Client can ping server but server cannot ping client

Swiety

Hi,
I`ve just made it moreorless working. Server on Debian 7 and client on ArchLinux.

Server config:

dev tun

ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/neutron.crt
key /etc/openvpn/certs/neutron.key
dh /etc/openvpn/certs/dh2048.pem
tls-auth /etc/openvpn/certs/ta.key 0

server 10.10.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

client-to-client
keepalive 1800 4000

cipher DES-EDE3-CBC # Triple-DES
comp-lzo

max-clients 10

user nobody
group nogroup

persist-key
persist-tun

log openvpn.log
status openvpn-status.log
verb 5
mute 20

Logs:

10.10.0.6,nexus4,79.xx.xx.xx:35902,Fri Sep 12 08:47:13 2014

Client seems to get 10.10.0.6 but first thing weird is:

Thu Sep 11 22:35:48 2014 us=238851 IFCONFIG POOL: base=10.10.0.4 size=62, ipv6=0
Thu Sep 11 22:35:48 2014 us=238864 ifconfig_pool_read(), in='nexus4,10.10.0.4', TODO: IPv6
Thu Sep 11 22:35:48 2014 us=238882 succeeded -> ifconfig_pool_set()
Thu Sep 11 22:35:48 2014 us=238891 IFCONFIG POOL LIST
Thu Sep 11 22:35:48 2014 us=238899 nexus4,10.10.0.4
Thu Sep 11 22:35:48 2014 us=238928 Initialization Sequence Completed

Why there is 10.10.0.4 while for client ip is 10.10.0.6 and destination 10.10.0.5 ?

The main problem is, that from client I can ping 10.10.0.1 and when pinging any website i see in traceroute that i`m going through openvpn tunel, but I cannot do the other way which is - CANNOT ping client from server 🙁

It`s OpenVZ VPS and iptables rulles added:

iptables -A INPUT -p udp -m state --state NEW -m udp --dport 1194 -j ACCEPT
iptables -A FORWARD -s 10.10.0.0/24 -j ACCEPT
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
#iptables -t nat -A POSTROUTING -s 10.10.0.0/24 -o eth0 -j MASQUERADE
# in openvz/vservers you may need the following instead
iptables -t nat -A POSTROUTING -s 10.10.0.0/24 -j SNAT --to-source my_public_vps-ip

Any ideas ?

Swiety

ifconfig-pool-persist ipp.txt contains only:

nexus4,10.10.0.4
nexus4,10.10.0.8

In server.conf:

server 10.10.0.0 255.255.255.0

so the subnet is /24

Just add in config:

topology subnet

??

For client iptables ACCEPT ALL:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Should I do some FORWARD or POSTROUTING or sth else ?

Swiety

If you can ping the server from the client then this is almost guaranteed to be your client firewall.

For OpenVPN no rules are required on the client side. You can of course tighten up your security for your own peace of mind or include any rules that you need for your environment.

So why can`t ping client from server ?

Added:

topology subnet

but after restarting openvpn it generates in ipp.txt:

nexus4,10.10.0.4
nexus4,10.10.0.8

Swiety

Config Server:

port 1194
proto udp
dev tun

ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/neutron.crt
key /etc/openvpn/certs/neutron.key
dh /etc/openvpn/certs/dh2048.pem
tls-auth /etc/openvpn/certs/ta.key 0

server 10.10.0.0 255.255.255.0
topology subnet
#ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

client-to-client
keepalive 20 80

cipher DES-EDE3-CBC # Triple-DES
comp-lzo

max-clients 10

user nobody
group nogroup

persist-key
persist-tun

log openvpn.log
status openvpn-status.log
verb 4
mute 20

Config client:

client
remote 89.32.xxx.xxx
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/nexus4.crt
key /etc/openvpn/certs/nexus4.key
cipher DES-EDE3-CBC
comp-lzo yes
dev tun
proto udp
tls-auth /etc/openvpn/certs/ta.key 1
nobind
auth-nocache
script-security 2
persist-key
persist-tun
user nobody
group nogroup
log openvpn.log
status openvpn-status.log
verb 4

LOG SERVER:

Fri Sep 12 21:03:18 2014 us=375078 Connection profiles [default]:
Fri Sep 12 21:03:18 2014 us=375086   proto = udp
Fri Sep 12 21:03:18 2014 us=375093   local = '[UNDEF]'
Fri Sep 12 21:03:18 2014 us=375100   local_port = 1194
Fri Sep 12 21:03:18 2014 us=375107   remote = '[UNDEF]'
Fri Sep 12 21:03:18 2014 us=375114   remote_port = 1194
Fri Sep 12 21:03:18 2014 us=375121   remote_float = DISABLED
Fri Sep 12 21:03:18 2014 us=375129   bind_defined = DISABLED
Fri Sep 12 21:03:18 2014 us=375136   bind_local = ENABLED
Fri Sep 12 21:03:18 2014 us=375143 NOTE: --mute triggered...
Fri Sep 12 21:03:18 2014 us=375157 260 variation(s) on previous 20 message(s) suppressed by --mute
Fri Sep 12 21:03:18 2014 us=375166 OpenVPN 2.2.1 i486-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Jun 19 2013
Fri Sep 12 21:03:18 2014 us=375284 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Fri Sep 12 21:03:18 2014 us=394937 Diffie-Hellman initialized with 2048 bit key
Fri Sep 12 21:03:18 2014 us=395673 Control Channel Authentication: using '/etc/openvpn/certs/ta.key' as a OpenVPN static key file
Fri Sep 12 21:03:18 2014 us=395692 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Sep 12 21:03:18 2014 us=395702 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Sep 12 21:03:18 2014 us=395717 TLS-Auth MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Fri Sep 12 21:03:18 2014 us=395740 Socket Buffers: R=[133120->131072] S=[133120->131072]
Fri Sep 12 21:03:18 2014 us=395936 TUN/TAP device tun0 opened
Fri Sep 12 21:03:18 2014 us=395953 TUN/TAP TX queue length set to 100
Fri Sep 12 21:03:18 2014 us=395965 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Sep 12 21:03:18 2014 us=395985 /sbin/ifconfig tun0 10.10.0.1 netmask 255.255.255.0 mtu 1500 broadcast 10.10.0.255
Fri Sep 12 21:03:18 2014 us=402451 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Fri Sep 12 21:03:18 2014 us=403197 GID set to nogroup
Fri Sep 12 21:03:18 2014 us=403234 UID set to nobody
Fri Sep 12 21:03:18 2014 us=403271 UDPv4 link local (bound): [undef]
Fri Sep 12 21:03:18 2014 us=403286 UDPv4 link remote: [undef]
Fri Sep 12 21:03:18 2014 us=403302 MULTI: multi_init called, r=256 v=256
Fri Sep 12 21:03:18 2014 us=403367 IFCONFIG POOL: base=10.10.0.2 size=252, ipv6=0
Fri Sep 12 21:03:18 2014 us=403408 Initialization Sequence Completed
Fri Sep 12 21:03:32 2014 us=470504 MULTI: multi_create_instance called
Fri Sep 12 21:03:32 2014 us=470568 83.24.175.218:40202 Re-using SSL/TLS context
Fri Sep 12 21:03:32 2014 us=470601 83.24.175.218:40202 LZO compression initialized
Fri Sep 12 21:03:32 2014 us=470719 83.24.175.218:40202 Control Channel MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Fri Sep 12 21:03:32 2014 us=470732 83.24.175.218:40202 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Fri Sep 12 21:03:32 2014 us=470778 83.24.175.218:40202 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher DES-EDE3-CBC,auth SHA1,keysize 192,tls-auth,key-method 2,tls-server'
Fri Sep 12 21:03:32 2014 us=470787 83.24.175.218:40202 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher DES-EDE3-CBC,auth SHA1,keysize 192,tls-auth,key-method 2,tls-client'
Fri Sep 12 21:03:32 2014 us=470826 83.24.175.218:40202 Local Options hash (VER=V4): 'b5edb94e'
Fri Sep 12 21:03:32 2014 us=470839 83.24.175.218:40202 Expected Remote Options hash (VER=V4): '53f7fc82'
Fri Sep 12 21:03:32 2014 us=470876 83.24.175.218:40202 TLS: Initial packet from [AF_INET]83.24.175.218:40202, sid=009a367b fdeb8612
Fri Sep 12 21:03:34 2014 us=295826 83.24.175.218:40202 VERIFY OK: depth=1, /C=PL/ST=PL/L=Raspberry/O=Raspberry/OU=Raspberry/CN=Raspberry/name=Raspberry/emailAddress=swiety@deltahost.pl
Fri Sep 12 21:03:34 2014 us=296123 83.24.175.218:40202 VERIFY OK: depth=0, /C=PL/ST=PL/L=Raspberry/O=Raspberry/OU=Raspbberry/CN=nexus4/name=Raspberry/emailAddress=swiety@deltahost.pl
Fri Sep 12 21:03:34 2014 us=461805 83.24.175.218:40202 Data Channel Encrypt: Cipher 'DES-EDE3-CBC' initialized with 192 bit key
Fri Sep 12 21:03:34 2014 us=461843 83.24.175.218:40202 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Sep 12 21:03:34 2014 us=461853 83.24.175.218:40202 Data Channel Decrypt: Cipher 'DES-EDE3-CBC' initialized with 192 bit key
Fri Sep 12 21:03:34 2014 us=461862 83.24.175.218:40202 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Sep 12 21:03:34 2014 us=538179 83.24.175.218:40202 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Fri Sep 12 21:03:34 2014 us=538228 83.24.175.218:40202 [nexus4] Peer Connection Initiated with [AF_INET]83.24.175.218:40202
Fri Sep 12 21:03:34 2014 us=538258 nexus4/83.24.175.218:40202 MULTI_sva: pool returned IPv4=10.10.0.2, IPv6=1cda:78b7:c468:a9bf:a86b:a9bf:d06e:36b9
Fri Sep 12 21:03:34 2014 us=538302 nexus4/83.24.175.218:40202 MULTI: Learn: 10.10.0.2 -> nexus4/83.24.175.218:40202
Fri Sep 12 21:03:34 2014 us=538313 nexus4/83.24.175.218:40202 MULTI: primary virtual IP for nexus4/83.24.175.218:40202: 10.10.0.2
Fri Sep 12 21:03:36 2014 us=637726 nexus4/83.24.175.218:40202 PUSH: Received control message: 'PUSH_REQUEST'
Fri Sep 12 21:03:36 2014 us=637762 nexus4/83.24.175.218:40202 send_push_reply(): safe_cap=960
Fri Sep 12 21:03:36 2014 us=637838 nexus4/83.24.175.218:40202 SENT CONTROL [nexus4]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route-gateway 10.10.0.1,topology subnet,ping 20,ping-resta

Server-Status:
OpenVPN CLIENT LIST
Updated,Fri Sep 12 21:04:21 2014
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
nexus4,83.24.175.218:40202,7841,8087,Fri Sep 12 21:03:32 2014
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
10.10.0.2,nexus4,83.24.175.218:40202,Fri Sep 12 21:03:34 2014
GLOBAL STATS
Max bcast/mcast queue length,0
END

CLIENT LOG:

Fri Sep 12 21:03:35 2014 us=497134   max_clients = 1024
Fri Sep 12 21:03:35 2014 us=497329   max_routes_per_client = 256
Fri Sep 12 21:03:35 2014 us=497523   auth_user_pass_verify_script = '[UNDEF]'
Fri Sep 12 21:03:35 2014 us=497723   auth_user_pass_verify_script_via_file = DISABLED
Fri Sep 12 21:03:35 2014 us=497920   port_share_host = '[UNDEF]'
Fri Sep 12 21:03:35 2014 us=498117   port_share_port = 0
Fri Sep 12 21:03:35 2014 us=498309   client = ENABLED
Fri Sep 12 21:03:35 2014 us=498505   pull = ENABLED
Fri Sep 12 21:03:35 2014 us=498798   auth_user_pass_file = '[UNDEF]'
Fri Sep 12 21:03:35 2014 us=499025 OpenVPN 2.3.4 armv6l-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Jul  1 2014
Fri Sep 12 21:03:35 2014 us=499351 library versions: OpenSSL 1.0.1g 7 Apr 2014, LZO 2.06
Fri Sep 12 21:03:35 2014 us=500087 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Fri Sep 12 21:03:35 2014 us=511323 Control Channel Authentication: using '/etc/openvpn/certs/ta.key' as a OpenVPN static key file
Fri Sep 12 21:03:35 2014 us=511758 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Sep 12 21:03:35 2014 us=512023 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Sep 12 21:03:35 2014 us=512396 LZO compression initialized
Fri Sep 12 21:03:35 2014 us=513489 Control Channel MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Fri Sep 12 21:03:35 2014 us=514028 Socket Buffers: R=[163840->131072] S=[163840->131072]
Fri Sep 12 21:03:35 2014 us=514464 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Fri Sep 12 21:03:35 2014 us=514995 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher DES-EDE3-CBC,auth SHA1,keysize 192,tls-auth,key-method 2,tls-client'
Fri Sep 12 21:03:35 2014 us=515222 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher DES-EDE3-CBC,auth SHA1,keysize 192,tls-auth,key-method 2,tls-server'
Fri Sep 12 21:03:35 2014 us=515616 Local Options hash (VER=V4): '53f7fc82'
Fri Sep 12 21:03:35 2014 us=515924 Expected Remote Options hash (VER=V4): 'b5edb94e'
Fri Sep 12 21:03:35 2014 us=530965 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Fri Sep 12 21:03:35 2014 us=531692 UDPv4 link local: [undef]
Fri Sep 12 21:03:35 2014 us=532068 UDPv4 link remote: [AF_INET]89.32.xxx.xxx:1194
Fri Sep 12 21:03:35 2014 us=602832 TLS: Initial packet from [AF_INET]89.32.xxx.xxx:1194, sid=f3012aa7 d70a8b42
Fri Sep 12 21:03:36 2014 us=131506 VERIFY OK: depth=1, C=PL, ST=PL, L=Raspberry, O=Raspberry, OU=Raspberry, CN=Raspberry, name=Raspberry, emailAddress=swiety@deltahost.pl
Fri Sep 12 21:03:36 2014 us=136404 VERIFY OK: depth=0, C=PL, ST=PL, L=Raspberry, O=Raspberry, OU=Raspberry, CN=deltahost.pl, name=Raspberry, emailAddress=swiety@deltahost.pl
Fri Sep 12 21:03:37 2014 us=601759 Data Channel Encrypt: Cipher 'DES-EDE3-CBC' initialized with 192 bit key
Fri Sep 12 21:03:37 2014 us=602135 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Sep 12 21:03:37 2014 us=602378 Data Channel Decrypt: Cipher 'DES-EDE3-CBC' initialized with 192 bit key
Fri Sep 12 21:03:37 2014 us=602850 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Sep 12 21:03:37 2014 us=603691 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Fri Sep 12 21:03:37 2014 us=604109 [deltahost.pl] Peer Connection Initiated with [AF_INET]89.32.xxx.xxx:1194
Fri Sep 12 21:03:39 2014 us=701361 SENT CONTROL [deltahost.pl]: 'PUSH_REQUEST' (status=1)
Fri Sep 12 21:03:39 2014 us=773815 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route-gateway 10.10.0.1,topology subnet,ping 20,ping-restart 80,ifconfig 10.
Fri Sep 12 21:03:39 2014 us=775327 OPTIONS IMPORT: timers and/or timeouts modified
Fri Sep 12 21:03:39 2014 us=775601 OPTIONS IMPORT: --ifconfig/up options modified
Fri Sep 12 21:03:39 2014 us=775790 OPTIONS IMPORT: route options modified
Fri Sep 12 21:03:39 2014 us=775978 OPTIONS IMPORT: route-related options modified
Fri Sep 12 21:03:39 2014 us=776426 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Fri Sep 12 21:03:39 2014 us=778101 ROUTE_GATEWAY 192.168.1.1/255.255.255.0 IFACE=eth0 HWADDR=b8:27:eb:b0:d3:6a
Fri Sep 12 21:03:39 2014 us=786566 TUN/TAP device tun0 opened
Fri Sep 12 21:03:39 2014 us=787053 TUN/TAP TX queue length set to 100
Fri Sep 12 21:03:39 2014 us=787364 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Sep 12 21:03:39 2014 us=787779 /usr/bin/ip link set dev tun0 up mtu 1500
Fri Sep 12 21:03:39 2014 us=807682 /usr/bin/ip addr add dev tun0 10.10.0.2/24 broadcast 10.10.0.255
Fri Sep 12 21:03:39 2014 us=829109 /usr/bin/ip route add 89.32.xxx.xxx/32 via 192.168.1.1
RTNETLINK answers: File exists
Fri Sep 12 21:03:39 2014 us=853270 ERROR: Linux route add command failed: external program exited with error status: 2
Fri Sep 12 21:03:39 2014 us=853782 /usr/bin/ip route add 0.0.0.0/1 via 10.10.0.1
Fri Sep 12 21:03:39 2014 us=879513 /usr/bin/ip route add 128.0.0.0/1 via 10.10.0.1
Fri Sep 12 21:03:39 2014 us=889356 GID set to nogroup
Fri Sep 12 21:03:39 2014 us=889903 UID set to nobody
Fri Sep 12 21:03:39 2014 us=890150 Initialization Sequence Completed

CLIENT STATUS:

OpenVPN STATISTICS
Updated,Fri Sep 12 21:09:36 2014
TUN/TAP read bytes,0
TUN/TAP write bytes,0
TCP/UDP read bytes,8882
TCP/UDP write bytes,8636
Auth read bytes,272
pre-compress bytes,0
post-compress bytes,0
pre-decompress bytes,0
post-decompress bytes,0
END

SERVER ROUTES:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.10.0.0       *               255.255.255.0   U     0      0        0 tun0
default         *               0.0.0.0         U     0      0        0 venet0



iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     udp  --  anywhere             anywhere             state NEW udp dpt:openvpn

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  10.10.0.0/24         anywhere
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

CLIENT ROUTE

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         10.10.0.1       128.0.0.0       UG    0      0        0 tun0
default         www.routerlogin 0.0.0.0         UG    204    0        0 eth0
10.10.0.0       *               255.255.255.0   U     0      0        0 tun0
xxx.xxx.32.89.s www.routerlogin 255.255.255.255 UGH   0      0        0 eth0      <- why is it from backward my IP of VPN server ?
128.0.0.0       10.10.0.1       128.0.0.0       UG    0      0        0 tun0
192.168.1.0     *               255.255.255.0   U     204    0        0 eth0

iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Swiety

Any ideas what could be wrong ?