HI,
I'm trying to get my OpenVPN server running on a debian linux box to see the LAN behind a cradlepoint MBR1400. The MBR1400 connects to the OpenVPN server fine, but can not access the LAN behind the router. Here is the basic setup
Debian Linux OpenVPN 2.2.1 - OpenVPN network 10.8.0.0/24
Cradlepoint MBR1400 - OpenVPN client LAN 10.18.0.0/24
OpenVPN server.conf
port 1194
proto udp
dev tun
ca ca.crt
cert HFDR-vpn-acq-server.crt
key HFDR-vpn-acq-server.key # This file should be kept secret
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.18.0.0 255.255.255.0"
push "route 10.8.0.0 255.255.255.0"
client-config-dir ccd
route 10.18.0.0 255.255.255.0
client-to-client
keepalive 10 120
persist-key
persist-tun
status openvpn-status.log
verb 4
contents of file" client-1" in ccd/ directory
iroute 10.18.0.0 255.255.255.0
On the client side, the OpenVPN configs are handled by a series of webpages, but pretty basic stuff (remote server address, port, proto etc).
once the client and server are connected I see the following in the server logs:
Sep 8 23:45:38 ovpn-server[19324]: MULTI: multi_create_instance called
Sep 8 23:45:38 ovpn-server[19324]: xx.xx.xx.xx:3037 Re-using SSL/TLS context
Sep 8 23:45:38 ovpn-server[19324]: xx.xx.xx.xx:3037 Control Channel MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sep 8 23:45:38 ovpn-server[19324]: xx.xx.xx.xx:3037 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
Sep 8 23:45:38 ovpn-server[19324]: xx.xx.xx.xx:3037 Local Options String: 'V4,dev-type tun,link-mtu 1541,tun-mtu 1500,proto UDPv4,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Sep 8 23:45:38 ovpn-server[19324]: xx.xx.xx.xx:3037 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1541,tun-mtu 1500,proto UDPv4,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tlsclient'
Sep 8 23:45:38 ovpn-server[19324]: xx.xx.xx.xx:3037 Local Options hash (VER=V4): '239669a8'
Sep 8 23:45:38 ovpn-server[19324]: xx.xx.xx.xx:3037 Expected Remote Options hash (VER=V4): '3514370b'
Sep 8 23:45:38 ovpn-server[19324]: xx.xx.xx.xx:3037 TLS: Initial packet from [AF_INET]xx.xx.xx.xx:3037, sid=c51cd8b0 51617c4b
Sep 8 23:45:39 ovpn-server[19324]: xx.xx.xx.xx:3037 VERIFY OK: depth=1, *****
Sep 8 23:45:39 ovpn-server[19324]: xx.xx.xx.xx:3037 VERIFY OK: depth=0, *****
Sep 8 23:45:39 ovpn-server[19324]: xx.xx.xx.xx:3037 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sep 8 23:45:39 ovpn-server[19324]: xx.xx.xx.xx:3037 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sep 8 23:45:39 ovpn-server[19324]: xx.xx.xx.xx:3037 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sep 8 23:45:39 ovpn-server[19324]: xx.xx.xx.xx:3037 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sep 8 23:45:39 ovpn-server[19324]: xx.xx.xx.xx:3037 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sep 8 23:45:39 ovpn-server[19324]: xx.xx.xx.xx:3037 [client-1] Peer Connection Initiated with [AF_INET]xx.xx.xx.xx:3037
Sep 8 23:45:39 ovpn-server[19324]: client-1/xx.xx.xx.xx:3037 OPTIONS IMPORT: reading client specific options from: ccd/client-1
Sep 8 23:45:39 ovpn-server[19324]: client-1/xx.xx.xx.xx:3037 MULTI_sva: pool returned IPv4=10.8.0.22, IPv6=5029:4a9e:ea7f:0:9ddd:829b:ea7f:0
Sep 8 23:45:39 ovpn-server[19324]: client-1/xx.xx.xx.xx:3037 MULTI: Learn: 10.8.0.22 -> client-1/xx.xx.xx.xx:3037
Sep 8 23:45:39 ovpn-server[19324]: client-1/xx.xx.xx.xx:3037 MULTI: primary virtual IP for client-1/xx.xx.xx.xx:3037: 10.8.0.22
Sep 8 23:45:39 ovpn-server[19324]: client-1/xx.xx.xx.xx:3037 MULTI: internal route 10.18.0.0/24 -> client-1/xx.xx.xx.xx:3037
Sep 8 23:45:39 ovpn-server[19324]: client-1/xx.xx.xx.xx:3037 MULTI: Learn: 10.18.0.0/24 -> client-1/xx.xx.xx.xx:3037
Sep 8 23:45:39 ovpn-server[19324]: client-1/xx.xx.xx.xx:3037 REMOVE PUSH ROUTE: 'route 10.18.0.0 255.255.255.0'
Sep 8 23:45:41 ovpn-server[19324]: client-1/xx.xx.xx.xx:3037 PUSH: Received control message: 'PUSH_REQUEST'
Sep 8 23:45:41 ovpn-server[19324]: client-1/xx.xx.xx.xx:3037 send_push_reply(): safe_cap=960
Sep 8 23:45:41 ovpn-server[19324]: client-1/xx.xx.xx.xx:3037 SENT CONTROL [client-1]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.22 10.8.0.21' (status=1)
Sep 8 23:45:43 ovpn-server[19324]: client-1/xx.xx.xx.xx:3037 TLS: new session incoming connection from [AF_INET]xx.xx.xx.xx:3037
Sep 8 23:45:44 ovpn-server[19324]: client-1/xx.xx.xx.xx:3037 VERIFY OK: depth=1, *****
Sep 8 23:45:44 ovpn-server[19324]: client-1/xx.xx.xx.xx:3037 VERIFY OK: depth=0, *****
Sep 8 23:45:44 ovpn-server[19324]: client-1/xx.xx.xx.xx:3037 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sep 8 23:45:44 ovpn-server[19324]: client-1/xx.xx.xx.xx:3037 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sep 8 23:45:44 ovpn-server[19324]: client-1/xx.xx.xx.xx:3037 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sep 8 23:45:44 ovpn-server[19324]: client-1/xx.xx.xx.xx:3037 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sep 8 23:45:44 ovpn-server[19324]: client-1/xx.xx.xx.xx:3037 TLS: move_session: dest=TM_ACTIVE src=TM_UNTRUSTED reinit_src=1
Sep 8 23:45:44 ovpn-server[19324]: client-1/xx.xx.xx.xx:3037 TLS: tls_multi_process: untrusted session promoted to semi-trusted
Sep 8 23:45:44 ovpn-server[19324]: client-1/xx.xx.xx.xx:3037 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sep 8 23:45:47 ovpn-server[19324]: client-1/xx.xx.xx.xx:3037 PUSH: Received control message: 'PUSH_REQUEST'
Sep 8 23:45:47 ovpn-server[19324]: client-1/xx.xx.xx.xx:3037 send_push_reply(): safe_cap=960
Sep 8 23:45:47 ovpn-server[19324]: client-1/xx.xx.xx.xx:3037 SENT CONTROL [client-1]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.22 10.8.0.21' (status=1)
Sep 8 23:47:36 ovpn-server[19324]: MULTI: Learn: 10.18.0.1 -> client-1/xx.xx.xx.xx:3037
Sep 8 23:47:39 ovpn-server[19324]: MULTI: Learn: 10.18.0.153 -> client-1/xx.xx.xx.xx:3037
routing table at server
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 xx.xx.xx.193 0.0.0.0 UG 0 0 0 eth0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
10.8.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
10.18.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
xx.xx.xx.192 0.0.0.0 255.255.255.192 U 0 0 0 eth0
routing table at client/MBR1400
Destination Gateway Device UID Flags Metric Type
10.8.0.0/24 10.8.0.21 *iface:tun0 0 unicast
10.8.0.21 * *iface:tun0 0 unicast
10.18.0.0/24 * primarylan 0 unicast
10.168.178.12/30 * 7651045c 0 unicast
fe80::/64 * primarylan 256 unicast
At this point I can access the admin webpages/ssh of the router by 10.8.0.22, but not at 10.18.0.1 nor any of the clients in 10.18.0.0 network. Clients behind the router are not able to ping 10.8.0.1, but can ping 10.8.0.22. Any ideas where I'm messing up?
THANKS!
