OpenVPN:Can ping both sides, but can't connect

asker1234

Hi all, need some help.

Scenario: I have Open VPN running on my LAN on server 192.168.1.10 (readynas box)
I use tunnel brick as clients on my mac machine to connect to my VPN network.

Goal: I'd like to connect to my home LAN from my mac book pro (MBP) when in office or on travel. I use tunnel brick on my MBP to connect to the OpenVPN server that runs at home.

What works: When connected via VPN, I can ping any LAN machine (not just the VPN gateway)
What does not work: For whatever reason, I can't ftp/telnet/http or access any IP level function on any of my LAN machines

If it helps, when I am at office, my local LAN IP for my MBP is 10.6.1.x. The VPN is configured at my home to give out 10.8.0.x addresses

I know for sure there are no firewall issues on the LAN machines - all firewalls are disabled. I have the following 3 LAN machines I'd like to access from my client laptop (Mac, running Mavericks) while in office

192.168.1.10: The VPN server --> everything works - ping as well as ssh/telnet/http
192.168.1.4: An iMac at my home --> ping from office-mac to 192.168.1.4 works. Ping from 192.168.1.4 to my office-mac (using VPN assigned IP of 10.8.0.6) works. But I can't remotely access any thing on this mac except ping it

192.168.1.9: A Windows XP laptop at my home --> ping from office-mac to 192.168.1.9 works. Ping from 192.168.1.9 to my office-mac (using VPN assigned IP of 10.8.0.6) works. But I can't remotely access any thing on this mac except ping it

I'm going nuts. I searched around - many have posted that after OpenVPN is connected, they can't ping other LAN computers. Well I can, I just can't access any of them besides pinging!

This is my server.conf file in the VPN gateway (at 192.168.1.10)

local 192.168.1.10 # This is the IP address of the real network interface on the server connected to the router
port 9876 # This is the port OpenVPN is running on - make sure the router is port forwarding this port to the above IP
proto udp 
push "dhcp-option DNS 8.8.8.8"  # I like to use Google’s DNS
push "dhcp-option DNS 8.8.4.4"  # 
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/MyVPNServer.crt
key /etc/openvpn/MyVPNServer.key
dh /etc/openvpn/dh1024.pem
server 10.8.0.0 255.255.255.0  ifconfig-pool-persist ipp.txt
push "route 192.168.1.0 255.255.255.0"
keepalive 10 120
#reneg-sec 0
cipher BF-CBC        # Blowfish (default) encryption
comp-lzo
max-clients 100 # Assign the maximum number of clients here
persist-key
persist-tun
#persist-tap
status openvpn-status.log
verb 3 
duplicate-cn

IP forwarding has been set to 1 at 192.168.1.10

xxx-readyNAS:/etc/openvpn# cat /proc/sys/net/ipv4/ip_forward
1
xxx-readyNAS:/etc/openvpn#

My gateway router is at 192.168.1.1
Router configuration: (This is a NetGear WNDR3700)

a) I have a port-forward port 9876 TCP/UDP to 192.168.10
b) I have a static route on the router as follows:
Active=Yes, Destination=10.8.0.0, Gateway = 192.168.1.10

My Tunnelbrick client configuration which I use to connect:

client
proto udp
dev tun
remote <my dynamic dns hostname> 9876
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo
cipher BF-CBC
verb 3
#dhcp-option DNS 8.8.8.8
#dhcp-option DNS 8.8.4.4
<ca>
 [Security-related line(s) omitted]
</ca>
<cert>
 [Security-related line(s) omitted]
</cert>
<key>
 [Security-related line(s) omitted]
</key>

If it helps, here is the output of netstat -nr from my LAN XP PC (192.168.1.9) after my MBP connects via OpenVPN

Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 21 70 6b 75 a0 ...... Broadcom 440x 10/100 Integrated Controller - Packet Scheduler Miniport
0x3 ...00 16 44 e3 85 bb ...... Dell Wireless 1395 WLAN Mini-Card - Packet Scheduler Miniport
0x4 ...00 ff d3 75 0c be ...... TAP-Win32 Adapter V8 - Packet Scheduler Miniport
0x5 ...00 ff cc 41 6e f5 ...... TAP-Win32 Adapter OAS - Packet Scheduler Miniport
0x6 ...00 ff 6b 39 68 bb ...... Leaf Networks Adapter - Packet Scheduler Miniport
0x7 ...08 00 27 00 50 29 ...... VirtualBox Host-Only Ethernet Adapter - Packet Scheduler Miniport
0x10009 ...00 ff 00 94 46 8a ...... Juniper Network Connect Virtual Adapter - Hotspot Shield Routing Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1     192.168.1.9	  25
          5.0.0.0        255.0.0.0     5.170.110.83    5.170.110.83	  9000
     5.170.110.83  255.255.255.255        127.0.0.1       127.0.0.1	  9000
    5.255.255.255  255.255.255.255     5.170.110.83    5.170.110.83	  9000
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1	  1
      169.254.0.0      255.255.0.0     5.170.110.83    5.170.110.83	  20
      192.168.1.0    255.255.255.0      192.168.1.9     192.168.1.9	  25
      192.168.1.9  255.255.255.255        127.0.0.1       127.0.0.1	  25
    192.168.1.255  255.255.255.255      192.168.1.9     192.168.1.9	  25
     192.168.56.0    255.255.255.0     192.168.56.1    192.168.56.1	  20
     192.168.56.1  255.255.255.255        127.0.0.1       127.0.0.1	  20
   192.168.56.255  255.255.255.255     192.168.56.1    192.168.56.1	  20
        224.0.0.0        240.0.0.0     5.170.110.83    5.170.110.83	  9000
        224.0.0.0        240.0.0.0      192.168.1.9     192.168.1.9	  25
        224.0.0.0        240.0.0.0     192.168.56.1    192.168.56.1	  20
  255.255.255.255  255.255.255.255     5.170.110.83           10009	  1
  255.255.255.255  255.255.255.255     5.170.110.83               5	  1
  255.255.255.255  255.255.255.255     5.170.110.83    5.170.110.83	  1
  255.255.255.255  255.255.255.255     5.170.110.83               4	  1
  255.255.255.255  255.255.255.255     5.170.110.83               2	  1
  255.255.255.255  255.255.255.255      192.168.1.9     192.168.1.9	  1
  255.255.255.255  255.255.255.255     192.168.56.1    192.168.56.1	  1
Default Gateway:       192.168.1.1
===========================================================================
Persistent Routes:
  None

Route Table

And here is netstat -nr from my home iMac after I connect my MBP through OpenVPN

[xxx@~]$ netstat -nr
Routing tables

Internet:
Destination        Gateway            Flags        Refs      Use   Netif Expire
default            192.168.1.1        UGSc           14        7     en0
127                127.0.0.1          UCS             3    54225     lo0
127.0.0.1          127.0.0.1          UH              8   129138     lo0
127.255.255.255    127.0.0.1          UHW3I           0    54217     lo0     25
169.254            link#4             UCS             1        0     en0
169.254.86.239     78:ca:39:b0:85:5   UHLSW           0        0     en0
192.168.1          link#4             UCS            12        0     en0
192.168.1.1        c0:3f:e:7d:c1:a3   UHLWIir        14     7932     en0   1191
192.168.1.2        0:8:89:f7:42:cf    UHLWI           0       75     en0   1196
192.168.1.4        127.0.0.1          UHS             1    23051     lo0
192.168.1.6        90:b9:31:c7:89:30  UHLWI           0        1     en0    742
192.168.1.9        0:16:44:e3:85:bb   UHLWI           0     1051     en0    665
192.168.1.10       a0:21:b7:5f:3b:1d  UHLWIir         2   234478     en0    580
192.168.1.14       f0:bf:97:4d:7a:c8  UHLWI           0     4521     en0    886
192.168.1.16       dc:3a:5e:bd:57:ba  UHLWI           0        0     en0   1144
192.168.1.25       0:e:58:e1:16:e2    UHLWI           0       50     en0   1163
192.168.1.26       0:e:58:5d:96:40    UHLWI           0     1162     en0   1144
192.168.1.31       link#4             UHLWIi          1      570     en0
192.168.1.94       0:d:4b:45:b6:4     UHLWI           0   614310     en0   1164
192.168.1.255      ff:ff:ff:ff:ff:ff  UHLWbI          0       92     en0

Internet6:
Destination                             Gateway                         Flags         Netif Expire
default                                 fe80::c23f:eff:fe7d:c1a3%en0    UGc             en0
::1                                     ::1                             UHL             lo0
2002:c0a8:640a:e472::/64                link#4                          UC              en0
2002:c0a8:640a:e472:6a5b:35ff:feba:3fad 68:5b:35:ba:3f:ad               UHL             lo0
2002:c0a8:640a:e472:705f:f1ed:b223:fe22 68:5b:35:ba:3f:ad               UHL             lo0
2002:c0a8:640a:e472:c23f:eff:fe7d:c1a3  c0:3f:e:7d:c1:a3                UHLWI           en0
fe80::%lo0/64                           fe80::1%lo0                     UcI             lo0
fe80::1%lo0                             link#1                          UHLI            lo0
fe80::%en0/64                           link#4                          UCI             en0
fe80::1%en0                             link#4                          UHLWI           en0
fe80::6a5b:35ff:feba:3fad%en0           68:5b:35:ba:3f:ad               UHLI            lo0
fe80::c23f:eff:fe7d:c1a3%en0            c0:3f:e:7d:c1:a3                UHLWIir         en0
fe80::%en1/64                           link#5                          UCI             en1
ff01::%lo0/32                           ::1                             UmCI            lo0
ff01::%en0/32                           link#4                          UmCI            en0
ff01::%en1/32                           link#5                          UmCI            en1
ff02::%lo0/32                           ::1                             UmCI            lo0
ff02::%en0/32                           link#4                          UmCI            en0
ff02::%en1/32                           link#5                          UmCI            en1
[xxxx@~]$

SUMMARY: After OpenVPN is connected, everyone can ping everyone else, but I can't connect to any service at the IP level. :cry:

asker1234

Hello, thanks for helping.
No, the home and work lan are not in the same network range

a) Home LAN: 192.168.1.x
b) Office LAN: 10.6.1.x
c) VPN server is configured to generate 10.8.0.x

I'm curious why you felt both office and home LAN are on the same range? If it helps:
the netstat outputs above are both for my home LAN machines (iMac and XP), not of my office MBP

debbie10t wrote
asker1234 wroteI'm going nuts
Unfortunately, your post reflects this.

Let us start with the most glaring possible problem.

It looks very much like your Home And your Work LAN are both 192.168.1.0/24 ..

If so .. OpenVPN will not work until you change one side or the other ..

asker1234

Hi Debbie, I apologize but I could not understand your note below.
As you have correctly quoted below, my first post notes:
a) Office LAN is 10.6.1.x
b) Home LAN is 192.168.1.x
c) VPN range 10.8.0.x

These are all different network ranges, and my office LAN and home LAN do not conflict as you indicated earlier. Or did I make a mistake?

debbie10t wroteIt's a common mistake .. and .. if you search this thread, you will see .. the first time you mention your Work LAN ID is ...
asker1234 wroteb) Office LAN: 10.6.1.x
Also, it would explain why you can ping but cannot connect to services (eg: http)
You might be pinging the wrong machine.

Summary:
1. Server (readynas.box) - Openvpn version: unknown (due to lack of logs): IP 192.168.1.10
2. Client (MBP) - TunnelBrick version: unknown (due to lack of logs): IP 10.6.1.x
3. VPN network range : 10.8.0.0/24
4. LAN XP PC (192.168.1.9)

Readynas Version: OpenVPN 2.0 sparc-unknown-linux [SSL] [LZO] [EPOLL] built on Jan 17 2007
TunnelBrick version: Tunnelblick 3.4beta32 (build 3904)
But as I've indicated above, my office and network LANs are completely different, so I can't be pinging the wrong machine

To expose your server side LAN (IE: LAN XP PC @ 192.168.1.9) your server gateway needs a static route for your VPN.
Or you can NAT your VPN to your Server LAN ..

Check out the HOWTO:
HOWTO: Expanding the scope of the VPN to include additional machines

I do have a static route on my home router as I've indicated in my first post.

asker1234

debbie10t wrote To expose your server side LAN (IE: LAN XP PC @ 192.168.1.9) your server gateway needs a static route for your VPN.
Or you can NAT your VPN to your Server LAN ..

Check out the HOWTO:
HOWTO: Expanding the scope of the VPN to include additional machines

As a followup to your note on the HOWTO you linked me to, this is exactly what I did. I'm either not following you, or you haven't read my first post fully (or maybe its not clear, in which case I'd be happy to clarify)

To quote the relevant FAQ section:

Including multiple machines on the server side when using a routed VPN (dev tun)

This is the one that applies to me

Once the VPN is operational in a point-to-point capacity between client and server, it may be desirable to expand the scope of the VPN so that clients can reach multiple machines on the server network, rather than only the server machine itself.

For the purpose of this example, we will assume that the server-side LAN uses a subnet of 10.66.0.0/24 and the VPN IP address pool uses 10.8.0.0/24 as cited in the server directive in the OpenVPN server configuration file
First, you must advertise the 10.66.0.0/24 subnet to VPN clients as being accessible through the VPN. This can easily be done with the following server-side config file directive:

push "route 10.66.0.0 255.255.255.0"

In my case server side LAN uses 192.168.1.0 and VPN IP pool is 10.8.0.0
Refer to my server.conf file where I have
push "route 192.168.1.0 255.255.255.0"
that meets this point.

Next, you must set up a route on the server-side LAN gateway to route the VPN client subnet (10.8.0.0/24) to the OpenVPN server (this is only necessary if the OpenVPN server and the LAN gateway are different machines).

My OpenVPN server and LAN gateway are different machines. The server is on 192.168.1.10 and the router (LAN Gateway) is 192.168.1.1
Refer to my first post where I wrote I set up a static route in the router as follows:
I have a static route on the router as follows:
Active=Yes, Destination=10.8.0.0, Gateway = 192.168.1.10

Make sure that you've enabled IP and TUN/TAP forwarding on the OpenVPN server machine.

Refer to my first post where I confirmed OpeNVPN server has IP forwarding as:
xxx-readyNAS:/etc/openvpn# cat /proc/sys/net/ipv4/ip_forward
1
xxx-readyNAS:/etc/openvpn#

Finally, to your concern that I may be pinging the wrong machines, no, that is not the case. If I switch off my home iMac which is 192.168.1.4 or my home XP which is 192.168.1.9, and connect via VPN to my home LAN, I can't ping them anymore.

asker1234

Here you go. Made no difference

openvpn --version
OpenVPN 2.3.4 sparc-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Aug  7 2014
library versions: OpenSSL 0.9.8g 19 Oct 2007, LZO 1.08
Originally developed by James Yonan
Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>
Compile time defines: enable_crypto=yes enable_debug=yes enable_def_auth=yes enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=yes enable_fragment=yes enable_http_proxy=yes enable_iproute2=no enable_libtool_lock=yes enable_lzo=yes enable_lzo_stub=no enable_management=yes enable_multi=yes enable_multihome=yes enable_pam_dlopen=no enable_password_save=no enable_pedantic=no enable_pf=yes enable_pkcs11=no enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=no enable_server=yes enable_shared=yes enable_shared_with_static_runtimes=no enable_small=no enable_socks=yes enable_ssl=yes enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=no enable_win32_dll=yes enable_x509_alt_username=no with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no with_plugindir='$(libdir)/openvpn/plugins' with_sysroot=no

debbie10t wrote
asker1234 wroteReadynas Version: OpenVPN 2.0 sparc-unknown-linux [SSL] [LZO] [EPOLL] built on Jan 17 2007
Ouch! .. I think you are now the current record holder for using the oldest version I have seen.

You will have to upgrade this.

asker1234

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

asker1234

Some more input, I ran tcpdump on the OpenVPN server after connecting via tunnel brick from my office laptop

xxxx-readyNAS:~# tcpdump -vvv -i tun0 dst host 192.168.1.20
tcpdump: WARNING: arptype 65534 not supported by libpcap - falling back to cooked socket
tcpdump: listening on tun0, link-type LINUX_SLL (Linux cooked), capture size 96 bytes

Here is the tcpdump output on the server when I did "ping 192.168.1.20"

(192.168.1.20 is a network printer at my home that is running a web server too. I can't use my home iMac which is at 192.168.1.4 which was what I was referring to in previous posts - as it is currently off)

15:20:33.948646 IP (tos 0x0, ttl  64, id 56501, offset 0, flags [none], length: 84) 10.8.0.6 > 192.168.1.20: icmp 64: echo request seq 0
15:20:34.948166 IP (tos 0x0, ttl  64, id 41190, offset 0, flags [none], length: 84) 10.8.0.6 > 192.168.1.20: icmp 64: echo request seq 1
15:20:35.946863 IP (tos 0x0, ttl  64, id 43272, offset 0, flags [none], length: 84) 10.8.0.6 > 192.168.1.20: icmp 64: echo request seq 2
15:20:36.950771 IP (tos 0x0, ttl  64, id 65428, offset 0, flags [none], length: 84) 10.8.0.6 > 192.168.1.20: icmp 64: echo request seq 3

Looks good to me.

But here is when I open a web browser and try and connect to the web server running on 192.168.1.20, here is the output of tcpdump I am seeing on openvpn server

15:21:12.065079 IP (tos 0x0, ttl  64, id 63544, offset 0, flags [DF], length: 64) 10.8.0.6.51235 > 192.168.1.20.www: S [tcp sum ok] 845445377:845445377(0) win 65535 <mss 1368,nop,wscale 4,nop,nop,timestamp 995959942 0,sackOK,eol>
15:21:13.168506 IP (tos 0x0, ttl  64, id 27781, offset 0, flags [DF], length: 64) 10.8.0.6.51235 > 192.168.1.20.www: S [tcp sum ok] 845445377:845445377(0) win 65535 <mss 1368,nop,wscale 4,nop,nop,timestamp 995961041 0,sackOK,eol>

If that "www" means world wide web, is my openvpn server at 192.168.1.10 trying to route this outside of its LAN? If so, why? Is that the problem?

asker1234

Thanks. I can assure you none of these home LAN machines have any form of firewalls active. I do think its a routing issue.

I ran tcpdump for the following situations on my readynas:

1. When my office client connects to the web server of 192.168.1.1 (my home router)

tcpdump logs

16:08:23.738473 IP 10.8.0.6.53229 > 192.168.1.1.www: S 1114180499:1114180499(0) win 65535 <mss 1368,nop,wscale 4,nop,nop,timestamp 998752188 0,sackOK,eol>
16:08:23.738874 IP 192.168.1.1.www > 10.8.0.6.53229: S 1247588274:1247588274(0) ack 1114180500 win 5792 <mss 1460,sackOK,timestamp 116408912 998752188,nop,wscale 1>
16:08:23.767071 IP 10.8.0.6.53229 > 192.168.1.1.www: . ack 1 win 8220 <nop,nop,timestamp 998752217 116408912>
16:08:23.772201 IP 10.8.0.6.53229 > 192.168.1.1.www: P 1:322(321) ack 1 win 8220 <nop,nop,timestamp 998752218 116408912>
16:08:23.772541 IP 192.168.1.1.www > 10.8.0.6.53229: . ack 322 win 3432 <nop,nop,timestamp 116408946 998752218>
16:08:23.773143 IP 192.168.1.1.www > 10.8.0.6.53229: P 1:508(507) ack 322 win 3432 <nop,nop,timestamp 116408946 998752218>
16:08:23.773283 IP 192.168.1.1.www > 10.8.0.6.53229: F 508:508(0) ack 322 win 3432 <nop,nop,timestamp 116408946 998752218>

In otherwords, from my office client, I am able to access my home router web service just fine

But when I try to connect to the http server on 192.168.1.20, I just get the TCP "SYN" packet (if I am reading tcpdump correctly) from the VPN server to 192.168.1.20, but no TCP ACK from 192.168.1.20

16:08:31.907271 IP 10.8.0.6.53249 > 192.168.1.20.www: S 4043809387:4043809387(0) win 65535 <mss 1368,nop,wscale 4,nop,nop,timestamp 998759573 0,sackOK,eol>
16:08:32.947251 IP 10.8.0.6.53249 > 192.168.1.20.www: S 4043809387:4043809387(0) win 65535 <mss 1368,nop,wscale 4,nop,nop,timestamp 998760581 0,sackOK,eol>
16:08:34.051299 IP 10.8.0.6.53249 > 192.168.1.20.www: S 4043809387:4043809387(0) win 65535 <mss 1368,nop,wscale 4,nop,nop,timestamp 998761675 0,sackOK,eol>
16:08:35.154045 IP 10.8.0.6.53249 > 192.168.1.20.www: S 4043809387:4043809387(0) win 65535 <mss 1368,nop,wscale 4,nop,nop,timestamp 998762710 0,sackOK,eol>

Since I have a static route on 192.168.1.1 (my router) saying 10.8.0.0 goes to 192.168.1.10, it works there.
Which seems to indicate to me that 192.168.1.20 (or any other LAN client) does not have a route back to recognize 10.8.0.x to get to 192.168.1.10 as its gateway. Now that is very odd, if they can ping, then a route exists isn't it? What I also find odd is 192.168.1.1 is the default gateway for my home LAN. If my home gateway (192.168.1.1) has a static route that maps 10.8.0.0 to 192.168.1.10, how come my home LAN clients can't respond to the TCP SYN?

Anyway, I'll see if I can upgrade the readynas firmware to one that supports iptables in its kernel. The problem is I can't really recompile my own stuff at the kernel level because it breaks a lot of apps at the user space level (Infact, I almost killed my NAS when I tried to upgrade openvpn to the latest version that you suggested above - see this ;-) )

On your suggestion about using another always on machine, I am trying to avoid it simply because besides the readyNAS I don't have any other machines at home that are always on except my iMac - and it is not openVPN server friendly.

asker1234

Quick update: I migrated my OpenVPN server to an old windows machine I had lying around. Used the same configuration files I had running on my readynas. Everything works just fine - I can access all LAN client services, including the web server in the printer

It's interesting why windows does not need NAT masquerading, just ip forwarding seems to work.

asker1234

Windows 7

Traffic wroteCuriosity: What version of windows ?

asker1234

Traffic wrote
asker1234 wrote's interesting why windows does not need NAT masquerading, just ip forwarding seems to work
Perhaps windows is doing NAT for you .. try using wireshark and see for yourself.

Ah you are right. In windows 7, when you enable "Internet Connection Sharing" as part of the HOWTO in the openvpn guide, you are actually enabling NAT masquerading. I forgot I did that (it was just a check box).