Client can't connect to Clients behind VPN-Server

[deleted]

I have successfully built up a bridged VPN-Network. The VPN-Client can connect to the VPN-Server and both can ping each other.
Within the LAN of the VPN-Server are several more LAN-Clients which I would like to access from my VPN-Client.
But no connection is possible between VPN-Client and LAN-Client. I used Ping for testing.

Now, I believe the routes are somehow misconfigured. I believe a ping from the VPN-Client to the LAN-Client reaches the destination, but then the LAN-Client might not know where to respond the ping to. (Just guessing though...).
Does anybody see the error?

Now the details are:
LAN of VPN-Server:

Gateway: 10.10.10.1
Subnet: 255.255.255.0
VPN-Server: 10.10.10.65
LAN-Clients: 10.10.10.2 ... 10.10.10.253

LAN of VPN-Client:

Gateway: 192.168.128.1
Subnet: 255.255.255.0
VPN-Client: 192.168.128.101

/etc/network/interfaces for the bridge creation:

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
#auto eth0
#iface eth0 inet dhcp

auto eth0
iface eth0 inet manual
up ip link set $IFACE up promisc on

auto br0
iface br0 inet static
address 10.10.10.65
netmask 255.255.255.0
bridge_ports eth0

up.sh Script for VPN startup:

#!/bin/sh

BR=$1
ETHDEV=$2
TAPDEV=$3

/sbin/ip link set "$TAPDEV" up
/sbin/ip link set "$ETHDEV" promisc on
/sbin/brctl addif $BR $TAPDEV

Config of VPN-Server:

port 1194
proto udp
;dev tun
dev tap
up "up.sh br0 eth0"

ca ca.crt
cert vpn-server.crt
key vpn-server.key
dh dh1024.pem

;server 10.8.0.0 255.255.255.0
server-bridge 10.10.10.65 255.255.255.0 10.10.10.128 10.10.10.254
push "route 10.10.10.0 255.0.0.0"
push "dhcp-option DNS 10.10.10.1"
ifconfig-pool-persist ipp.txt
keepalive 10 120
cipher AES-128-CBC # AES
comp-lzo
persist-key
persist-tun
status openvpn-status.log

verb 3

client-to-client

Config of VPN-Client:

client
dev tap
;dev tun
proto udp
remote myserver.dyndns.org 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert vpn-client.crt
key vpn-client.key
ns-cert-type server
cipher AES-128-CBC
comp-lzo
verb 3

[deleted]

--server-bridge gateway netmask pool-start-IP pool-end-IP

Yeah, tried that. It does indeed make sense to put the LAN gateway instead of the VPN-Server. I checked however man openvpn, finding following explanation:

The gateway and netmask parameters to --server-bridge can be set to either the IP/netmask of the bridge interface, or the IP/netmask of the default gateway/router on the bridged subnet.

Within this I understand that I may take either one of them, the LAN-Gateway (in my case 10.10.10.1) or the OpenVPN-Server (in my case 10.10.10.65). Anyway, I checked both without the slightest change in result.

Maybe there are other factors (firewalls!) but you do need to check that is not a problem.

Checked that as well using iptables. I allowed traffic on eth0, tun0, and br0:

user@vpn-server:~$ sudo iptables -L -n
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0

Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

My current OpenVPN-Server configuration currently looks like this:

port 1194
proto udp
dev tap
up "up.sh br0 eth0"

ca ca.crt
cert srv-vpn.crt
key srv-vpn.key
dh dh1024.pem

mode server
tls-server
push "route-gateway dhcp"

;ifconfig-pool-persist ipp.txt
keepalive 10 120
cipher AES-128-CBC # AES
comp-lzo
persist-key
persist-tun
status openvpn-status.log

verb 3

client-to-client

Though the situation is unchanged. As soon as I am connected, I am able to place a ping from the VPN-Client to the VPN-Server, but not from the VPN-Client to any LAN-Client behind the VPN-Server.
There still has to be some misconfiguration.
Any idea where the error could be?

maikcat

2 things,

1) use dev tap0 on your server config not just dev tap

2)according to fellow janjust's book you can use YOUR servers ip address in server-bridge directive (page 79).

Michael.

[deleted]

What about IP Forwarding ?

Good point! At first I thought "of course", sure do I have IP Forwarding, thinking of the router in my network. But then my OpenVPN Server has to do IP Forwarding as well, to let VPN Clients reach the computers in his LAN. Otherwise they would only reach the OpenVPN Server. I tried to find a possiblity to enable IP Forwarding on my OpenVPN Ubuntu Linux Server, and I found:

echo 1 > /proc/sys/net/ipv4/ip_forward

which you have to execute using "sudo -s" before placing this command.
Unfortunately it didn't seem to help, as after setting this, ping requests from VPN Clients to LAN Clients behind the OpenVPN Server still are not responding.
Is there another way to forwad ips? This doesn't seem to be the right way.

You absolutely cannot run your up.sh script from within openvpn.

This is another topic I would place into security issues. But still, what's wrong in executing scripts through the OpenVPN configuration? It seems to work well.