I am looking to setup an OpenVPN Server/Client setup to allow remote management of a server behind a firewall. The Client has two connection profiles to two different OpenVPN servers to ensure redundancy.
The server configuration is as follows:
Server 1:
cd /etc/openvpn
port 1194
proto udp
dev tun
server 172.28.2.0 255.255.255.0
client-config-dir ccd
pkcs12 keys/...
dh keys/dh2048.pem
cipher AES-256-CBC
cipher DES-EDE3-CBC
tls-server
tls-auth keys/ta.key 0
keepalive 10 120
comp-lzo
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
log-append /var/log/openvpn/openvpn.log
verb 3
Server 1/Client Configuration:
ifconfig-push 172.28.2.6 172.28.2.5
push "route 10.25.0.0 255.255.0.0 172.28.2.5 10"
Server 2:
cd /etc/openvpn
port 1194
proto udp
dev tun
server 172.28.2.0 255.255.255.0
client-config-dir ccd
pkcs12 keys/...
dh keys/dh2048.pem
cipher AES-256-CBC
cipher DES-EDE3-CBC
tls-server
tls-auth keys/ta.key 0
keepalive 10 120
comp-lzo
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
log-append /var/log/openvpn/openvpn.log
verb 3
Server 1/Client Configuration:
ifconfig-push 172.29.2.6 172.29.2.5
push "route 10.25.0.0 255.255.0.0 172.29.2.5 10"
Client Configurations:
For Server 1:
cd /etc/openvpn
client
dev tun0
nobind
remote ...
ca keys/ca.crt
cert keys/...
key keys/...
remote-cert-tls server
cipher AES-256-CBC
cipher DES-EDE3-CBC
tls-client
tls-auth keys/ta.key 1
keepalive 10 120
comp-lzo
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
log-append /var/log/openvpn/openvpn.log
verb 3
For Server 2:
cd /etc/openvpn
client
dev tun1
nobind
remote ...
ca keys/ca.crt
cert keys/...
key keys/...
remote-cert-tls server
cipher AES-256-CBC
cipher DES-EDE3-CBC
tls-client
tls-auth keys/ta.key 1
keepalive 10 120
comp-lzo
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
log-append /var/log/openvpn/openvpn.log
verb 3
Connecting to the OpenVPN servers all work as shown in the routing table below from the client.
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 10.100.4.1 0.0.0.0 UG 0 0 0 eth0
10.25.0.0 172.28.2.5 255.255.0.0 UG 10 0 0 tun0
10.25.0.0 172.29.2.5 255.255.0.0 UG 20 0 0 tun1
10.100.4.0 0.0.0.0 255.255.254.0 U 0 0 0 eth0
169.254.169.254 0.0.0.0 255.255.255.255 UH 0 0 0 eth0
172.28.2.1 172.28.2.5 255.255.255.255 UGH 0 0 0 tun0
172.28.2.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
172.29.2.1 172.29.2.5 255.255.255.255 UGH 0 0 0 tun1
172.29.2.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun1
And I can reach the server on the 172.28.2.6 address. However, I cannot reach the client on the 172.29.2.6 address. My assumption is that what is happening is traffic is going to 172.29.2.6 and then is following the routing table and trying to go back out tun0. I took a look at both of the OpenVPN servers and rp_filter is disabled on the tun0 interfaces. IPTABLES has also been disabled for testing and it still is not working.
Any thoughts or help on this would be appreciated.
Thanks!!
