Trying to create route to vpn client from server and reverse

Johnnyjohnny

Hi

I'm scratching my head quite a bit here, im new to vpn, used to run openswan but it was a nightmare for windows and ios clients so im very happy with openvpn so far.

However, I have a problem with routing and is seeking advice here.

My setup is as follow:

Router: 192.168.1.1 OVPN server: 192.168.1.123 with gw 192.168.1.1. TUN0 is 10.8.0.1 10.8.0.2 <= cabin@192.168.0.57 openvpn with assigned tun0 ip 10.8.0.21

What im trying to achieve is to be able to connect to my cabin where I have camera surveilance in case of a break in, and the cabin would be able to transfer files to the openvpn server (pictures and clips from camera)

I have experiemented back and forth but no been able to get it working 100%. im unable to ping the openvpn server (192.168.1.123) from the client and unable to ping 10.8.0.21 from the vpn server.

My server.conf:
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ccd
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 192.168.1.1"
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

I have this ccd conf for this particular client:
ifconfig-push 10.8.0.21 10.8.0.22
push "route 192.168.1.0 255.255.255.0"

Help me obi-wan kenobi, you're my only hope

Traffic

How about your client config .. padawan ?

And while you are there .. perhaps your log files .. :mrgreen:

Johnnyjohnny

ah, ofcourse. how sloppy of me 🙂

client config from "stugan" (cabin)
client
dev tun
proto udp
remote myserver 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert stugan.crt
key stugan.key
ns-cert-type server
comp-lzo
verb 3

syslog from server:
Oct 26 22:01:36 mp3b ovpn-server[2692]: cabinextip:50877 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Oct 26 22:01:36 mp3b ovpn-server[2692]: cabinextip:50877 [stugan] Peer Connection Initiated with [AF_INET]cabinextip:50877
Oct 26 22:01:36 mp3b ovpn-server[2692]: MULTI: new connection by client 'stugan' will cause previous active sessions by this client to be dropped. Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Oct 26 22:01:36 mp3b ovpn-server[2692]: OPTIONS IMPORT: reading client specific options from: ccd/stugan
Oct 26 22:01:36 mp3b ovpn-server[2692]: MULTI: Learn: 10.8.0.21 -> stugan/cabinextip:50877
Oct 26 22:01:36 mp3b ovpn-server[2692]: MULTI: primary virtual IP for stugan/cabinextip:50877: 10.8.0.21
Oct 26 22:01:38 mp3b ovpn-server[2692]: stugan/cabinextip:50877 PUSH: Received control message: 'PUSH_REQUEST'
Oct 26 22:01:38 mp3b ovpn-server[2692]: stugan/cabinextip:50877 send_push_reply(): safe_cap=940
Oct 26 22:01:38 mp3b ovpn-server[2692]: stugan/cabinextip:50877 SENT CONTROL [stugan]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 192.168.1.1,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,route 192.168.1.0 255.255.255.0,ifconfig 10.8.0.21 10.8.0.22' (status=1)

Traffic

On what devices do you run OpenVPN for this particular connection ?

Check your logs for Version details etc and paste them here, please.

Johnnyjohnny

server is ubuntu 14.04:
openvpn --version
OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Feb 4 2014

client is a raspberry pi running raspbian:
OpenVPN 2.2.1 arm-linux-gnueabihf [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Oct 12 2013

Traffic

OK .. Linux all round .. that helps a lot .. but this may take some time .. depending on:
How much of the documentation you have read and how much you know about routing ..

The very first thing you need to know ..
Never use 192.168.0.0/24 or 192.168.1.0/24 for your server LAN.
It will cause routing conflicts eventually.
For now you can probably leave it but remember this for future reference.

Next, you are using "push redirect-gateway .. " for your client, this is unnecessary
A routed VPN only requires connectivity and routing.

This HOWTO explains what you need to accomplish suitable routing:
HOWTO: Expanding the scope of the VPN to include additional machines

Remember to enable IP_Forwarding on your client and server as your camera is on your client LAN.

Johnnyjohnny

Thanks for the input, im gonna sit down tomorrow and give it a go, right now its almost midnight so it's bedtime for me.

My router at the cabin is extremely annoying, it lacks so many features (dlink 4g router), cannot even reserve DHCP IP 🙁 , I know that using 192.168.1.x or 0.x might cause issues (actually already experienced it the hard way) I've been thinking about changing it for some time but I got so much stuff connected that it will take a while to sort out when I change ip 🙂 but one day.

Johnnyjohnny

Morning

My cabin failed to dial back to me so it was unavailable for quite some time, but now its back (why I don't know)
I read that article and have almost got it working, at least one way 🙂 added "iroute 192.168.0.0 255.255.255.0" to the ccd config file and push 192.168.1.0 255.255.255.0 to the server conf file.

Status now is that I can ping the 10.8.0.21 assigned ip and also ssh to it, very nice. However the client cannot ping 192.168.1.123 or ssh to it. so one last step to achieve.
Gonna take a closer look tonight, but first..time to get to work.

Johnnyjohnny

ahhhh it works now, I forgot about a iptable rule I was experimenting with earlier which prevented the client to ping and connect to server (192.168.1.123).

Removed it and it works like a charm now 🙂

~$ ssh pi@10.8.0.21
pi@10.8.0.21's password:
pi@raspberrypi ~ $ ping 192.168.1.123
PING 192.168.1.123 (192.168.1.123) 56(84) bytes of data.
64 bytes from 192.168.1.123: icmp_req=1 ttl=64 time=31.3 ms
64 bytes from 192.168.1.123: icmp_req=2 ttl=64 time=41.1 ms
64 bytes from 192.168.1.123: icmp_req=3 ttl=64 time=39.0 ms
64 bytes from 192.168.1.123: icmp_req=4 ttl=64 time=38.3 ms

I can also ssh from server to the client. Success!

Traffic

Johnnyjohnny wroteit works like a charm now 🙂

Great .. thanks for letting us know.