I have two networks and one remote PC connected by openvpn tun tunnels. NetworkA is 172.16.175.0/24 NetworkB is 10.10.11.0/24 & remote client NetworkA has gateway (Linux box) with OpenVPN service acting as a server for NetworkB NetworkB has router (Asus RT-N66U router) with two OpenVPN instances - one is configured as NetwokB client & another as server for remote clients connectinf to NetworkB Remote client can access NetworkB hosts (and its router) but can't access neither NetworkA network, nor its gateway server. Echo requests are not even hiting gateway tun interface (to verify this, I've disabled encryption and used tcpdump against tun interface). Using iptables -v command, I've verified that NetworkA router is forwarding pings from remote client (tun21 is the openvnp server int), number of packets is increasing: [quote] Chain FORWARD (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 75 4304 ACCEPT all -- tun21 * 0.0.0.0/0 0.0.0.0/0[/quote] However number of outgoing packets to the NetworkA is still at zero (tun11 is the openvpn client int): [quote] Chain OUTPUT (policy ACCEPT 26584 packets, 13M bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT all -- * tun11 0.0.0.0/0 0.0.0.0/0 [/quote] I can't understand what I am doing wrong and will be grateful for any help. NetworkB routers iptables filter: [quote] Chain INPUT (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination 1 840 89190 ACCEPT all -- ppp+ * 0.0.0.0/0 0.0.0.0/0 2 2281 216K ACCEPT all -- ppp10 * 0.0.0.0/0 0.0.0.0/0 3 0 0 ACCEPT all -- tun12 * 0.0.0.0/0 0.0.0.0/0 4 0 0 ACCEPT all -- tun11 * 0.0.0.0/0 0.0.0.0/0 5 0 0 ACCEPT all -- tun21 * 0.0.0.0/0 0.0.0.0/0 6 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1194 7 131 13745 logdrop all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID 8 19334 8496K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 9 13 4745 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 state NEW 10 821 76125 ACCEPT all -- br0 * 0.0.0.0/0 0.0.0.0/0 state NEW 11 1 28 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 12 2 108 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:1723 13 0 0 ACCEPT 47 -- * * 0.0.0.0/0 0.0.0.0/0 14 699 82562 logdrop all -- * * 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy DROP 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination 1 2 104 TCPMSS tcp -- ppp10 * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU 2 6228 503K ACCEPT all -- ppp+ * 0.0.0.0/0 0.0.0.0/0 3 7 392 ACCEPT all -- ppp10 * 0.0.0.0/0 0.0.0.0/0 4 106K 88M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 5 0 0 ACCEPT all -- tun12 * 0.0.0.0/0 0.0.0.0/0 6 0 0 ACCEPT all -- tun11 * 0.0.0.0/0 0.0.0.0/0 7 0 0 ACCEPT all -- tun21 * 0.0.0.0/0 0.0.0.0/0 8 0 0 logdrop all -- !br0 eth0 0.0.0.0/0 0.0.0.0/0 9 9 360 logdrop all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID 10 0 0 ACCEPT all -- br0 br0 0.0.0.0/0 0.0.0.0/0 11 0 0 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x17/0x02 limit: avg 1/sec burst 5 12 0 0 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x17/0x04 limit: avg 1/sec burst 5 13 0 0 ACCEPT icmp -- eth0 * 0.0.0.0/0 0.0.0.0/0 icmp type 8 limit: avg 1/sec burst 5 14 318 40481 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate DNAT 15 759 82772 ACCEPT all -- br0 * 0.0.0.0/0 0.0.0.0/0 Chain OUTPUT (policy ACCEPT 23411 packets, 12M bytes) num pkts bytes target prot opt in out source destination Chain FUPNP (0 references) num pkts bytes target prot opt in out source destination 1 0 0 ACCEPT udp -- * * 0.0.0.0/0 10.10.11.150 udp dpt:10441 2 0 0 ACCEPT tcp -- * * 0.0.0.0/0 10.10.11.150 tcp dpt:10441 3 0 0 ACCEPT tcp -- * * 0.0.0.0/0 10.10.11.150 tcp dpt:32371 4 0 0 ACCEPT udp -- * * 0.0.0.0/0 10.10.11.150 udp dpt:32371 Chain PControls (0 references) num pkts bytes target prot opt in out source destination 1 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 Chain logaccept (0 references) num pkts bytes target prot opt in out source destination 1 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW LOG flags 7 level 4 prefix `ACCEPT ' 2 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 Chain logdrop (4 references) num pkts bytes target prot opt in out source destination 1 699 82562 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW LOG flags 7 level 4 prefix `DROP ' 2 839 96667 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 [/quote] NetworkA openvpn server config: [quote] port 4649 proto udp dev tun ca /etc/openvpn/keys/ca.crt cert /etc/openvpn/keys/server.crt key /etc/openvpn/keys/server.key dh /etc/openvpn/keys/dh1024.pem server 10.10.0.0 255.255.255.0 # servers LAN push "route 172.16.175.0 255.255.255.0" # clients LAN route 10.10.11.0 255.255.255.0 ifconfig-pool-persist ipp.txt keepalive 10 120 comp-lzo persist-key persist-tun verb 4 client-config-dir /etc/openvpn/ccd[/quote] CCD config for NetworkB cllient: [quote] iroute 10.10.11.0 255.255.255.0[/quote] NetworkB openvpn client config: [quote] # Automatically generated configuration daemon client dev tun11 proto udp remote 4649 resolv-retry 30 nobind persist-key persist-tun comp-lzo adaptive verb 3 ca ca.crt cert client.crt key client.key status-version 2 status status # Custom Configuration ns-cert-type server[/quote] NetworkB openvpn server config: [quote] # Automatically generated configuration daemon server 10.8.0.0 255.255.255.0 proto udp port 1194 dev tun21 cipher BF-CBC comp-lzo adaptive keepalive 15 60 verb 3 push "route 10.10.11.0 255.255.255.0" duplicate-cn ca ca.crt dh dh.pem cert server.crt key server.key status-version 2 status status # Custom Configuration push "route 172.16.175.0 255.255.255.0" push "route 10.0.0.0 255.0.0.0"[/quote] Remote client config: [quote] client dev tun # Windows needs the TAP-Win32 adapter name # from the Network Connections panel # if you have more than one. On XP SP2, # you may need to disable the firewall # for the TAP adapter. ;dev-node MyTap proto udp remote 1194 float comp-lzo adaptive cipher BF-CBC ;keepalive 15 60 ns-cert-type server ca ca.crt cert client.crt key client.key verb 4[/quote] Thanks in advance for your replies :)

Ensure IP_Forwarding is enabled on all the Server devices. Have you checked all your VPN log files for possible errors ? EG:[list][*]Are routes successfully added ? [*]Are CCD files successfully parsed ?[/list] Have you identified where you need static routes or even NAT ? [quote="Virtul"]NetworkB openvpn server config: Quote: # Automatically generated configuration daemon server 10.8.0.0 255.255.255.0 push "route [u]10.0.0.0[/u] 255.0.0.0"[/quote]This looks wrong. Have you tried saving and resetting iptables ?

Traffic, thank you for your reply. [quote="Traffic"]Ensure IP_Forwarding is enabled on all the Server devices.[/quote] Ensured, both server hosts actually forward traffic (from networkB to NetworkA and from client to NetworkB) [quote="Traffic"]Have you checked all your VPN log files for possible errors ? EG:[list][*]Are routes successfully added ? [*]Are CCD files successfully parsed ?[/list][/quote] Logs at both servers and both client doesn't have related errors (client shows many [i]Authenticate/Decrypt packet error: bad packet ID (may be a replay)[/i], but still can connect to NetworkB) [quote="Traffic"]Have you identified where you need static routes or even NAT ?[/quote] NAT is not needed. As well as static routes (I use push route & iroute instead). [quote="Virtul"]NetworkB openvpn server config: Quote: # Automatically generated configuration daemon server 10.8.0.0 255.255.255.0 push "route [u]10.0.0.0[/u] 255.0.0.0"[/quote]This looks wrong.[/quote] Well, changing this to 10.10.11.0/24 fixed nothing :( [quote="Traffic"]Have you tried saving and resetting iptables ?[/quote] Many times, in fact I've tried dozens of changes in iptables :( Small update: I've managed to install tcpdump to router in NetworkB, here is the output of pinging host 172.16.175.133 from NetworkB router: [quote] Router in NetworkB# tcpdump -p icmp -nn -i tun11 listening on tun11, link-type RAW (Raw IP), capture size 65535 bytes 01:32:17.305155 IP 10.10.0.74 > 172.16.175.133: ICMP echo request, id 45059, seq 0, length 64 01:32:17.355380 IP 172.16.175.133 > 10.10.0.74: ICMP echo reply, id 45059, seq 0, length 64 01:32:18.323068 IP 10.10.0.74 > 172.16.175.133: ICMP echo request, id 45059, seq 1, length 64 01:32:18.372670 IP 172.16.175.133 > 10.10.0.74: ICMP echo reply, id 45059, seq 1, length 64 01:32:19.343079 IP 10.10.0.74 > 172.16.175.133: ICMP echo request, id 45059, seq 2, length 64 01:32:19.392522 IP 172.16.175.133 > 10.10.0.74: ICMP echo reply, id 45059, seq 2, length 64 01:32:20.363208 IP 10.10.0.74 > 172.16.175.133: ICMP echo request, id 45059, seq 3, length 64 01:32:20.412699 IP 172.16.175.133 > 10.10.0.74: ICMP echo reply, id 45059, seq 3, length 64 Router in NetworkB# tcpdump -p icmp -nn -i tun21 listening on tun21, link-type RAW (Raw IP), capture size 65535 bytes (nothing, since this is Clients interface) Server in NetworkA# tcpdump -p icmp -nn -i tun0 listening on tun0, link-type RAW (Raw IP), capture size 65535 bytes 01:32:16.256633 IP 10.10.0.74 > 172.16.175.133: ICMP echo request, id 45059, seq 0, length 64 01:32:16.257047 IP 172.16.175.133 > 10.10.0.74: ICMP echo reply, id 45059, seq 0, length 64 01:32:17.274105 IP 10.10.0.74 > 172.16.175.133: ICMP echo request, id 45059, seq 1, length 64 01:32:17.274445 IP 172.16.175.133 > 10.10.0.74: ICMP echo reply, id 45059, seq 1, length 64 01:32:18.294091 IP 10.10.0.74 > 172.16.175.133: ICMP echo request, id 45059, seq 2, length 64 01:32:18.294282 IP 172.16.175.133 > 10.10.0.74: ICMP echo reply, id 45059, seq 2, length 64 01:32:19.314258 IP 10.10.0.74 > 172.16.175.133: ICMP echo request, id 45059, seq 3, length 64 01:32:19.314546 IP 172.16.175.133 > 10.10.0.74: ICMP echo reply, id 45059, seq 3, length 64 [/quote] Pinging the same host from openvpn Client of NetworkB router: [quote] Router in NetworkB# tcpdump -p icmp -nn -i tun11 listening on tun11, link-type RAW (Raw IP), capture size 65535 bytes 01:29:30.532482 IP 10.8.0.6 > 172.16.175.133: ICMP echo request, id 1, seq 951, length 40 01:29:35.068135 IP 10.8.0.6 > 172.16.175.133: ICMP echo request, id 1, seq 952, length 40 01:29:40.072752 IP 10.8.0.6 > 172.16.175.133: ICMP echo request, id 1, seq 953, length 40 Router in NetworkB# tcpdump -p icmp -nn -i tun21 listening on tun21, link-type RAW (Raw IP), capture size 65535 bytes 01:29:30.532117 IP 10.8.0.6 > 172.16.175.133: ICMP echo request, id 1, seq 951, length 40 01:29:35.068058 IP 10.8.0.6 > 172.16.175.133: ICMP echo request, id 1, seq 952, length 40 01:29:40.072676 IP 10.8.0.6 > 172.16.175.133: ICMP echo request, id 1, seq 953, length 40 Server in NetworkA# tcpdump -p icmp -nn -i tun0 listening on tun0, link-type RAW (Raw IP), capture size 65535 bytes (nothing) [/quote] So router does forwarding for clients traffic (not sure why iptables counters doesn't increase) But server in NetworkA doesn't recieve it for some reason

Can't reach hosts in OpenVPN network from another OpenVPN ne

Virtul

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

Traffic

Ensure IP_Forwarding is enabled on all the Server devices.

Have you checked all your VPN log files for possible errors ?

EG:

Are routes successfully added ?
Are CCD files successfully parsed ?

Have you identified where you need static routes or even NAT ?

Virtul wroteNetworkB openvpn server config:
Quote:
# Automatically generated configuration
daemon
server 10.8.0.0 255.255.255.0

<snip>

push "route 10.0.0.0 255.0.0.0"

This looks wrong.

Have you tried saving and resetting iptables ?

Virtul

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

Traffic

Virtul wrote
Traffic wroteVirtul wrote:
NetworkB openvpn server config:
Quote:
# Automatically generated configuration
daemon
server 10.8.0.0 255.255.255.0

<snip>

push "route 10.0.0.0 255.0.0.0"
This looks wrong.
Well, changing this to 10.10.11.0/24 fixed nothing 🙁

I think this is part of the problem ..

Virtul wrotePinging the same host from openvpn Client of NetworkB router:
Quote:
Router in NetworkB# tcpdump -p icmp -nn -i tun11
listening on tun11, link-type RAW (Raw IP), capture size 65535 bytes
01:29:30.532482 IP 10.8.0.6 > 172.16.175.133: ICMP echo request, id 1, seq 951, length 40
01:29:35.068135 IP 10.8.0.6 > 172.16.175.133: ICMP echo request, id 1, seq 952, length 40

how are you providing routes for 10.8 ? 172.16.175 does not have a route back to 10.8 .. you could use NAT here or routing.

Virtul

Thanks again, Traffic

The problem was that openvpn server instance in NetworkA wasn't aware about internal openvpn network for Client<->NetworkB tunnel
After adding iroute 10.8.0.0 255.255.0.0 to the NetworkB router ccd, finally I could see incoming icmp traffic from Client at Server in NetworkB

However seerver doesn't respond with echo replies 🙁 Not sure if this is OpenVPN issue tho...
I've added iptables trace:
iptables -S -t raw

-P PREROUTING ACCEPT
-P OUTPUT ACCEPT
-A PREROUTING -p icmp -j TRACE
-A OUTPUT -p icmp -j TRACE

These rules show the following output when server is pinged by the Client:

Nov 14 23:35:56 gate kernel: TRACE: raw:PREROUTING:policy:2 IN=tun0 OUT= MAC= SRC=10.8.0.6 DST=172.16.175.1 LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=8166 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=978
Nov 14 23:35:56 gate kernel: TRACE: mangle:PREROUTING:policy:1 IN=tun0 OUT= MAC= SRC=10.8.0.6 DST=172.16.175.1 LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=8166 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=978
Nov 14 23:35:56 gate kernel: TRACE: nat:PREROUTING:policy:6 IN=tun0 OUT= MAC= SRC=10.8.0.6 DST=172.16.175.1 LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=8166 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=978

Same for pinging any host behind the server

Output when pinging host from NetworkB router:

Nov 15 00:00:06 gate kernel: TRACE: raw:PREROUTING:policy:2 IN=tun0 OUT= MAC= SRC=10.10.0.74 DST=172.16.175.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=23043 SEQ=0
Nov 15 00:00:06 gate kernel: TRACE: mangle:PREROUTING:policy:1 IN=tun0 OUT= MAC= SRC=10.10.0.74 DST=172.16.175.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=23043 SEQ=0
Nov 15 00:00:06 gate kernel: TRACE: nat:PREROUTING:policy:6 IN=tun0 OUT= MAC= SRC=10.10.0.74 DST=172.16.175.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=23043 SEQ=0
Nov 15 00:00:06 gate kernel: TRACE: mangle:INPUT:policy:1 IN=tun0 OUT= MAC= SRC=10.10.0.74 DST=172.16.175.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=23043 SEQ=0
Nov 15 00:00:06 gate kernel: TRACE: filter:INPUT:rule:3 IN=tun0 OUT= MAC= SRC=10.10.0.74 DST=172.16.175.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=23043 SEQ=0
Nov 15 00:00:06 gate kernel: TRACE: raw:OUTPUT:policy:2 IN= OUT=tun0 SRC=172.16.175.1 DST=10.10.0.74 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=55100 PROTO=ICMP TYPE=0 CODE=0 ID=23043 SEQ=0
Nov 15 00:00:06 gate kernel: TRACE: mangle:OUTPUT:policy:1 IN= OUT=tun0 SRC=172.16.175.1 DST=10.10.0.74 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=55100 PROTO=ICMP TYPE=0 CODE=0 ID=23043 SEQ=0
Nov 15 00:00:06 gate kernel: TRACE: filter:OUTPUT:rule:4 IN= OUT=tun0 SRC=172.16.175.1 DST=10.10.0.74 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=55100 PROTO=ICMP TYPE=0 CODE=0 ID=23043 SEQ=0
Nov 15 00:00:06 gate kernel: TRACE: mangle:POSTROUTING:policy:1 IN= OUT=tun0 SRC=172.16.175.1 DST=10.10.0.74 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=55100 PROTO=ICMP TYPE=0 CODE=0 ID=23043 SEQ=0

What could cause this?

Virtul

Adding iroute and kernel routes to 10.8.0.0 network solved all problems.
Thanks Traffic! You were totally right.

Traffic

You are welcome and thank you for your feed back to the forum.

You figured it out .. I just help you focus :mrgreen: