 {
            family inet {
                address 192.168.1.1/24;
            }
        }
        unit 2 {
            family inet {
                address 172.16.1.1/24;
            }
        }
        unit 254 {
            family inet {
                address 172.16.254.254/24;
            }
        }
    }
}
protocols {
    stp;
}
security {
    nat {
        source {
            rule-set trust-to-untrust {
                from zone trust;
                to zone untrust;
                rule source-nat-rule {
                    match {
                        source-address 0.0.0.0/0;
                    }
                    then {
                        source-nat {
                            interface;
                        }
                    }
                }
            }
        }
    }
    screen {
        ids-option untrust-screen {
            icmp {
                ping-death;
            }
            ip {
                source-route-option;
                tear-drop;
            }
            tcp {
                syn-flood {
                    alarm-threshold 1024;
                    attack-threshold 200;
                    source-threshold 1024;
                    destination-threshold 2048;
                    timeout 20;
                }
                land;
            }
        }
    }
    zones {
        security-zone trust {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                vlan.0;
                vlan.254;
                vlan.2;
            }
        }
        security-zone untrust {
            screen untrust-screen;
            interfaces {
                ge-0/0/0.0 {
                    host-inbound-traffic {
                        system-services {
                            dhcp;
                            tftp;
                        }
                    }
                }
            }
        }
    }
    policies {
        from-zone trust to-zone untrust {
            policy trust-to-untrust {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone trust to-zone trust {
            policy default-permit {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
    }
}
vlans {
    LAN {
        vlan-id 2;
        l3-interface vlan.2;
    }
    Management {
        vlan-id 254;
        l3-interface vlan.254;
    }
    vlan-trust {
        vlan-id 3;
        l3-interface vlan.0;
    }
}

tmolko

Hmm I dont get it - I have only one router, SRX is my router. Let me clear this a little bit:

I cant connect when my client is in different subnet than my vpn server, when theyre on the same subnet, they can connect, but, for example, tftp gives me "timeout" ...

Maybe my config files are wrong?

I cant connect when:

tmolko

Many thanks! I really appreciate your help. Tomorrow I will check those 2 things you mentioned:

1) will try to change udp to tcp
2) will add the policy you suggested
3) ... will ask for further help if needed and if you dont mind 😉

maikcat

is there any firewall running on your openvpn server itself?.

can you ping (from your client) junipers other vlans?

Michael.

tmolko

I turned off firewall on my VPN server machine (Windows 7).

When the OpenVPN is turned off I can ping from Juniper every client. With VPN turned on I can only ping machines from the same subnet.

You mean the problem is with routing? Which static route should I add to the Juniper?

tmolko

I dont know why I cant edit my posts. Anyway, have to clear up something:

With OpenVPN turned off:

1) I can ping every client from JSRX (172.16.1.x, 172.16.254.x, 192.x.x.x)
2) Every client can ping JSRX

With OpenVPN turned on:

1) tried ping 10.8.0.1 from JSRX - failed
2) tried ping 172.16.1.2 from JSRX - ok
3) tried ping 10.8.0.1 from client - failed
4) tried ping 192.168.1.1 from client - ok

Im confused. Should I add some static routes to my JSRX to be able to find 10.8.0.1?

maikcat

lets take it one step at a time...

I turned off firewall on my VPN server machine (Windows 7).

so now you can connect from your 192.x client or not?
did you enabled ip routing on your windows 7? leave firewall down on 7 while testing..

1) tried ping 10.8.0.1 from JSRX - failed

juniper itself is NOT aware about 10.8.0.0/24 network,
you MUST add a static route to it if you need juniper to "talk"
to this network...

keep in mind that after your client establishes vpn traffic destined to 10.8 network
flows transparently over juniper...

please answer the previous questions and i will catch up with you.. 🙂

Michael.