Hello,
I try to interconnect 2 sites with several lans.
My first site (my home) hosts a firewall (debian virtual machine -xen-) and the second site (kid's home) hosts a "sky" (debian jessie).
3 lans are connected to "firewall" (192.168.1.0/24, 192.168.3.0/24 and 192.168.4.0/24),
1 lan is connected to sky (192.168.29.0/24).
the vpn uses the network 192.168.100.0/24.
currently on firewall, routing works between its own networks
Now :
- - connection between firewall and sky works
- sky can ping a server on the .3 lan;
- firewall can not ping the .29 lan's@ of sky
- firewall can ping the .100 lan @ of sky
I use tshark to follow icmp packets : sky tun0, sky br0, firewall tun0, firewall eth0
When firewall pings sky vpn address (.100), I sew the data on each tun0 interfaces.
When firewall ping sky local lan address (.29) I only see datas on tun0 of firewall, but no activity on sky tun0 interface (maybe I made a black hole)
Both server have ip forwarding set.
On firewall
- 3 lans : 192.168.1.0/24, 192.168.3.0/24 and 192.168.4.0/24
- openvpn version 2.1.3 , with server.conf
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
dh dh1024.pem
server 192.168.100.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.3.0 255.255.255.0"
push "route 192.168.4.0 255.255.255.0"
push "route 192.168.1.0 255.255.255.0"
client-config-dir ccd
route 192.168.29.0 255.255.255.0
push "route 192.168.29.0 255.255.255.0"
client-to-client
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log openvpn.log
verb 4
and client ccd for sky.lys-net
iroute 192.168.29.0 255.255.255.0
routing table with opencvpn started and sky connected
root@firewall:~# netstat -rn
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
192.168.100.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
192.168.100.0 192.168.100.2 255.255.255.0 UG 0 0 0 tun0
192.168.4.0 0.0.0.0 255.255.255.0 U 0 0 0 eth2
192.168.3.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1
192.168.29.0 192.168.100.2 255.255.255.0 UG 0 0 0 tun0
0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth1
On sky
- 1 lans : 192.168.29.0/24
- openvpn version 2.3.2 , with sky.lys-net/client.conf
client
dev tun
proto udp
remote xx.yy.zz.www 1194
resolv-retry infinite
cipher DES-EDE3-CBC
ca ca.crt
cert sky.lys-net.crt
key sky.lys-net.key
tls-auth ta.key 1
nobind
persist-key
persist-tun
comp-lzo
verb 3
routing table with sky connected
root@sky:~# netstat -rn
Table de routage IP du noyau
Destination Passerelle Genmask Indic MSS Fenêtre irtt Iface
0.0.0.0 192.168.29.1 0.0.0.0 UG 0 0 0 br0
192.168.1.0 192.168.100.21 255.255.255.0 UG 0 0 0 tun0
192.168.3.0 192.168.100.21 255.255.255.0 UG 0 0 0 tun0
192.168.4.0 192.168.100.21 255.255.255.0 UG 0 0 0 tun0
192.168.29.0 0.0.0.0 255.255.255.0 U 0 0 0 br0
192.168.100.0 192.168.100.21 255.255.255.0 UG 0 0 0 tun0
192.168.100.21 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
openvpn.log extract from sky. I don't understand why the client tries to add a route to his own network througth the vpn.
Thu Sep 4 19:06:13 2014 us=164943 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Sep 4 19:06:13 2014 us=242625 PUSH: Received control message: 'PUSH_REPLY,route 192.168.3.0 255.255.255.0,route 192.168.4.0 255.255.255.0,route 192.168.1.0 255.255.255.0,route 192.168.29.0 255.255.255.0,dhcp-option DNS 192.168.3.80,dhcp-option DOMAIN ianco.homelinux.org,route 192.168.100.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 192.168.100.22 192.168.100.21'
Thu Sep 4 19:06:13 2014 us=243606 OPTIONS IMPORT: timers and/or timeouts modified
Thu Sep 4 19:06:13 2014 us=243704 OPTIONS IMPORT: --ifconfig/up options modified
Thu Sep 4 19:06:13 2014 us=243773 OPTIONS IMPORT: route options modified
Thu Sep 4 19:06:13 2014 us=243841 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu Sep 4 19:06:13 2014 us=244656 ROUTE_GATEWAY 192.168.29.1/255.255.255.0 IFACE=br0 HWADDR=00:18:7d:08:ad:1c
Thu Sep 4 19:06:13 2014 us=252360 TUN/TAP device tun0 opened
Thu Sep 4 19:06:13 2014 us=252590 TUN/TAP TX queue length set to 100
Thu Sep 4 19:06:13 2014 us=252715 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Sep 4 19:06:13 2014 us=252888 /sbin/ip link set dev tun0 up mtu 1500
Thu Sep 4 19:06:13 2014 us=263014 /sbin/ip addr add dev tun0 local 192.168.100.22 peer 192.168.100.21
Thu Sep 4 19:06:13 2014 us=277943 /sbin/ip route add 192.168.3.0/24 via 192.168.100.21
Thu Sep 4 19:06:13 2014 us=287862 /sbin/ip route add 192.168.4.0/24 via 192.168.100.21
Thu Sep 4 19:06:13 2014 us=295846 /sbin/ip route add 192.168.1.0/24 via 192.168.100.21
Thu Sep 4 19:06:13 2014 us=307189 /sbin/ip route add 192.168.29.0/24 via 192.168.100.21
RTNETLINK answers: File exists
Thu Sep 4 19:06:13 2014 us=319798 ERROR: Linux route add command failed: external program exited with error status: 2
Thu Sep 4 19:06:13 2014 us=320080 /sbin/ip route add 192.168.100.0/24 via 192.168.100.21
Thu Sep 4 19:06:13 2014 us=327593 Initialization Sequence Completed
Regards,
Yann.
