Ping OpenVPN clients from OpenVPN server

jompsi

Hello all

I need to setup a monitoring and for this i need to ping the OpenVPN clients. The OpenVPN server is running on an edge router.

Server.conf:

description "description"
 local-port 1195
 mode server
 openvpn-option "--verb 5"
 protocol udp
 server {
     push-route 192.168.70.0/24
     subnet 10.97.5.0/24
     topology subnet
 }
 tls {
     ca-cert-file /config/auth/vpn/ca.crt
     cert-file /config/auth/vpn/vd-vpn.crt
     dh-file /config/auth/vpn/dh2048.pem
     key-file /config/auth/vpn/vd-vpn.key
 }

I am connecting to the router over openVPN without any problems. I connect with some Windows 7 clients and everything works. They have access to the network and the openvpn server/router is able to ping the clients. Now I connected with a linux debian client and the connection works as well, but the openvpn server/router is not able to ping the client.

linux-debian-client.conf:

tls-client
remote x.x.x.x
dev tun1
port 1195
proto udp
ca testing/ca.crt
cert testing/testing.crt
key testing/testing.key
verb 5

The Linux Debian client is ping-able from his local network. And I enabled in iptables the pings from anywhere, but still, the ping over the openvpn doesnt work 🙁

iptables:

iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT

You got any idea, how i have to configure the debian client, so it allows ping over OpenVPN.

Thanks and regards
jompsi

jompsi

Hi

Thanks for your help. But if my config looks like that:

client
remote x.x.x.x
dev tun1
port 1195
proto udp
ca ca.crt
cert testing.crt
key testing.key
verb 5

But I get this error:

Note: Cannot open TUN/TAP dev /dev/net/tun: No such file or directory (errno=2)
Mon Jul 28 10:04:15 2014 us=142121 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Jul 28 10:04:15 2014 us=142171 /sbin/ifconfig  10.86.19.11 netmask 255.255.255.0 mtu 1500 broadcast 10.86.19.255
SIOCSIFADDR: No such device
: ERROR while getting interface flags: No such device
SIOCSIFNETMASK: No such device
SIOCSIFMTU: No such device
SIOCSIFBRDADDR: No such device
: ERROR while getting interface flags: No such device
Mon Jul 28 10:04:15 2014 us=143893 Linux ifconfig failed: external program exited with error status: 255
Mon Jul 28 10:04:15 2014 us=143931 Exiting

But I think I know what generates the error. This client is a virtual machine. If I use the same config on a physical system it works. Unfortunately I dont have a clue why thats so. Maybe something with routing or so.

From my point of view you can close this task, but if anyone has an idea, i would be really happy 🙂

Thanks and kind regards
jompsi

jompsi

Morning

I dont think the installation generates the error, because with this config:

tls-client
remote x.x.x.x
dev tun1
port 1195
proto udp
ca testing/ca.crt
cert testing/testing.crt
key testing/testing.key
verb 5

I can connect. And for the client everything is available, but the client isnt reachable for the openvpn server.

Thanks and regards
jompsi

jompsi

Hi @debbie10t

Thanks, but the VPN works on the machine. The tun device exists. The problem i had is, that the linux client cant be pinged from the router. BUT the linux client is in the VPN and can ping the router. The OpenVPN works fine. The only thing that bottered me, was that the router cant ping the client.

My physical linux client can be pinged from the router.

Thanks for the help. I am really thankfull. The task can be closed from my point of view.

Kind regards
jompsi

jompsi

Hi Traffic

Traffic wroteOut of curiosity, what virtualization software are you using .. is it your own machine or hosted ?

I use Proxmox as virtualization software and my client is an OpenVZ(container virtualization). The client runs Debian 7 and it is my own machine.

Traffic wroteOpenVPN Server is running on your router?

Yes, it is. It is running on an edge router.

Traffic wroteThe VPN Client can ping the VPN Server (the router)?

Yes, it can ping the router.

Traffic wroteThe VPN Server (the router) cannot ping the VPN Client

Yes, thats the problem I have if I run this on the virtual machine.

The OpenVPN tunnel doesnt work if I use "client" in the config. I get the following error:

Code:
Note: Cannot open TUN/TAP dev /dev/net/tun: No such file or directory (errno=2)
Mon Jul 28 10:04:15 2014 us=142121 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Jul 28 10:04:15 2014 us=142171 /sbin/ifconfig 10.86.19.11 netmask 255.255.255.0 mtu 1500 broadcast 10.86.19.255
SIOCSIFADDR: No such device
: ERROR while getting interface flags: No such device

But if I use "tls-client" in the config, the OpenVPN tunnel works, except that the OpenVPN server(router) cant ping this client.

Traffic wroteWith your client apparently connected to your vpn, do ifconfig and see if your tun device is configured

Wow, you are right. Thats how an ifconfig looks like.

ifconfig
eth0      Link encap:Ethernet  HWaddr ba:21:e6:e2:4d:40
          inet addr:10.200.1.96  Bcast:10.200.1.255  Mask:255.255.255.0
          inet6 addr: fe80::b821:e6ff:fee2:4d40/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:4373373 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3845 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:598549129 (570.8 MiB)  TX bytes:735810 (718.5 KiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:4 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:2304 (2.2 KiB)  TX bytes:2304 (2.2 KiB)

Like you said no tun device. I know debbie10t told me already but I couldnt believe it, because I thought it worked.

So I need to set up a tun device.

Thanks a lot. You showed me, that even when i thought it worked, it wasnt working properly and thanks to debbie10t and sorry for my disbelieve

Kind regards
jompsi