I have a new install that I can't seem to get configured correctly to give access to resources behind the VPN server. I can successfully connect to the VPN server and once connected can ssh in using the 10.8.0.1 IP. I cannot connect or ping any resources on the subnets listed behind the server. The server itself is running in the 10.2.0.0/16 network.
OS: Amazon Linux
OpenVPN: 2.3.2
IPTables: Not running
net.ipv4.ip_forward = 1
server.conf
port 1194
proto udp
dev tun
keepalive 10 120
comp-lzo
local 0.0.0.0
push route '10.0.0.0 255.255.0.0'
push route '10.1.0.0 255.255.0.0'
push route '10.2.0.0 255.255.0.0'
push route '172.31.0.0 255.255.0.0'
up /etc/openvpn/server.up.sh
# Keys and certificates.
ca /etc/openvpn/keys/ca.crt
key /etc/openvpn/keys/server.key # This file should be kept secret.
cert /etc/openvpn/keys/server.crt
dh /etc/openvpn/keys/dh1024.pem
ifconfig-pool-persist /etc/openvpn/ipp.txt
server 10.8.0.0 255.255.255.0
user nobody
group nobody
# avoid accessing certain resources on restart
persist-key
persist-tun
# current client connections
status /etc/openvpn/openvpn-status.log
# logging settings.
log-append /var/log/openvpn.log
verb 4
mute 10 # suppress identical messages > 10 occurances.
script-security 2
Client OS: OSX
Client: Tunnelblick
client.conf
client
dev tun
proto udp
remote xx.xx.xx.xx 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert xxxx.crt
key xxxx.key
comp-lzo
verb 3
Server logs (start up):
Fri Oct 10 17:28:53 2014 us=795223 Current Parameter Settings:
Fri Oct 10 17:28:53 2014 us=795283 config = 'server.conf'
Fri Oct 10 17:28:53 2014 us=795303 mode = 1
Fri Oct 10 17:28:53 2014 us=795309 persist_config = DISABLED
Fri Oct 10 17:28:53 2014 us=795315 persist_mode = 1
Fri Oct 10 17:28:53 2014 us=795320 show_ciphers = DISABLED
Fri Oct 10 17:28:53 2014 us=795325 show_digests = DISABLED
Fri Oct 10 17:28:53 2014 us=795330 show_engines = DISABLED
Fri Oct 10 17:28:53 2014 us=795335 genkey = DISABLED
Fri Oct 10 17:28:53 2014 us=795340 key_pass_file = '[UNDEF]'
Fri Oct 10 17:28:53 2014 us=795345 NOTE: --mute triggered...
Fri Oct 10 17:28:53 2014 us=795372 274 variation(s) on previous 10 message(s) suppressed by --mute
Fri Oct 10 17:28:53 2014 us=795379 OpenVPN 2.3.2 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Sep 4 2013
Fri Oct 10 17:28:53 2014 us=795543 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Fri Oct 10 17:28:53 2014 us=796549 Diffie-Hellman initialized with 1024 bit key
Fri Oct 10 17:28:53 2014 us=796730 WARNING: file '/etc/openvpn/keys/server.key' is group or others accessible
Fri Oct 10 17:28:53 2014 us=796866 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Fri Oct 10 17:28:53 2014 us=796884 Socket Buffers: R=[212992->131072] S=[212992->131072]
Fri Oct 10 17:28:53 2014 us=796950 ROUTE_GATEWAY 10.2.2.1/255.255.255.0 IFACE=eth0 HWADDR=0a:3b:95:80:3d:c2
Fri Oct 10 17:28:53 2014 us=797306 TUN/TAP device tun0 opened
Fri Oct 10 17:28:53 2014 us=797320 TUN/TAP TX queue length set to 100
Fri Oct 10 17:28:53 2014 us=797331 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Oct 10 17:28:53 2014 us=797346 /sbin/ip link set dev tun0 up mtu 1500
Fri Oct 10 17:28:53 2014 us=798601 /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
Fri Oct 10 17:28:53 2014 us=800292 /etc/openvpn/server.up.sh tun0 1500 1542 10.8.0.1 10.8.0.2 init
net.ipv4.ip_forward = 1
Fri Oct 10 17:28:53 2014 us=802710 /sbin/ip route add 10.8.0.0/24 via 10.8.0.2
Fri Oct 10 17:28:53 2014 us=804281 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Fri Oct 10 17:28:53 2014 us=806042 GID set to nobody
Fri Oct 10 17:28:53 2014 us=806076 UID set to nobody
Fri Oct 10 17:28:53 2014 us=806091 UDPv4 link local (bound): [undef]
Fri Oct 10 17:28:53 2014 us=806098 UDPv4 link remote: [undef]
Fri Oct 10 17:28:53 2014 us=806107 MULTI: multi_init called, r=256 v=256
Fri Oct 10 17:28:53 2014 us=806159 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Fri Oct 10 17:28:53 2014 us=806186 ifconfig_pool_read(), in='wlillyw,10.8.0.4', TODO: IPv6
Fri Oct 10 17:28:53 2014 us=806202 succeeded -> ifconfig_pool_set()
Fri Oct 10 17:28:53 2014 us=806211 IFCONFIG POOL LIST
Fri Oct 10 17:28:53 2014 us=806218 wlillyw,10.8.0.4
Fri Oct 10 17:28:53 2014 us=806281 Initialization Sequence Completed
Server log (connect)
Fri Oct 10 17:30:19 2014 us=214223 MULTI: multi_create_instance called
Fri Oct 10 17:30:19 2014 us=214298 70.211.73.106:2257 Re-using SSL/TLS context
Fri Oct 10 17:30:19 2014 us=214332 70.211.73.106:2257 LZO compression initialized
Fri Oct 10 17:30:19 2014 us=214495 70.211.73.106:2257 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Fri Oct 10 17:30:19 2014 us=214507 70.211.73.106:2257 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Fri Oct 10 17:30:19 2014 us=214547 70.211.73.106:2257 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Fri Oct 10 17:30:19 2014 us=214560 70.211.73.106:2257 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Fri Oct 10 17:30:19 2014 us=214579 70.211.73.106:2257 Local Options hash (VER=V4): '530fdded'
Fri Oct 10 17:30:19 2014 us=214589 70.211.73.106:2257 Expected Remote Options hash (VER=V4): '41690919'
Fri Oct 10 17:30:19 2014 us=214624 70.211.73.106:2257 TLS: Initial packet from [AF_INET]70.211.73.106:2257, sid=97b58a95 5ee67f50
Fri Oct 10 17:30:20 2014 us=892435 70.211.73.106:2257 VERIFY OK: XXXXX
Fri Oct 10 17:30:20 2014 us=892550 70.211.73.106:2257 VERIFY OK: XXXXX
Fri Oct 10 17:30:21 2014 us=182312 70.211.73.106:2257 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Oct 10 17:30:21 2014 us=182351 70.211.73.106:2257 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Oct 10 17:30:21 2014 us=182393 70.211.73.106:2257 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Oct 10 17:30:21 2014 us=182400 70.211.73.106:2257 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Oct 10 17:30:21 2014 us=321714 70.211.73.106:2257 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Fri Oct 10 17:30:21 2014 us=321767 70.211.73.106:2257 [wlillyw] Peer Connection Initiated with [AF_INET]70.211.73.106:2257
Fri Oct 10 17:30:21 2014 us=321786 wlillyw/70.211.73.106:2257 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Fri Oct 10 17:30:21 2014 us=321815 wlillyw/70.211.73.106:2257 MULTI: Learn: 10.8.0.6 -> wlillyw/70.211.73.106:2257
Fri Oct 10 17:30:21 2014 us=321823 wlillyw/70.211.73.106:2257 MULTI: primary virtual IP for wlillyw/70.211.73.106:2257: 10.8.0.6
Fri Oct 10 17:30:23 2014 us=431732 wlillyw/70.211.73.106:2257 PUSH: Received control message: 'PUSH_REQUEST'
Fri Oct 10 17:30:23 2014 us=431772 wlillyw/70.211.73.106:2257 send_push_reply(): safe_cap=940
Fri Oct 10 17:30:23 2014 us=431793 wlillyw/70.211.73.106:2257 SENT CONTROL [wlillyw]: 'PUSH_REPLY,route 10.0.0.0 255.255.0.0,route 10.1.0.0 255.255.0.0,route 10.2.0.0 255.255.0.0,route 172.31.0.0 255.255.0.0,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Client Log (Connect)
2014-10-10 14:30:18 *Tunnelblick: OS X 10.9.5; Tunnelblick 3.4.0 (build 4007); prior version 3.4beta34 (build 3935)
2014-10-10 14:30:18 *Tunnelblick: Attempting connection with wlillyw using shadow copy; Set nameserver = 1; monitoring connection
2014-10-10 14:30:18 *Tunnelblick: openvpnstart start wlillyw.tblk 1337 1 0 1 0 16688 -ptADGNWradsgnw 2.3.4
2014-10-10 14:30:18 OpenVPN 2.3.4 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [PKCS11] [MH] [IPv6] built on Oct 2 2014
2014-10-10 14:30:18 library versions: OpenSSL 1.0.1i 6 Aug 2014, LZO 2.08
2014-10-10 14:30:18 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:1337
2014-10-10 14:30:18 Need hold release from management interface, waiting...
2014-10-10 14:30:18 *Tunnelblick: openvpnstart log:
Tunnelblick:
OpenVPN started successfully. Command used to start OpenVPN (one argument per displayed line):
/Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.3.4/openvpn
--daemon
--log
/Library/Application Support/Tunnelblick/Logs/-SUsers-Swlillyw-SLibrary-SApplication Support-STunnelblick-SConfigurations-Swlillyw.tblk-SContents-SResources-Sconfig.ovpn.1_0_1_0_16688.1337.openvpn.log
--cd
/Library/Application Support/Tunnelblick/Users/wlillyw/wlillyw.tblk/Contents/Resources
--config
/Library/Application Support/Tunnelblick/Users/wlillyw/wlillyw.tblk/Contents/Resources/config.ovpn
--cd
/Library/Application Support/Tunnelblick/Users/wlillyw/wlillyw.tblk/Contents/Resources
--management
127.0.0.1
1337
--management-query-passwords
--management-hold
--script-security
2
--up
/Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -m -w -d -f -ptADGNWradsgnw
--down
/Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -m -w -d -f -ptADGNWradsgnw
2014-10-10 14:30:18 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:1337
2014-10-10 14:30:18 *Tunnelblick: openvpnstart starting OpenVPN
2014-10-10 14:30:19 *Tunnelblick: Established communication with OpenVPN
2014-10-10 14:30:19 MANAGEMENT: CMD 'pid'
2014-10-10 14:30:19 MANAGEMENT: CMD 'state on'
2014-10-10 14:30:19 MANAGEMENT: CMD 'state'
2014-10-10 14:30:19 MANAGEMENT: CMD 'bytecount 1'
2014-10-10 14:30:19 MANAGEMENT: CMD 'hold release'
2014-10-10 14:30:19 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
2014-10-10 14:30:19 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2014-10-10 14:30:19 Socket Buffers: R=[196724->65536] S=[9216->65536]
2014-10-10 14:30:19 UDPv4 link local: [undef]
2014-10-10 14:30:19 UDPv4 link remote: [AF_INET]xx.xx.xx.xxx:1194
2014-10-10 14:30:19 MANAGEMENT: >STATE:1412976619,WAIT,,,
2014-10-10 14:30:19 MANAGEMENT: >STATE:1412976619,AUTH,,,
2014-10-10 14:30:19 TLS: Initial packet from [AF_INET]xx.xx.xx.xxx:1194, sid=0edd309e 977fd6ee
2014-10-10 14:30:19 VERIFY OK: xxxxxx
2014-10-10 14:30:19 VERIFY OK: xxxxxx
2014-10-10 14:30:21 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
2014-10-10 14:30:21 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2014-10-10 14:30:21 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
2014-10-10 14:30:21 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2014-10-10 14:30:21 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
2014-10-10 14:30:21 [server] Peer Connection Initiated with [AF_INET]54.84.156.187:1194
2014-10-10 14:30:22 MANAGEMENT: >STATE:1412976622,GET_CONFIG,,,
2014-10-10 14:30:23 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
2014-10-10 14:30:23 PUSH: Received control message: 'PUSH_REPLY,route 10.0.0.0 255.255.0.0,route 10.1.0.0 255.255.0.0,route 10.2.0.0 255.255.0.0,route 172.31.0.0 255.255.0.0,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
2014-10-10 14:30:23 OPTIONS IMPORT: timers and/or timeouts modified
2014-10-10 14:30:23 OPTIONS IMPORT: --ifconfig/up options modified
2014-10-10 14:30:23 OPTIONS IMPORT: route options modified
2014-10-10 14:30:23 Opened utun device utun0
2014-10-10 14:30:23 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
2014-10-10 14:30:23 MANAGEMENT: >STATE:1412976623,ASSIGN_IP,,10.8.0.6,
2014-10-10 14:30:23 /sbin/ifconfig utun0 delete
ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
2014-10-10 14:30:23 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
2014-10-10 14:30:23 /sbin/ifconfig utun0 10.8.0.6 10.8.0.5 mtu 1500 netmask 255.255.255.255 up
2014-10-10 14:30:23 /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -m -w -d -f -ptADGNWradsgnw utun0 1500 1542 10.8.0.6 10.8.0.5 init
**********************************************
Start of output from client.up.tunnelblick.sh
No network configuration changes need to be made.
Will NOT monitor for other network configuration changes.
End of output from client.up.tunnelblick.sh
**********************************************
2014-10-10 14:30:25 MANAGEMENT: >STATE:1412976625,ADD_ROUTES,,,
2014-10-10 14:30:25 /sbin/route add -net 10.0.0.0 10.8.0.5 255.255.0.0
add net 10.0.0.0: gateway 10.8.0.5
2014-10-10 14:30:25 /sbin/route add -net 10.1.0.0 10.8.0.5 255.255.0.0
add net 10.1.0.0: gateway 10.8.0.5
2014-10-10 14:30:25 /sbin/route add -net 10.2.0.0 10.8.0.5 255.255.0.0
add net 10.2.0.0: gateway 10.8.0.5
2014-10-10 14:30:25 /sbin/route add -net 172.31.0.0 10.8.0.5 255.255.0.0
add net 172.31.0.0: gateway 10.8.0.5
2014-10-10 14:30:25 /sbin/route add -net 10.8.0.1 10.8.0.5 255.255.255.255
add net 10.8.0.1: gateway 10.8.0.5
2014-10-10 14:30:25 Initialization Sequence Completed
2014-10-10 14:30:25 MANAGEMENT: >STATE:1412976625,CONNECTED,SUCCESS,10.8.0.6,54.84.156.187
2014-10-10 14:30:25 *Tunnelblick: No 'connected.sh' script to execute
Server Routes
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 10.2.2.1 0.0.0.0 UG 0 0 0 eth0
10.2.2.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
10.8.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
169.254.169.254 0.0.0.0 255.255.255.255 UH 0 0 0 eth0
Client Routes
Internet:
Destination Gateway Flags Refs Use Netif Expire
default 192.168.0.1 UGSc 26 78 en0
10/16 10.8.0.5 UGSc 0 0 utun0
10.1/16 10.8.0.5 UGSc 0 0 utun0
10.2/16 10.8.0.5 UGSc 0 0 utun0
10.8.0.1/32 10.8.0.5 UGSc 0 0 utun0
10.8.0.5 10.8.0.6 UH 5 0 utun0
127 127.0.0.1 UCS 0 0 lo0
127.0.0.1 127.0.0.1 UH 10 164720 lo0
127.94.0.1 127.94.0.1 UH 0 305 lo0
169.254 link#4 UCS 0 0 en0
172.31 10.8.0.5 UGSc 0 0 utun0
192.168.0 link#4 UCS 2 0 en0
192.168.0.1 0:30:44:f:20:87 UHLWIir 27 5526 en0 1191
192.168.0.198 127.0.0.1 UHS 0 15 lo0
192.168.0.255 ff:ff:ff:ff:ff:ff UHLWbI 0 11 en0
Not sure what the problem is here, I have noticed that the gateway on the client is being set to 10.8.0.5 not 10.8.0.1, not sure where that's coming from or if its a problem.
Assuming I can get this going I would also like to push DNS settings to the client, only for resolving the internal EC2 domains.
I did try installing the AS product and was able to get it fully working so I know the VPCs and Security Groups are set up OK.
Any help is much appreciated!
