Hello everyone.
I have recently successfully setup an OpenVPN server to connect remotely to the management network of some server cluster. I have run into some issues that really don't seem to make any sense.
Here the networks in question:
Management: 10.197.64.0/24
OpenVPN: 10.137.64.0/24
Public IP range: 176.65.xx.176/28
The relevant machines for this post:
10.197.64.7 - Service:
A machine on the local LAN that I want to access from my home client.
10.197.64.1 - Router:
The router of the local LAN.
10.197.64.8 / 10.137.64.1 / 176.65.xx.190 - OpenVPN Server:
The OpenVPN server, with an interface in the local LAN, his IP in the OpenVPN network and a public IP for Internet access.
176.65.xx.177 - Gateway:
The Gateway to access Internet.
10.137.64.6 / (Internet IP) - OpenVPN Client:
The OpenVPN client, connected to the Internet and connected to the OpenVPN server.
What is happening:
When I connect my OpenVPN client to the OpenVPN server, the connection is established successfully.
I am, however, not able to ping either the router or the local service.
What I know so far:
OpenVPN Client
- Can ping the OpenVPN server on the OpenVPN LAN:
PING 10.137.64.1 (10.137.64.1) 56(84) bytes of data.
64 bytes from 10.137.64.1: icmp_req=1 ttl=64 time=59.6 ms
- Can (!) ping the OpenVPN server on the local LAN:
PING 10.197.64.8 (10.197.64.8) 56(84) bytes of data.
64 bytes from 10.197.64.8: icmp_req=1 ttl=64 time=16.8 ms
- Can NOT ping the Router on the local LAN:
PING 10.197.64.1 (10.197.64.1) 56(84) bytes of data.
5 packets transmitted, 0 received, 100% packet loss, time 4030ms
- Can NOT ping the Service on the local LAN:
PING 10.197.64.7 (10.197.64.7) 56(84) bytes of data.
4 packets transmitted, 0 received, 100% packet loss, time 3024ms
OpenVPN Server
- Can ping the OpenVPN client on the OpenVPN LAN:
PING 10.137.64.6 (10.137.64.6) 56(84) bytes of data.
64 bytes from 10.137.64.6: icmp_req=1 ttl=64 time=49.6 ms
- Can ping the Router on the local LAN:
PING 10.197.64.1 (10.197.64.1) 56(84) bytes of data.
64 bytes from 10.197.64.1: icmp_req=1 ttl=255 time=0.797 ms
- Can ping the Service on the local LAN:
PING 10.197.64.7 (10.197.64.7) 56(84) bytes of data.
64 bytes from 10.197.64.7: icmp_req=1 ttl=64 time=0.360 ms
Router
- Can ping the Service on the local LAN:
10.197.64.7 is alive, time = 2 ms
- Can ping the OpenVPN server on the local LAN:
10.197.64.8 is alive, time = 3 ms
- Can (!) ping the OpenVPN server on the OpenVPN LAN:
10.137.64.1 is alive, time = 2 ms
- Can NOT ping the OpenVPN client on the OpenVPN LAN:
Request timed out.
Why I am losing my mind:
Initially, I assumed there was something wrong with my route on the local router, so I checked the static route to route back into the OpenVPN network (10.137.64.0/24) with next hop set to the OpenVPN Server's local LAN address (10.197.64.8). However, I can ping the OpenVPN server, even on his OpenVPN LAN IP, just fine. Which is weird. Which is why I marked it with an exclamation mark. If I can ping the OpenVPN Server on his OpenVPN LAN IP (10.137.64.1), then the route has to be fine on the router. To verify this, I also pinged the Router from the OpenVPN Server's OpenVPN LAN IP (ping 10.197.64.1 -I 10.137.64.1), which also worked just fine. So there should be no issue with the routing in the local network, between the service, the router and the OpenVPN server.
This would, typically, mean to me that the route is not properly pushed to the OpenVPN Client. Before configuring it manually in the client configuration file, I went to check the routing table on my home PC:
default via 10.137.64.5 dev tun0 proto static metric 1024
10.137.64.1 via 10.137.64.5 dev tun0 proto static metric 1024
10.137.64.5 dev tun0 proto kernel scope link src 10.137.64.6
10.197.64.0/24 via 10.137.64.5 dev tun0 proto static metric 1024
176.65.xx.190 via 192.168.178.1 dev eth0 proto static metric 1
192.168.178.0/24 dev eth0 proto kernel scope link src 192.168.178.21
And again, isn't that weird? Everything seems to be defined just fine, with 10.197.64.0/24 being routed through the 10.137.64.x interface on the tunnel device. At the same time, I manage to ping the OpenVPN Server on his local network IP (10.197.64.1), so the routing seems to work fine, which is again, weird, which is, again, why I marked it with an exclamation mark.
Now, I don't consider myself a network expert by any means, but I do think that I have a grasp on the fundamentals. If the router from the local LAN can ping the OpenVPN Server on his OpenVPN LAN, and if the OpenVPN Client can ping the OpenVPN Server on his local LAN, doesn't that mean that they should be able to ping each other. Aren't these fact completely contradictory?
I really don't get why it's not working.
Configuration files:
Server
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server 10.137.64.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.197.64.0 255.255.255.0"
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
Client
client
remote 176.65.xx.190
ca /etc/openvpn/nexunity.crt
cert /etc/openvpn/max.wolter.crt
key /etc/openvpn/max.wolter.key
comp-lzo yes
dev tun
proto udp
nobind
auth-nocache
script-security 2
persist-key
persist-tun
user openvpn
group openvpn
