Hello All,
Great product and great documentation. Thank you for reading my post.
I am trying to give myself full access to the computers and devices behind my embedded linux device after I have established a vpn connection to the Embedded linux openvpn server. So to do this I block all traffic except openvpn and ssh on the server (E1) and I forward all of the traffic from the tun device to the second etherent interface on the embedded device.
PC1 is a windows 7 pc running openvpn windows. Using the gui.
E1 is the embedded linux device with two ethernet interfaces, openvpn server
I only had a switch in there for lack of a crossover cable, dont know what issues this could cause.
I have setup a test case where everything works
SCENARIO 1
PC1 <--cable--> (eth0) E1 (eth1) <----> switch <----> PC2(ubuntu)
After connecting PC1 to the server E1 I can ping the server, and the PC2 device behind it. I've tested with several ports and protocols it seems to work fine. So I moved onto the actual senario.
SCENARIO 2
PC1<-network(complex!)->(eth0) E1 (eth1) <---rj45---> PLC Device (D1)
The complex network in scenario 2 is a corporate network where I'm going through switches and such.
In Senario 2 I can ping the device (D1) from the openvpn server (E1) just fine but I cannot ping it from (PC1). I can also ping (E1-Eth1) from (PC1) so I see I'm getting access to the eth1 side of E1. I dont get it if I can ping from E1 why cant I ping from PC1.
As far as I can tell there is no connectivity between PC1 and D1. This seems really strange to me since in senario1 it worked fine. I have both setups up and running and have tested both several times. The configuration of E1 is identical in both cases as well as PC1
PC1 CONFIGURATION
client
dev tun
proto udp
remote 192.168.1.220
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client2.crt
key client2.key
ns-cert-type server
comp-lzo
verb 3
Wed Mar 12 15:39:24 2014 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Mar 12 15:39:24 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Mar 12 15:39:24 2014 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Mar 12 15:39:24 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Mar 12 15:39:24 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Mar 12 15:39:24 2014 [AutosolCN] Peer Connection Initiated with [AF_INET]192.168.1.220:1194
Wed Mar 12 15:39:25 2014 MANAGEMENT: >STATE:1394656765,GET_CONFIG,,,
Wed Mar 12 15:39:26 2014 SENT CONTROL [AutosolCN]: 'PUSH_REQUEST' (status=1)
Wed Mar 12 15:39:26 2014 PUSH: Received control message: 'PUSH_REPLY,route 172.17.140.0 255.255.255.0,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.8 255.255.255.0'
Wed Mar 12 15:39:26 2014 OPTIONS IMPORT: timers and/or timeouts modified
Wed Mar 12 15:39:26 2014 OPTIONS IMPORT: --ifconfig/up options modified
Wed Mar 12 15:39:26 2014 OPTIONS IMPORT: route options modified
Wed Mar 12 15:39:26 2014 OPTIONS IMPORT: route-related options modified
Wed Mar 12 15:39:26 2014 Preserving previous TUN/TAP instance: Local Area Connection 10
Wed Mar 12 15:39:26 2014 Initialization Sequence Completed
Wed Mar 12 15:39:26 2014 MANAGEMENT: >STATE:1394656766,CONNECTED,SUCCESS,10.8.0.8,192.168.1.220
E1 CONFIGURATION
ServerCerts.conf
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 172.17.140.0 255.255.255.0"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
routing / iptables setup (i have tried flushing them and it still works the same)
#assume defaults for now
WANIF=eth0
SRCIF=tun0
DESTIF=eth1
SRCNET=10.8.0.0/24
if [ $# -eq 1 ]
then
echo "example: ./setupTables 172.17.140.50 172.17.140.0/24"
Exit
fi
if [ $# -ne 2 ]
then
echo "No Arguments, using defaults"
DSTNET=172.17.140.0/24
DESTIP=172.17.140.50
fi
if [ $# -eq 2 ]
then
echo "Using user supplied values"
DESTIP="$1"
DSTNET="$2"
fi
logger -s -t SETUPIPT -p 4 User: $USER ran setuptables WAN: WANIF DEST: $DESTIF DESTIP: $DESTIP
# shut everything down while we enable the right rules
sysctl -w net.ipv4.ip_forward=0
ifconfig $DESTIF down
echo "Stopping firewall and allowing everyone..."
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
# allow established sessions to go through
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
# allow ssh traffic on wan TODO mutual auth for ssh using certs
iptables -A INPUT -i $WANIF -p tcp --dport ssh -j ACCEPT
# allow openvpn connections on the wan, tcp
iptables -A INPUT -i $WANIF -p tcp --dport 1194 -j ACCEPT
# allow openvpn connections on the wan, udp
iptables -A INPUT -i $WANIF -p udp --dport 1194 -j ACCEPT
# make a new log table
iptables -N LOGGING
# any traffic not openvpn or ssh gets logged
iptables -A INPUT -j LOGGING
# setup logging table
iptables -A LOGGING -i $WANIF -j LOG --log-prefix "iptables denied: " --log-level 4
# drop any other traffic (After logging)
iptables -A INPUT -i $WANIF -j DROP
# Allow traffic initiated from VPN to access LAN
iptables -A FORWARD -i $SRCIF -o $DESTIF -s $SRCNET -d $DSTNET -m conntrack --ctstate NEW -j ACCEPT
# Allow traffic initiated from VPN to access "the world"
# this allows traffic to go back out through eth0, i dont think we want this
iptables -I FORWARD -i $SRCIF -o $WANIF -s $SRCNET -m conntrack --ctstate NEW -j ACCEPT
# Allow traffic initiated from LAN to access "the world"
iptables -I FORWARD -i $DESTIF -o $WANIF -s $DSTNET -m conntrack --ctstate NEW -j ACCEPT
# Allow established traffic to pass back and forth
iptables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
# Notice that -I is used, so when listing it (iptables -vxnL) it
# will be reversed. This is intentional in this demonstration.
# Masquerade traffic from VPN to "the world" -- done in the nat table
iptables -t nat -I POSTROUTING -o $WANIF -s $SRCNET -j MASQUERADE
# Masquerade traffic from LAN to "the world"
iptables -t nat -I POSTROUTING -o $WANIF -s $DSTNET -j MASQUERADE
# start dest if and forwarding
ifconfig $DESTIF $DESTIP netmask 255.255.255.0 up
sysctl -w net.ipv4.ip_forward=1
then I run
arm-none-linux-openvpn --daemon openvpn --config ServerCerts.conf
server log
62989
Mar 12 21:37:34 (none) daemon.notice openvpn[940]: CLIENT2/192.168.1.39:62989 MULTI: Learn: 10.8.0.8 -> CLIENT2/192.168.1.39:62989
Mar 12 21:37:34 (none) daemon.notice openvpn[940]: CLIENT2/192.168.1.39:62989 MULTI: primary virtual IP for CLIENT2/192.168.1.39:62989: 10.8.0.8
Mar 12 21:37:35 (none) daemon.notice openvpn[940]: changeme/192.168.1.26:51208 PUSH: Received control message: 'PUSH_REQUEST'
Mar 12 21:37:35 (none) daemon.notice openvpn[940]: changeme/192.168.1.26:51208 SENT CONTROL [changeme]: 'PUSH_REPLY,route 172.17.140.0 255.255.255.0,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.4 255.255.255.0' (status=1)
Mar 12 21:37:37 (none) daemon.notice openvpn[940]: CLIENT2/192.168.1.39:62989 PUSH: Received control message: 'PUSH_REQUEST'
Mar 12 21:37:37 (none) daemon.notice openvpn[940]: CLIENT2/192.168.1.39:62989 SENT CONTROL [CLIENT2]: 'PUSH_REPLY,route 172.17.140.0 255.255.255.0,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.8 255.255.255.0' (status=1)
Mar 12 21:37:41 (none) user.warn SETUPIPT: User: root ran setuptables WAN: WANIF DEST: eth1 DESTIP: 172.17.140.50
