Site-2-Site one site using other sites gateway

mijedk

Hi,

I having some trouble wrapping my head around how to set up a site2site vpn with openvpn, where site2 uses site1's gateway.

My setup is similar this:

Site1:
VPS server, that has one public IPv4, and a /64 IPv6 network assigned to it (on eth0)

Site2:
Sits behind nat, running on net 192.168.1.0/24, has port udp/1194 nat'ed to 192.168.1.10 (the openvpn box)
The openvpn box has two nics (one for 192.168.1.10/24), and one other network (10.9.8.0/24)
I would like that all clients on the 10.9.8.0/24 network uses Site1 as a gateway (pref. with ipv6 working as well, but primarily ipv4 to start with).

I tried to set up a normal client/server vpn, with Site1 being the server, the openvpn in site2 box being a client with the following working config:

Server:
dev tap1
cipher AES-256-CBC
auth SHA384
ifconfig 10.9.8.1 255.255.255.0
secret /etc/openvpn/static.key
keepalive 60 120
comp-lzo yes
up /etc/openvpn/nat.up

#(nat.up containing):
/sbin/iptables -F
/sbin/iptables -F -t nat
/sbin/iptables -t nat -A POSTROUTING -s 10.9.8.0/24 -o eth0 -j MASQUERADE
/sbin/iptables -A FORWARD -i eth0 -o tap1 -m state --state RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -A FORWARD -i tap1 -o eth0 -j ACCEPT

Client:
remote Site1's public ip
dev tap1
cipher AES-256-CBC
auth SHA384
ifconfig 10.9.8.2 255.255.255.0
secret /etc/openvpn/static.key
keepalive 60 120
comp-lzo yes
redirect-gateway def1
route-gateway 10.9.8.1

This all works great, the problem is there will be >20 clients on the 10.9.8.0/24 net on site2, where it would be unpractical to have each one "dial" up to the openvpn server, so i'm trying to figure out how i can let the openvpn box in site2 handle the vpn for the whole subnet, can any of you give me a hint what to search around for?

mijedk

I tried with a bridge config as well:

Server:
dev tap2
cipher AES-256-CBC
auth SHA384
server-bridge 10.1.0.1 255.255.255.0 10.1.0.128 10.1.0.254
keepalive 60 120
comp-lzo yes
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh4096.pem

Client:
dev tap2
cipher AES-256-CBC
auth SHA384
keepalive 60 120
comp-lzo yes
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/client.crt
key /etc/openvpn/easy-rsa/keys/client.key
remote Site1-publicip 1194
tls-client

With a bridge config of:
Server:
br="br0"
tap="tap2"
eth="eth0.10"
eth_ip="10.1.0.1"
eth_netmask="255.255.255.0"
eth_broadcast="10.1.0.255"

Client:
br="br0"
tap="tap2"
eth="eth1"
eth_ip="10.1.0.2"
eth_netmask="255.255.255.0"
eth_broadcast="10.1.0.255"

This works fine like the above, when its just a server/client setup, ping both ways works fine.

I just cant figure out what i'm missing for other clients in the 10.1.0.0/24 network to use site2's openvpn box.
The rest of the clients are on the same subnet as eth1 on site2's openvpn box.

I know its not using optimal settings for security, but just trying to get _any_ data through, in the way i would like it to work, before looking into optimizing the config.

Must be missing something completely obvious?

mijedk

Think i explained it badly, what i meant with other clients on 10.1.0.0/24 was, not clients as in openvpn client, but other client pc's on that subnet.

The above (also tried with the client-to-client option on the server), i can ping both ways fine between the two openvpn boxes, my problem is on site2 (10.1.0.0/24), if i have an additional client pc, with the ip 10.1.0.5 (also tried with 10.1.0.130 in case it needed to be inside the server-bridge pool) i can ping site2's ips, but not the 10.1.0.1 ip on site1 (the openvpn box on site2 itself, can ping the ip), both sites have ip forwarding enabled / no firewall rules blocking anything, nat is set up on site1, and works fine when testing from both openvpn boxes.

The goal i try to reach, is that >20 pc's on the 10.1.0.0/24 network, will route all their traffic through site1's public ip, without having to set up vpn clients on each individual client pc.

mijedk

Got one step further, had forgotten to allow promiscuous mode in vmware on site2, after many reinstalls.

Now both sites (and their client pc's) can see each other, and site2's pc clients, can use the gateway on site1.

Now i just need to find out why ICMP packets to the internet isn't working from site2 client pc's (like pinging 8.8.8.8), and how to get ipv6 to work in some way on site2 client pc's.

But have to wait with that until i get back from work in 8 hours.

mijedk

After 8,5 hours of no progress at all, i'm giving up on getting this to work with anything else than using tap in bridge mode, no matter what options I throw at it (server/client side), it just ignores every single ICMP packet that isn't sent to one of the tunnel ips.

It should have been a pretty simple setup:
1 VPS (openvpn server with public IPv4/6 on eth0)

@Home a normal ISP router with a public ip, with port 1194 nat'ed to my internal network (192.168.1.0/24)
1 VM for the openvpn client with two nics
- eth0 192.168.1.10
- eth1 10.1.0.0/24 network

For testing 1 VM with one nic (eth0) on the 10.1.0.0/24 network (ie not connected to the internal network @home), when working alot more VM's on the 10.1.0.0/24 network.

With tap and bridged mode on both side, that worked fine, except ICMP/IPv6, would like to use tun instead, but no matter which config example i try i just get "MULTI: bad source address from client".

I have read:
http://openvpn.net/index.php/open-source/documentation/howto.html
https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage
https://community.openvpn.net/openvpn/wiki/IPv6
(and several different forums posts/wiki pages)

But that helped my nothing, esp not with getting tun to work in this kind of setup.

mijedk

Tried following the simple tun examples from:
/usr/share/doc/openvpn/examples/sample-config-files/static-office.conf
/usr/share/doc/openvpn/examples/sample-config-files/static-home.conf

And with a simplified setup of just the VPS and the openvpn client VM @home with just eth0:

Server:
dev tun
ifconfig 10.1.0.1 10.1.0.2
up ./office.up
secret static.key

Client:
dev tun
remote publicip
ifconfig 10.1.0.2 10.1.0.1
up ./home.up
secret static.key

Then i can ping both ends of the tunnel.

Then to route all traffic from the client, I added this to the server config:
push "redirect-gateway def1"

Restarted the tunnels, and i can still ping both ways, but no internet traffic is flowing from the client -> server (no packets shown with --verb 6 on either side if ping 8.8.8.8 from the client side).

And adding these iptables rules on the server does nothing to help with it as the howto says:
iptables -t nat -A POSTROUTING -s 10.1.0.0/24 -o eth0 -j MASQUERADE
iptables -A FORWARD -i eth0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT

(again just when using tun, with tap/bridging atleast tcp/udp packets will flow through the tunnel from client -> server for packets to the internet).

Something weird is just going on somewhere, or i'm missing something completely obvious, when using tun instead of tap, in all the examples / howto's etc i have read, the above should just work, but it isn't 🙁.