Static key: allow server side machines reach the client

sunmast

Hi, I'm following this tutorial (https://openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html) to setup a simple VPN tunnel between two machines and it works great, thanks OpenVPN!

In the bottom of the tutorial, I find how to allow the client to reach entire server subnet, but I don't know how to do it in the other way: how to allow machines in server subnet to reach the client?

I tried to find information from the main howto document (https://openvpn.net/index.php/open-source/documentation/howto.html#scope) but it seems it's not for static key configuration...

Another question is about "Also, don't forget to enable IP Forwarding on the OpenVPN server machine": I'm running OpenVPN server on Ubuntu, is it enabled by default? If no how to enable it? Is "echo 1 > /proc/sys/net/ipv4/ip_forward" sufficient?

Thanks in advance!

maikcat

hi there,

Another question is about "Also, don't forget to enable IP Forwarding on the OpenVPN server machine": I'm running OpenVPN server on Ubuntu, is it enabled by default? If no how to enable it? Is "echo 1 > /proc/sys/net/ipv4/ip_forward" sufficient?

yes echo 1> ip_forward is sufficient until you reboot...
try using sysctl.conf instead for permanent affect.

but I don't know how to do it in the other way: how to allow machines in server subnet to reach the client?

just configure routing in both sides accordingly...

also configure your iptables (if any) accordingly.

Michael.

sunmast

maikcat wrotehi there,

Another question is about "Also, don't forget to enable IP Forwarding on the OpenVPN server machine": I'm running OpenVPN server on Ubuntu, is it enabled by default? If no how to enable it? Is "echo 1 > /proc/sys/net/ipv4/ip_forward" sufficient?
yes echo 1> ip_forward is sufficient until you reboot...
try using sysctl.conf instead for permanent affect.

but I don't know how to do it in the other way: how to allow machines in server subnet to reach the client?
just configure routing in both sides accordingly...

also configure your iptables (if any) accordingly.

Michael.

Thanks for your reply! With routes configured on both side, I can ping each other, but it's very strange that only ping is working, everything on TCP is not (SMB share, RDP, etc). They are working on local subnet, and I have checked firewall settings on both sides. I suspect the TCP/UDP packets are not routed. Did I miss anything? Thanks!

sunmast

BTW the server is also running as an NAT. I have following lines on rc.local to start NAT:

iptables -A FORWARD -o eth0 -i br0 -s 192.168.1.0/24 -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

iptables -t nat -F POSTROUTING
iptables -t nat -A POSTROUTING -j MASQUERADE

exit 0

Could they be the issue? The eth0 connects to internet, and the br0 is the network bridge for intranet. The tun0/tun1/tun2 are not included in br0.

bridge name     bridge id               STP enabled     interfaces
br0             8000.0000000000df       no              eth1
                                                        eth2
                                                        eth3
                                                        wlan0

Here is the full output of ifconfig -a

br0       Link encap:Ethernet  HWaddr 00:00:00:00:00:df
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::200:ff:fe00:df/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:25642419 errors:0 dropped:0 overruns:0 frame:0
          TX packets:39662188 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:8625014605 (8.6 GB)  TX bytes:52493710913 (52.4 GB)

eth0      Link encap:Ethernet  HWaddr 74:27:ea:d1:a9:04
          inet addr:<my internet ip>  Bcast:255.255.255.255  Mask:255.255.254.0
          inet6 addr: fe80::7627:eaff:fed1:a904/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:84554080 errors:0 dropped:0 overruns:0 frame:0
          TX packets:39906095 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:119926812553 (119.9 GB)  TX bytes:5703293004 (5.7 GB)

eth1      Link encap:Ethernet  HWaddr 00:00:00:00:00:df
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1734050 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:111027968 (111.0 MB)  TX bytes:4374869442 (4.3 GB)

eth2      Link encap:Ethernet  HWaddr 00:00:00:00:01:0b
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:1439822 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:70147470 (70.1 MB)  TX bytes:3898717922 (3.8 GB)

eth3      Link encap:Ethernet  HWaddr 00:00:00:00:01:2b
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:5715 errors:0 dropped:0 overruns:0 frame:0
          TX packets:5715 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:554117 (554.1 KB)  TX bytes:554117 (554.1 KB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.10.0.1  P-t-P:10.10.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:54075657 errors:0 dropped:0 overruns:0 frame:0
          TX packets:21386868 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:76005564488 (76.0 GB)  TX bytes:1151199790 (1.1 GB)

tun1      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.10.1.1  P-t-P:10.10.1.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:69356 errors:0 dropped:0 overruns:0 frame:0
          TX packets:78580 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:5282799 (5.2 MB)  TX bytes:30584387 (30.5 MB)

tun2      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.10.2.1  P-t-P:10.10.2.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wlan0     Link encap:Ethernet  HWaddr 10:9a:dd:9d:c6:98
          inet6 addr: fe80::129a:ddff:fe9d:c698/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:22480519 errors:0 dropped:0 overruns:0 frame:0
          TX packets:33862829 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:8773925635 (8.7 GB)  TX bytes:44949000073 (44.9 GB)

sunmast

Finally I resolved the problem by my self! I added following commands to setup correct routing:

iptables -t nat -A POSTROUTING -o tun0 -d 10.10.0.0/24 -j MASQUERADE
iptables -t nat -A POSTROUTING -o tun1 -d 10.10.1.0/24 -j MASQUERADE
iptables -t nat -A POSTROUTING -o tun2 -d 10.10.2.0/24 -j MASQUERADE

iptables -P FORWARD ACCEPT