Connecting to client's subnet.

soimimozo

Greetings.
I would really appreciate some help with my openvpn configuration.
My network scheme:
Client_A-----Server-----Client_B--Subnet
The goal:
Get a connection between Client_A and every device on Client_B's subnet.

Right now I'm able to ping Client_B, using it's subnet IP, but I can't get any response from other machines.

Here is my server config file:

port 1498
proto udp
dev tun
 
ca /etc/openvpn/ca.crt
cert /etc/openvpn/serv.crt
key /etc/openvpn/serv.key
dh /etc/openvpn/dh1024.pem
 
server 10.105.51.0 255.255.255.0

ifconfig-pool-persist ipp.txt
 
keepalive 10 120

client-config-dir ccd

client-to-client
push "route 192.168.1.0 255.255.255.0"

comp-lzo
cipher BF-CBC

persist-key
persist-tun
 
status /etc/openvpn/status_server.log
 
verb 3

Subnet is in 192.168.1.x range. OpenVPN client is a router with 192.168.1.2 address. The gateway is 192.168.1.1 ASDL modem.
So, I can ping 192.168.1.2 router from Client_A, but nothing else.
I have created a file named Client_B in /openvpn/ccd folder, and put:

iroute 192.168.1.0 255.255.255.0

string into it.

Server log:

OpenVPN CLIENT LIST
Updated,Wed Mar 12 13:57:18 2014
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
Client_B,xx.xx.xx.xx:xx,293083,56345,Wed Mar 12 13:24:57 2014
Client_A,xx.xx.xx.xx:xx,55578,299772,Wed Mar 12 13:23:26 2014
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
10.105.51.10,Client_B,xx.xx.xx.xx:xx,Wed Mar 12 13:25:10 2014
10.105.51.6,Client_A,xx.xx.xx.xx:xx,Wed Mar 12 13:42:28 2014
192.168.1.0/24,Client_B,xx.xx.xx.xx:xx,Wed Mar 12 13:24:59 2014
GLOBAL STATS
Max bcast/mcast queue length,1

Thanks in advance.

maikcat

for lan-to-lan scenarios you need:

1) enable ip forwarding on all openvpn clients/server involved

2) add route statements inside server config using clients lan range you want to access

3) use ccd files with iroute statement sing clients lan range you want to access

4) push the necessary routes to your clients

Michael.

soimimozo

Thanks for your reply Michael.
I definitely have a mistake somewhere, but I can't understand where exactly.
1. Ip forwarding is enabled on the server. And since the client with the subnet is a router, it should be enabled there too I suppose.
2. I've added

route 192.168.1.0 255.255.255.0

to the config file. Looks like it did change anything.
3. I have a file in ccd with the name Client_B (the router's name) and string

iroute 192.168.1.0 255.255.255.0

in it.
4. I have this string in the config

push "route 192.168.1.0 255.255.255.0"

, so I suppose it should be enough, right?
Thanks.

soimimozo

did change anything

Just noticed, it supposed to be "did not change anything".

mr.blister

I forgot to set routes to each lan on default gateways in each lan once. So do the clients have a route to each other?

maikcat

please add to your ccd file:

ifconfig-push 10.105.51.22 10.105.51.21

restart your client and check if he gets 10.105.51.22 ip....

if not then his ccd file is not parsed correctly.

Michael.

soimimozo

I forgot to set routes to each lan on default gateways in each lan once. So do the clients have a route to each other?

Thanks for the reply, but I don't get it. Did you mean to set LAN gateway on each openvpn client?
My Client_A can access Client_B with no problem, but I can't access any other device on Client_B's LAN.

please add to your ccd file:

Code:
ifconfig-push 10.105.51.22 10.105.51.21

restart your client and check if he gets 10.105.51.22 ip....

if not then his ccd file is not parsed correctly.

Michael.

Michael, thank you. Tried what you suggested, and got this in the log:

10.105.51.22,Client_B,xx.xx.xx.xx:xx,Fri Mar 14 03:53:40 2014

So I guess, it is fine.

maikcat

The goal:
Get a connection between Client_A and every device on Client_B's subnet.

Right now I'm able to ping Client_B, using it's subnet IP, but I can't get any response from other machines.

ok so far,

choose one pc from client_b side and do:

a tracert to clients_b vpn ip (10.105.51.22)

if this answers then do a tracert to 10.105.51.1 (vpn server tun ip)

and we will talk back again... 🙂
michael.

soimimozo

I'm sorry for the long absence.

Michel, tried ping the Client_B from inside of it's subnet, using VPN IP.
Everything looks fine. I have Linux on all machines inside of the subnet, so I'm using traceroute instead of tracert, but for some reason traceroute won't show me all hops between tracing machine and destination. But I CAN trace it without problems.

Noticed some really weird behavior today. I was able to ping one computer 192.168.1.3 in Client_B's subnet from Client_A, but I was loosing it every few minutes. And when it was reachable, I could not ping the Client_B itself (192.168.1.2 router). It looks like for some reason traffic goes only to any ONE machine in that subnet. I can not ping two destinations at the same time.
192.168.1.3 machine was open for ping for a few minutes after TeamViewer session, and than it stoped to respond to pings, but 192.168.1.2 router started to answer.

soimimozo

Come on guys, no ideas?

soimimozo

Have the feeling that I'm almost there, can't find the source of the problem though.

Tried to run tcpdump on a machine behind Client_B. Looks like it recives packets from Client_A

16:43:49.112917 IP 10.105.51.6 > 192.168.1.3: ICMP echo request, id 16063, seq 83, length 64
16:43:49.112959 IP 192.168.1.3 > 10.105.51.6: ICMP echo reply, id 16063, seq 83, length 64

And even sends a reply, but it doesn't come back. I suppose, it's a routing problem on Client_B's side but routing table looks fine to me:

0.0.0.0	0.0.0.0	192.168.1.1	UG	0	LAN & WLAN
10.105.51.0	255.255.255.0	10.105.51.9	UG	0	tun1
10.105.51.9	255.255.255.255	0.0.0.0	UH	0	tun1
169.254.0.0	255.255.0.0	0.0.0.0	U	0	LAN & WLAN
192.168.1.0	255.255.255.0	0.0.0.0	U	0	LAN & WLAN
192.168.51.0	255.255.255.0	10.105.51.9	UG	0	tun1

soimimozo

Fixed the problem, by adding route to VPN network to Client_B's LAN gateway.