OpenVPN with several VLANs problems to reach VLAN

cybermania

Hello,

What I try to do is the following:

On our main server (CentOS) I've installed OpenVPN (OpenVPN 2.2.2), also on this server there are several connections through one interface to different VLANs.

The ifcfg-eth0 file only contains bootproto, hwaddr and so on, but on the eth0.2, eth0.6 and so on are the VLANs and the desired IP address to join the VLAN configured. eth0.2 is our public IP.

When starting OpenVPN server and client, the VPN connection is set up. But after that I can`t ping IP's in the several VLANs. From the server itself it is pinging good. I would to get access to all the VLANs from my desktop so I could use the internal interfaces of the devices.

My server config:

local myserverhostname
mode server
tls-server
port 1194
proto udp
dev tun
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
server 172.16.1.0 255.255.255.0
keepalive 10 60
comp-lzo
persist-key
persist-tun
persist-local-ip
persist-remote-ip
verb 4
no-replay
push "route 172.16.2.0 255.255.255.0 vpn_gateway"
push "route 172.16.3.0 255.255.255.0 vpn_gateway"
push "route 172.16.4.0 255.255.255.0 vpn_gateway"
push "route 172.16.5.0 255.255.255.0 vpn_gateway"
push "route 172.16.6.0 255.255.255.0 vpn_gateway"

My client config:

client
remote theserverhostname or IP 1194
proto udp
port 9050
dev tun
keepalive 10 60
comp-lzo
persist-key
persist-tun
persist-local-ip
persist-remote-ip
verb 4
no-replay
dh keys/own/dh1024.pem
ca keys/own/ca.crt
cert keys/own/own.crt
key keys/own/own.key
route 172.16.0.0 255.255.255.0 vpn_gateway

I tried different IPtables rules I found over the forums here, but it didn`t succeed. Any help to get this working would be appriciated, working on it a whole morning and still no luck.

cybermania

Yes, it is indeed the public name of the server.

If I'm correct your scheme would only work when there are multiple physical interfaces.

cybermania

debbie10t wroteDo you have a router to the internet or is your server also the router ?

Our network provider does the routing for us. Our switch gives the routes to our network. The OpenVPN server is running on a server with one connection to the switch. We have several devices in several VLAN's that we would like to have access to with OpenVPN.

Listening to the DNS name is not my biggest concern at the moment. Getting access through OpenVPN to my VLANs is prio number one. But maybe it's a misunderstanding and would your comment achieve that.

cybermania

debbie10t wroteI am not sure how your network is configured .. so not much I can do to help there.

However, have you enabled IP Forwarding on your server ?

Finally, you don't want to put routing rules in the client configs, it is easier to manage by pushing them from the server.

ISP with routing our public subnet -> our switch -> our servers.
The servers are in several VLANs, our management server is in all vlan's (ifcfg-eth0.6, 0.7, 0.9 and so on)

So the server.conf contains the push routes to the client, also see:

push "route 172.16.2.0 255.255.255.0 vpn_gateway"
push "route 172.16.3.0 255.255.255.0 vpn_gateway"
push "route 172.16.4.0 255.255.255.0 vpn_gateway"
push "route 172.16.5.0 255.255.255.0 vpn_gateway"
push "route 172.16.6.0 255.255.255.0 vpn_gateway"

IP forwarding is on (returns 1).

The only problem looks like some routing or IPtable rules for using the different subnets so I can visit the IP's in all the different VLANs.

cybermania

debbie10t wrotePlease post ifconfig and route for the server machine.

The output of ifconfig:

eth0      Link encap:Ethernet  HWaddr 78:2B:CB:27:20:5A  
          inet6 addr: fe80::7a2b:cbff:fe27:205a/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:81955 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4547 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:6161321 (5.8 MiB)  TX bytes:622750 (608.1 KiB)

eth0.2    Link encap:Ethernet  HWaddr 78:2B:CB:27:20:5A  
          inet addr:our.public.ip.5  Bcast:our.public.ip.255  Mask:255.255.255.0
          inet6 addr: fe80::7a2b:cbff:fe27:205a/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:81912 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4422 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:4356493 (4.1 MiB)  TX bytes:576370 (562.8 KiB)

eth0.6    Link encap:Ethernet  HWaddr 78:2B:CB:27:20:5A  
          inet addr:172.16.2.5  Bcast:172.16.2.255  Mask:255.255.255.0
          inet6 addr: fe80::7a2b:cbff:fe27:205a/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:15 errors:0 dropped:0 overruns:0 frame:0
          TX packets:63 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:730 (730.0 b)  TX bytes:4822 (4.7 KiB)

eth0.7    Link encap:Ethernet  HWaddr 78:2B:CB:27:20:5A  
          inet addr:172.16.3.2  Bcast:172.16.3.255  Mask:255.255.255.0
          inet6 addr: fe80::7a2b:cbff:fe27:205a/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:6 errors:0 dropped:0 overruns:0 frame:0
          TX packets:15 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:256 (256.0 b)  TX bytes:846 (846.0 b)

eth0.8    Link encap:Ethernet  HWaddr 78:2B:CB:27:20:5A  
          inet addr:172.16.4.2  Bcast:172.16.4.255  Mask:255.255.255.0
          inet6 addr: fe80::7a2b:cbff:fe27:205a/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:6 errors:0 dropped:0 overruns:0 frame:0
          TX packets:15 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:256 (256.0 b)  TX bytes:846 (846.0 b)

eth0.9    Link encap:Ethernet  HWaddr 78:2B:CB:27:20:5A  
          inet addr:172.16.5.2  Bcast:172.16.5.255  Mask:255.255.255.0
          inet6 addr: fe80::7a2b:cbff:fe27:205a/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:5 errors:0 dropped:0 overruns:0 frame:0
          TX packets:15 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:210 (210.0 b)  TX bytes:846 (846.0 b)

eth0.10   Link encap:Ethernet  HWaddr 78:2B:CB:27:20:5A  
          inet addr:172.16.6.2  Bcast:172.16.6.255  Mask:255.255.255.0
          inet6 addr: fe80::7a2b:cbff:fe27:205a/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:7 errors:0 dropped:0 overruns:0 frame:0
          TX packets:12 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:302 (302.0 b)  TX bytes:720 (720.0 b)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:31 errors:0 dropped:0 overruns:0 frame:0
          TX packets:31 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:2712 (2.6 KiB)  TX bytes:2712 (2.6 KiB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:172.16.1.1  P-t-P:172.16.1.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

And the route info with openvpn started:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
172.16.1.2      *               255.255.255.255 UH    0      0        0 tun0
172.16.6.0      *               255.255.255.0   U     0      0        0 eth0.10
172.16.4.0      *               255.255.255.0   U     0      0        0 eth0.8
172.16.5.0      *               255.255.255.0   U     0      0        0 eth0.9
172.16.2.0      *               255.255.255.0   U     0      0        0 eth0.6
172.16.3.0      *               255.255.255.0   U     0      0        0 eth0.7
172.16.1.0      172.16.1.2      255.255.255.0   UG    0      0        0 tun0
xx.xx.51.0     *               255.255.255.0   U     0      0        0 eth0.2
link-local      *               255.255.0.0     U     1002   0        0 eth0
link-local      *               255.255.0.0     U     1010   0        0 eth0.10
link-local      *               255.255.0.0     U     1011   0        0 eth0.2
link-local      *               255.255.0.0     U     1012   0        0 eth0.6
link-local      *               255.255.0.0     U     1013   0        0 eth0.7
link-local      *               255.255.0.0     U     1014   0        0 eth0.8
link-local      *               255.255.0.0     U     1015   0        0 eth0.9
default         xx.xx.51.1     0.0.0.0         UG    0      0        0 eth0.2

And the route info with openvpn stopped:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
172.16.6.0      *               255.255.255.0   U     0      0        0 eth0.10
172.16.4.0      *               255.255.255.0   U     0      0        0 eth0.8
172.16.5.0      *               255.255.255.0   U     0      0        0 eth0.9
172.16.2.0      *               255.255.255.0   U     0      0        0 eth0.6
172.16.3.0      *               255.255.255.0   U     0      0        0 eth0.7
xx.xx.51.0     *               255.255.255.0   U     0      0        0 eth0.2
link-local      *               255.255.0.0     U     1002   0        0 eth0
link-local      *               255.255.0.0     U     1010   0        0 eth0.10
link-local      *               255.255.0.0     U     1011   0        0 eth0.2
link-local      *               255.255.0.0     U     1012   0        0 eth0.6
link-local      *               255.255.0.0     U     1013   0        0 eth0.7
link-local      *               255.255.0.0     U     1014   0        0 eth0.8
link-local      *               255.255.0.0     U     1015   0        0 eth0.9
default         xx.xx.51.1     0.0.0.0         UG    0      0        0 eth0.2

cybermania

I changed the eth0.2 interface to a normal eth0 interface. Also I made it an untagged interface as it would normaly be.
Now tried something more, VPN looks like working good. Somehow I need some forwarding or so for iptables to get the vlan's reachable for the clients connected through VPN.