Hello,
I try to configure following openvpn setup:
internet internet
| public ip A (ipv4) | public ip B (ipv4)
^ ^
+--------------------+ +--------------------+
| HOST A | | HOST B |
| tap0 |<------------------->| tap0 |
| 192.168.201.1/10 | openvpn p2p bridge | 192.168.201.2/10 |
| | | |
| tun0 (roadwarrior) | | |
| 192.168.200.1/29 | | |
+--------------------+ +--------------------+
^
|
internet
|
roadwarrior clients (all traffic is routed through vpn/tun0 )
eg. 192.168.200.6 (win7)
Host A and B are directly connected to the internet, each with a fixed ip. I've setup a openvpn p2p mode bridge, which is working fine so far.
On host A, I've added an additional routed roadwarrior setup. Host A and B can ping each other. Roadwarrior clients have internet access through host A and can ping host A, but can't ping host B.
The question now is, what is missing that roadwarrior clients are able to ping host B and vice versa host B is able to ping road warrior clients.
For analyzing I completely turned off my firewall and run 'tcpdump -i tap0 -v icmp' on hosts A + B and ping host B from roadwarriour client:
=> On both hosts A + B I detect incoming icmp requests
root@hostB:~# tcpdump -i tap0 -v icmp
tcpdump: listening on tap0, link-type EN10MB (Ethernet), capture size 65535 bytes
16:45:46.540201 IP (tos 0x0, ttl 63, id 39519, offset 0, flags [none], proto ICMP (1), length 84)
192.168.200.6 > 192.168.201.2: ICMP echo request, id 48979, seq 0, length 64
16:45:47.543304 IP (tos 0x0, ttl 63, id 7666, offset 0, flags [none], proto ICMP (1), length 84)
192.168.200.6 > 192.168.201.2: ICMP echo request, id 48979, seq 1, length 64
16:45:48.541836 IP (tos 0x0, ttl 63, id 48155, offset 0, flags [none], proto ICMP (1), length 84)
192.168.200.6 > 192.168.201.2: ICMP echo request, id 48979, seq 2, length 64
=> but ping response it not received on road warrior client, so it seems the route back from host B to the roadwarrior client is missing. How to set it and where to set it?
ping 192.168.201.2
PING 192.168.201.2 (192.168.201.2): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
routing table of hostA:
root@hostA: netstat -r
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
default gateway.ipv4.fr 0.0.0.0 UG 0 0 0 br0
62.113.241.0 * 255.255.255.0 U 0 0 0 br0
192.168.200.0 192.168.200.2 255.255.255.248 UG 0 0 0 tun0
192.168.200.2 * 255.255.255.255 UH 0 0 0 tun0
192.168.201.0 * 255.255.255.0 U 0 0 0 tap0
routing table of hostB:
root@hostB: netstat -r
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
default gateway.ipv4.fr 0.0.0.0 UG 0 0 0 br0
62.113.218.0 * 255.255.255.0 U 0 0 0 br0
192.168.201.0 * 255.255.255.0 U 0 0 0 tap0
openvpn roadwarrior config on host A
local <host A's public ip>
port 1194
proto udp
dev tun
mode server
server 192.168.200.0 255.255.255.248
push "redirect-gateway def1"
push "dhcp-option DOMAIN internal.mydomain.tld"
push "dhcp-option DNS 192.168.201.1"
push "dhcp-option NTP 192.53.103.108"
push "dhcp-option NTP 192.53.103.104"
#client-to-client
ca /etc/openvpn/ssl/ca.crt
cert /etc/openvpn/ssl/hosta.mydomain.tld.crt
key /etc/openvpn/ssl/hosta.mydomain.tld.key
dh /etc/openvpn/ssl/dh2048.pem
tls-server
user openvpn
group openvpn
persist-tun
persist-key
keepalive 10 120
comp-lzo
log-append /var/log/openvpn/roadwarrior.log
status /var/log/openvpn/roadwarrior-status.log
verb 3
mute 20
openvpn p2p bridge on host A
remote hostb.mydomain.tld
port 1195
proto udp
dev tap0
mode p2p
ifconfig 192.168.201.1 255.255.255.0
user openvpn
group openvpn
ca /etc/openvpn/ssl/ca.crt
cert /etc/openvpn/ssl/hosta.mydomain.tld.crt
key /etc/openvpn/ssl/hosta.mydomain.tld.key
dh /etc/openvpn/ssl/dh2048.pem
tls-server
persist-tun
persist-key
keepalive 10 120
comp-lzo
log-append /var/log/openvpn/p2p.log
status /var/log/openvpn/p2p-status.log
verb 3
mute 20
openvpn p2p bridge on host B
remote hosta.mydomain.tld
port 1195
proto udp
dev tap0
mode p2p
ifconfig 192.168.201.2 255.255.255.0
user openvpn
group openvpn
ca /etc/openvpn/ssl/ca.crt
cert /etc/openvpn/ssl/hostb.mydomain.tld.crt
key /etc/openvpn/ssl/hostb.mydomain.tld.key
dh /etc/openvpn/ssl/dh2048.pem
tls-client
persist-tun
persist-key
keepalive 10 120
comp-lzo
log-append /var/log/openvpn/p2p.log
status /var/log/openvpn/p2p-status.log
verb 3
mute 20
If you need further logs or config files, please let me know.
Regards,
theq
