Server can ping only one client

bibrown

I set up OpenVPN server on Windows XP, static IP: 192.168.0.89, VPN IP: 10.8.0.1, turned off firewall on Windows.

I also have 2 clients connecting to server from one machine (Ubuntu, 2 vpn connections from one machine). My clients use their own keys and certificates (client1.key, client1.crt, client2.key, client2.crt).

My client machine has static IP: 192.168.0.197, VPN1 IP: 10.8.0.6 (client1), VPN2 IP: 10.8.0.10 (client2).

I can ping :

1) server to client1 (10.8.0.6)
2) server to client1 and client2 (192.168.0.89 --> 192.168.0.197)

I cant ping:

1) server to client (10.8.0.10) and got the error "connection timed out"

I set up iptables on my client machine:

#!/bin/bash

# OpenVPN
/sbin/iptables -A INPUT -i eth0 -m state --state NEW -p udp --dport 1194 -j ACCEPT
 
# Allow TUN interface connections to OpenVPN server
/sbin/iptables -A INPUT -i tun+ -j ACCEPT
 
# Allow TUN interface connections to be forwarded through other interfaces
/sbin/iptables -A FORWARD -i tun+ -j ACCEPT
/sbin/iptables -A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
 
# NAT the VPN client traffic to the internet
/sbin/iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

server.ovpn:

dev tun0
proto udp
port 1194
ca ca.crt
cert server.crt
key server.key
dh dh.pem
tls-auth ta.key 0
cipher AES-256-CBC
server 10.8.0.0 255.255.255.0
persist-key
persist-tun
keepalive 10 120
ifconfig-pool-persist ipp.txt

client2.conf:

dev tun1
client
proto udp
remote 192.168.0.89 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client2.crt
key client2.key
tls-auth ta.key 1
cipher AES-256-CBC
verb 3
keepalive 10 120

client1.conf:

dev tun0
client
proto udp
remote 192.168.0.89 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
tls-auth ta.key 1
cipher AES-256-CBC
verb 3
keepalive 10 120

maikcat

what exactly are you trying to achieve?

also

/sbin/iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

you have this enabled on your client???

Michael.

bibrown

I want to create 2 (or more) vpn tunnels between server and client (2 machines, first machine - 2 clients, second machine - one server). Client has 2 config files (I consider it having 2 clients). As I wrote, both clients seem to be connected but server can ping only one client (this client can ping the server too). My second client cant be pinged by the server ...

maikcat

I want to create 2 (or more) vpn tunnels between server and client (2 machines, first machine - 2 clients, second machine - one server)

when you are saying clients you mean openvpn instances?

do you want on one pc to start 2 openvpn instances simultaneously?

if yes you will have a routing problem...

What OS is your client?

What exactly do you want to achieve with this kind of setup?

Michael.

bibrown

do you want on one pc to start 2 openvpn instances simultaneously?

Client OS: Xubuntu 12.04, server: Windows XP.

Yes, exactly. I have 2 client config files: client1.conf and clent2.conf and I want to start ten on a single machine:

Xubuntu:

openvpn --config client1.conf
(open new tab in terminal window)
openvpn --config client2.conf

they both are connected to openvpn server (Windows XP) but only one of them can ping and be pinged - is there any way to do what I want here?

bibrown

What routing problems may I have? I dont get it - my second connected client gets another, different IP than my first client, so what kind of routing problems?

jchutch2

Is it on an ESXi server?

maikcat

please use wireshark to log traffic (ping packets)

Michael.

bibrown

Yes, its all on ESXi. Client is the vm and server is the vm. I checked promiscuous mode on vSwitch, accepted but still - I can ping only one connected client even if 2 clients are connected.