Unable to connect single client to network behind VPN Server

DavidB

Situation - One single client connecting to a VPN Server. The VPN Server is part of a private LAN (containing DHCP, DNS, Web, Email, FTP servers and a router). Each machine (including the router) are virtual machines in Virtual Box. The router VM is also the gateway to the Internet for all the machines on the private LAN.

Goal - Have a single client machine connect to the VM containing the VPN Server and have it access all the services/machines behind the server (the DHCP, DNS, Web etc).

Info - All the VMs are on one host. Client is NAT'ed to host, private network (192.168.56.0/24) has access to host through router VM on NAT. IP address of host 192.168.1.100
192.168.56.6 - Address of VPN in the private network
192.168.56.7 - Address of router in the private network - contains 2 interfaces, one into the private network, one out to host for Internet.

Currently, my client can connect to the VPN Server but cannot reach anything on the private LAN.

Does anyone know the procedure I need to take to let my client see/use the services behind the VPN server?

server.conf

port 1194
proto udp
dev tap0
ca ca.crt
cert vpnserver.crt
key vpnserver.key  # This file should be kept secret
dh dh2048.pem
ifconfig-pool-persist ipp.txt
server-bridge 192.168.56.6 255.255.255.0 192.168.56.40 192.168.56.60
push "route 192.168.56.7 255.255.255.0"
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log-append  openvpn.log
verb 6
up "/etc/openvpn/up.sh br0"
down "/etc/openvpn/down.sh br0"

client.conf

client
dev tun
proto udp
remote 192.168.1.100 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert hermione.crt
key hermione.key
ns-cert-type server
comp-lzo
verb 3

DavidB

Thanks for replying debbie10t.

I have made a few changes since this, so I'll explain them below and hopefully my network will make a bit more sense.

Situation and Goal are the same.

Info
IP address of the host is now 192.168.0.65 (instead of 192.168.1.100)
192.168.56.6 - Address of the VPN server which is also the router/default gateway (also contains a 2nd interface to access the Internet on - other machines on the network can successfully access the Internet through this gateway).

I am still unable to reach any other machines behind the VPN server. I can ping the IP address of the VPN (192.168.56.6) but not the IP address of the DHCP/DNS server (192.168.56.1)

Any help is greatly appreciated!

server.conf

port 1194
proto udp
dev tun
ca ca.crt
cert vpnserver.crt
key vpnserver.key  # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
log         openvpn.log
verb 5

client.conf

client
dev tun
proto udp
remote 192.168.1.100 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert hermione.crt
key hermione.key
ns-cert-type server
comp-lzo
log	openvpn-client.log
verb 5

server log

Jul 27 19:04:37 2014 us=895746 MULTI: multi_create_instance called
Sun Jul 27 19:04:37 2014 us=895900 10.0.2.2:53983 Re-using SSL/TLS context
Sun Jul 27 19:04:37 2014 us=895973 10.0.2.2:53983 LZO compression initialized
Sun Jul 27 19:04:37 2014 us=896068 10.0.2.2:53983 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Jul 27 19:04:37 2014 us=896109 10.0.2.2:53983 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Jul 27 19:04:37 2014 us=896163 10.0.2.2:53983 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Sun Jul 27 19:04:37 2014 us=896195 10.0.2.2:53983 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Sun Jul 27 19:04:37 2014 us=896237 10.0.2.2:53983 Local Options hash (VER=V4): '530fdded'
Sun Jul 27 19:04:37 2014 us=896275 10.0.2.2:53983 Expected Remote Options hash (VER=V4): '41690919'
RSun Jul 27 19:04:37 2014 us=896349 10.0.2.2:53983 TLS: Initial packet from [AF_INET]10.0.2.2:53983, sid=99bb567e 1811d5d5
WRRWRWRWWWWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRRRRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRSun Jul 27 19:04:37 2014 us=954344 10.0.2.2:53983 VERIFY OK: depth=1, C=US, ST=NY, L=Rome, O=ACE, OU=TeamJaws, CN=vpn, name=TeamJawsRSA, emailAddress=webmaster@teamjaws.net
Sun Jul 27 19:04:37 2014 us=954767 10.0.2.2:53983 VERIFY OK: depth=0, C=US, ST=NY, L=Rome, O=ACE, OU=TeamJaws, CN=vpn, name=TeamJawsRSA, emailAddress=webmaster@teamjaws.net
WRWRWRWRWRWRWWWWRWRWRWRWRWRWRWRWRWRWRWRWRRRRWRWRWRSun Jul 27 19:04:37 2014 us=968202 10.0.2.2:53983 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Jul 27 19:04:37 2014 us=968243 10.0.2.2:53983 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jul 27 19:04:37 2014 us=968298 10.0.2.2:53983 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Jul 27 19:04:37 2014 us=968322 10.0.2.2:53983 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
WWWRRRSun Jul 27 19:04:37 2014 us=969835 10.0.2.2:53983 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sun Jul 27 19:04:37 2014 us=969887 10.0.2.2:53983 [vpn] Peer Connection Initiated with [AF_INET]10.0.2.2:53983
Sun Jul 27 19:04:37 2014 us=970116 MULTI: new connection by client 'vpn' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Sun Jul 27 19:04:37 2014 us=970148 MULTI_sva: pool returned IPv4=10.8.0.10, IPv6=(Not enabled)
Sun Jul 27 19:04:37 2014 us=970195 MULTI: Learn: 10.8.0.10 -> vpn/10.0.2.2:53983
Sun Jul 27 19:04:37 2014 us=970220 MULTI: primary virtual IP for vpn/10.0.2.2:53983: 10.8.0.10
RSun Jul 27 19:04:39 2014 us=90514 vpn/10.0.2.2:53983 PUSH: Received control message: 'PUSH_REQUEST'
Sun Jul 27 19:04:39 2014 us=90584 vpn/10.0.2.2:53983 send_push_reply(): safe_cap=940
Sun Jul 27 19:04:39 2014 us=90672 vpn/10.0.2.2:53983 SENT CONTROL [vpn]: 'PUSH_REPLY,route 192.168.56.0 255.255.255.0,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.10 10.8.0.9' (status=1)
WWWWRRRRwRwRwRwRwRwRwRwRwWRwRwRwRwRwRwrWRwrWRwRWwRWRwRwWRWRWRRwRWwRwWRw

client log

Sun Jul 27 19:04:49 2014 us=796241 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sun Jul 27 19:04:49 2014 us=796310 TLS Error: TLS handshake failed
Sun Jul 27 19:04:49 2014 us=796424 TCP/UDP: Closing socket
Sun Jul 27 19:04:49 2014 us=796607 SIGUSR1[soft,tls-error] received, process restarting
Sun Jul 27 19:04:49 2014 us=796716 Restart pause, 2 second(s)
Sun Jul 27 19:04:51 2014 us=797434 Re-using SSL/TLS context
Sun Jul 27 19:04:51 2014 us=797582 LZO compression initialized
Sun Jul 27 19:04:51 2014 us=797720 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Jul 27 19:04:51 2014 us=797901 Socket Buffers: R=[212992->131072] S=[212992->131072]
Sun Jul 27 19:04:51 2014 us=797990 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Jul 27 19:04:51 2014 us=798072 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Sun Jul 27 19:04:51 2014 us=798132 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Sun Jul 27 19:04:51 2014 us=798208 Local Options hash (VER=V4): '41690919'
Sun Jul 27 19:04:51 2014 us=798279 Expected Remote Options hash (VER=V4): '530fdded'
Sun Jul 27 19:04:51 2014 us=798372 UDPv4 link local: [undef]
Sun Jul 27 19:04:51 2014 us=798447 UDPv4 link remote: [AF_INET]192.168.0.16:1194
WWWWWSun Jul 27 19:05:51 2014 us=756259 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sun Jul 27 19:05:51 2014 us=756413 TLS Error: TLS handshake failed
Sun Jul 27 19:05:51 2014 us=756581 TCP/UDP: Closing socket
Sun Jul 27 19:05:51 2014 us=756859 SIGUSR1[soft,tls-error] received, process restarting
Sun Jul 27 19:05:51 2014 us=757013 Restart pause, 2 second(s)
Sun Jul 27 19:05:53 2014 us=757533 Re-using SSL/TLS context
Sun Jul 27 19:05:53 2014 us=757733 LZO compression initialized
Sun Jul 27 19:05:53 2014 us=757875 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Jul 27 19:05:53 2014 us=758058 Socket Buffers: R=[212992->131072] S=[212992->131072]
Sun Jul 27 19:05:53 2014 us=758148 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Jul 27 19:05:53 2014 us=758230 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Sun Jul 27 19:05:53 2014 us=758327 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Sun Jul 27 19:05:53 2014 us=758404 Local Options hash (VER=V4): '41690919'
Sun Jul 27 19:05:53 2014 us=758475 Expected Remote Options hash (VER=V4): '530fdded'
Sun Jul 27 19:05:53 2014 us=758549 UDPv4 link local: [undef]
Sun Jul 27 19:05:53 2014 us=758613 UDPv4 link remote: [AF_INET]192.168.0.16:1194
WWWWWSun Jul 27 19:06:53 2014 us=691464 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sun Jul 27 19:06:53 2014 us=691664 TLS Error: TLS handshake failed
Sun Jul 27 19:06:53 2014 us=691869 TCP/UDP: Closing socket
Sun Jul 27 19:06:53 2014 us=692192 SIGUSR1[soft,tls-error] received, process restarting
Sun Jul 27 19:06:53 2014 us=692370 Restart pause, 2 second(s)
Sun Jul 27 19:06:55 2014 us=692929 Re-using SSL/TLS context
Sun Jul 27 19:06:55 2014 us=693071 LZO compression initialized
Sun Jul 27 19:06:55 2014 us=693275 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Jul 27 19:06:55 2014 us=693465 Socket Buffers: R=[212992->131072] S=[212992->131072]
Sun Jul 27 19:06:55 2014 us=693554 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Jul 27 19:06:55 2014 us=693636 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Sun Jul 27 19:06:55 2014 us=693696 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Sun Jul 27 19:06:55 2014 us=693772 Local Options hash (VER=V4): '41690919'
Sun Jul 27 19:06:55 2014 us=693843 Expected Remote Options hash (VER=V4): '530fdded'
Sun Jul 27 19:06:55 2014 us=693918 UDPv4 link local: [undef]
Sun Jul 27 19:06:55 2014 us=693983 UDPv4 link remote: [AF_INET]192.168.0.16:1194
WWWWWSun Jul 27 19:07:55 2014 us=431512 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sun Jul 27 19:07:55 2014 us=431713 TLS Error: TLS handshake failed
Sun Jul 27 19:07:55 2014 us=431902 TCP/UDP: Closing socket
Sun Jul 27 19:07:55 2014 us=432192 SIGUSR1[soft,tls-error] received, process restarting
Sun Jul 27 19:07:55 2014 us=432380 Restart pause, 2 second(s)
Sun Jul 27 19:07:57 2014 us=432886 Re-using SSL/TLS context
Sun Jul 27 19:07:57 2014 us=432986 LZO compression initialized
Sun Jul 27 19:07:57 2014 us=433073 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Jul 27 19:07:57 2014 us=433188 Socket Buffers: R=[212992->131072] S=[212992->131072]
Sun Jul 27 19:07:57 2014 us=433242 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Jul 27 19:07:57 2014 us=433293 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Sun Jul 27 19:07:57 2014 us=433329 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Sun Jul 27 19:07:57 2014 us=433375 Local Options hash (VER=V4): '41690919'
Sun Jul 27 19:07:57 2014 us=433418 Expected Remote Options hash (VER=V4): '530fdded'
Sun Jul 27 19:07:57 2014 us=433463 UDPv4 link local: [undef]
Sun Jul 27 19:07:57 2014 us=433524 UDPv4 link remote: [AF_INET]192.168.0.16:1194
WWWWW

DavidB

Thanks again for replying debbie10t. Good point - I noticed that requirement shortly after posting this but it hasn't made any effect.

I started to debug this using Wireshark:

When I try to ping the DHCP server (192.168.56.1) from the client, the VPN machine receives ICMP packets from the client with a destination address of the DHCP server. The VPN server forwards these packets onto the DHCP server and the DHCP server replies, with a destination address of 10.8.0.10 - the client. However, these packets are not routed onto the tun0 interface and so never get back to the client.

I guess my question is, how do I route traffic:
from the private network 192.168.56.0/24 that is addressed to the 10.8.0.0/24 network
from the local interface (eth1) to the VPN interface (tun0)?

server.conf

port 1194
proto udp
dev tun
ca ca.crt
cert vpnserver.crt
key vpnserver.key  # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.56.0 255.255.255.0"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
log         openvpn.log
verb 5

client.conf

client
dev tun
proto udp
remote 192.168.0.65 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert hermione.crt
key hermione.key
ns-cert-type server
comp-lzo
log	openvpn-client.log
verb 5

DavidB

DavidB wrote
I guess my question is, how do I route traffic:
from the private network 192.168.56.0/24 that is addressed to the 10.8.0.0/24 network
from the local interface (eth1) to the VPN interface (tun0)?

SOLVED!!

I worked it out with a little help from iptables.
I added a line to the FORWARD chain to take any packets on eth1 addressed to 10.8.0.0/24 and forward them to tun0. Now the client can ping other machines and access the services behind the VPN server 🙂

Thanks very much for your help debbie10t, really appreciate it!