FORWARD from tun0 -> eth0 problem

ciccio

I've the OpenVPN configured on some clients , one server i can ping all the nodes in the OpenVPN networks, i can surf the web with the clients in the clients network i cannot use the Server to navigate throught it, so i try to send icmp traffic on the OpenVPN server (before close the internet connections on the clients and swap in the mod where all the traffic pass through the OpenVPN server ) with command :

ping -i tun0 google.com

with tcpdump i can see the traffic flow on the tun0 interface on the OpenVPN server, but i cannot FORWARD the traffic on the other interface eth0,
and get the response at ping !

This is my route table :

sudo route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 10.240.0.1 0.0.0.0 UG 0 0 0 eth0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
10.8.0.2 * 255.255.255.255 UH 0 0 0 tun0
10.240.0.1 * 255.255.255.255 UH 0 0 0 eth0

The iptables is set to ACCEPT all, i need to complete the nat table (in the right way ) the ipv4 forwarding is active and the address on the network are :

server 10.240.79.17 Gateway 10.240.0.1
client 10.8.0.6 gateway 10.8.0.1

Thanks for help ..... i wasted already a cuople of days !!

maikcat

post your configs used
post your logs
post the output of:

iptables -L -v
iptables -L -v -t nat

on your openvpn server

Michael.

ciccio

// server.config
port 7777
proto udp
dev tun
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/neutron.crt
key /etc/openvpn/certs/neutron.key
dh /etc/openvpn/certs/dh2048.pem
# tls-auth /etc/openvpn/certs/ta.key
topology subnet

server 10.8.0.0 255.255.255.0
push "route 10.240.0.0 255.255.0.0"

ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
client-to-client
keepalive 1800 4000
cipher DES-EDE3-CBC
comp-lzo
max-clients 20
user nobody
group nogroup
persist-key
persist-tun
log /var/log/openvpn.log
status /var/openvpn-status.log
verb 5
mute 20

// client.conf
client
dev tun
proto udp
remote xxx.xxx.xx.108 7777
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/zeus.crt
key /etc/openvpn/certs/zeus.key
cipher DES-EDE3-CBC
comp-lzo
verb 3
route no-pull

// routing table
Chain INPUT (policy ACCEPT 20593 packets, 6304K bytes)
pkts bytes target prot opt in out source destination

Chain FORWARD (policy ACCEPT 6 packets, 504 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 25679 packets, 2152K bytes)
pkts bytes target prot opt in out source destination
ciccio@ares:/etc/openvpn$ sudo iptables -L -v -t nat
Chain PREROUTING (policy ACCEPT 145 packets, 8418 bytes)
pkts bytes target prot opt in out source destination

Chain INPUT (policy ACCEPT 144 packets, 8334 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 4321 packets, 266K bytes)
pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 4321 packets, 266K bytes)
pkts bytes target prot opt in out source destination
1 84 MASQUERADE all -- any eth0 10.8.0.0/24 anywhere

// log file on client
Mon Dec 8 11:13:34 2014 OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Dec 1 2014
Mon Dec 8 11:13:34 2014 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Mon Dec 8 11:13:34 2014 Socket Buffers: R=[212992->131072] S=[212992->131072]
Mon Dec 8 11:13:34 2014 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Mon Dec 8 11:13:34 2014 UDPv4 link local: [undef]
Mon Dec 8 11:13:34 2014 UDPv4 link remote: [AF_INET]xxx.xxx.xxx.108:7777
Mon Dec 8 11:13:34 2014 TLS: Initial packet from [AF_INET]xxx.xxx.xxx.108:7777, sid=3b876905 dd702b77
Mon Dec 8 11:13:35 2014 VERIFY OK: depth=1, C=IT, ST=BG, L=Bergamo, O=Be, OU=future-division, CN=company, name=company, emailAddress=
Mon Dec 8 11:13:35 2014 VERIFY OK: depth=0, C=IT, ST=BG, L=Be, O=Be, OU=future-division, CN=neutron, name=company, emailAddress=
Mon Dec 8 11:13:37 2014 Data Channel Encrypt: Cipher 'DES-EDE3-CBC' initialized with 192 bit key
Mon Dec 8 11:13:37 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Dec 8 11:13:37 2014 Data Channel Decrypt: Cipher 'DES-EDE3-CBC' initialized with 192 bit key
Mon Dec 8 11:13:37 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Dec 8 11:13:37 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mon Dec 8 11:13:37 2014 [neutron] Peer Connection Initiated with [AF_INET]xxx.xxx.xxx.108:7777
Mon Dec 8 11:13:40 2014 SENT CONTROL [neutron]: 'PUSH_REQUEST' (status=1)
Mon Dec 8 11:13:40 2014 PUSH: Received control message: 'PUSH_REPLY,route 10.240.0.0 255.255.0.0,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route-gateway 10.8.0.1,topology subnet,ping 1800,ping-restart 4000,ifconfig 10.8.0.4 255.255.255.0'
Mon Dec 8 11:13:40 2014 OPTIONS IMPORT: timers and/or timeouts modified
Mon Dec 8 11:13:40 2014 OPTIONS IMPORT: --ifconfig/up options modified
Mon Dec 8 11:13:40 2014 OPTIONS IMPORT: route options modified
Mon Dec 8 11:13:40 2014 OPTIONS IMPORT: route-related options modified
Mon Dec 8 11:13:40 2014 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Mon Dec 8 11:13:40 2014 ROUTE_GATEWAY 192.168.0.1/255.255.255.0 IFACE=wlan0 HWADDR=dc:85:de:9d:6c:f7
Mon Dec 8 11:13:40 2014 RESOLVE: Cannot resolve host address: no-pull: Name or service not known
Mon Dec 8 11:13:40 2014 OpenVPN ROUTE: failed to parse/resolve route for host/network: no-pull
Mon Dec 8 11:13:40 2014 TUN/TAP device tun0 opened
Mon Dec 8 11:13:40 2014 TUN/TAP TX queue length set to 100
Mon Dec 8 11:13:40 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Dec 8 11:13:40 2014 /sbin/ip link set dev tun0 up mtu 1500
Mon Dec 8 11:13:40 2014 /sbin/ip addr add dev tun0 10.8.0.4/24 broadcast 10.8.0.255
Mon Dec 8 11:13:40 2014 /sbin/ip route add 10.240.0.0/16 via 10.8.0.1
Mon Dec 8 11:13:40 2014 GID set to nogroup
Mon Dec 8 11:13:40 2014 UID set to nobody
Mon Dec 8 11:13:40 2014 Initialization Sequence Completed

// server
sudo openvpn --config server.conf
Mon Dec 8 10:24:54 2014 us=234932 Current Parameter Settings:
Mon Dec 8 10:24:54 2014 us=235045 config = 'server.conf'
Mon Dec 8 10:24:54 2014 us=235094 mode = 1
Mon Dec 8 10:24:54 2014 us=235137 persist_config = DISABLED
Mon Dec 8 10:24:54 2014 us=235179 persist_mode = 1
Mon Dec 8 10:24:54 2014 us=235217 show_ciphers = DISABLED
Mon Dec 8 10:24:54 2014 us=235248 show_digests = DISABLED
Mon Dec 8 10:24:54 2014 us=235277 show_engines = DISABLED
Mon Dec 8 10:24:54 2014 us=235306 genkey = DISABLED
Mon Dec 8 10:24:54 2014 us=235335 key_pass_file = '[UNDEF]'
Mon Dec 8 10:24:54 2014 us=235363 NOTE: --mute triggered...
Mon Dec 8 10:24:54 2014 us=235401 270 variation(s) on previous 10 message(s) suppressed by --mute
Mon Dec 8 10:24:54 2014 us=235437 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Jun 18 2013
Mon Dec 8 10:24:54 2014 us=235573 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Dec 8 10:24:54 2014 us=240973 Diffie-Hellman initialized with 2048 bit key
Mon Dec 8 10:24:54 2014 us=241525 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Dec 8 10:24:54 2014 us=241580 Socket Buffers: R=[229376->131072] S=[229376->131072]
Mon Dec 8 10:24:54 2014 us=242349 TUN/TAP device tun0 opened
Mon Dec 8 10:24:54 2014 us=242398 TUN/TAP TX queue length set to 100
Mon Dec 8 10:24:54 2014 us=242438 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Dec 8 10:24:54 2014 us=242483 /sbin/ifconfig tun0 10.8.0.1 netmask 255.255.255.0 mtu 1500 broadcast 10.8.0.255
Mon Dec 8 10:24:54 2014 us=244795 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Dec 8 10:24:54 2014 us=245128 GID set to nogroup
Mon Dec 8 10:24:54 2014 us=245141 UID set to nobody
Mon Dec 8 10:24:54 2014 us=245149 UDPv4 link local (bound): [undef]
Mon Dec 8 10:24:54 2014 us=245155 UDPv4 link remote: [undef]
Mon Dec 8 10:24:54 2014 us=245165 MULTI: multi_init called, r=256 v=256
Mon Dec 8 10:24:54 2014 us=245189 IFCONFIG POOL: base=10.8.0.2 size=252, ipv6=0
Mon Dec 8 10:24:54 2014 us=245205 ifconfig_pool_read(), in='zeus,10.8.0.4', TODO: IPv6
Mon Dec 8 10:24:54 2014 us=245213 succeeded -> ifconfig_pool_set()
Mon Dec 8 10:24:54 2014 us=245218 ifconfig_pool_read(), in='arduino-test,10.8.0.8', TODO: IPv6
Mon Dec 8 10:24:54 2014 us=245224 succeeded -> ifconfig_pool_set()
Mon Dec 8 10:24:54 2014 us=245229 ifconfig_pool_read(), in='zeus,10.8.0.12', TODO: IPv6
Mon Dec 8 10:24:54 2014 us=245234 succeeded -> ifconfig_pool_set()
Mon Dec 8 10:24:54 2014 us=245240 IFCONFIG POOL LIST
Mon Dec 8 10:24:54 2014 us=245245 zeus,10.8.0.4
Mon Dec 8 10:24:54 2014 us=245251 arduino-tre-test,10.8.0.8
Mon Dec 8 10:24:54 2014 us=245256 zeus,10.8.0.12
Mon Dec 8 10:24:54 2014 us=245275 Initialization Sequence Completed
Mon Dec 8 10:26:04 2014 us=302443 MULTI: multi_create_instance called
Mon Dec 8 10:26:04 2014 us=302513 2.x.0.x:53368 Re-using SSL/TLS context
Mon Dec 8 10:26:04 2014 us=302546 2.x.0.x:53368 LZO compression initialized
Mon Dec 8 10:26:04 2014 us=302650 2.x.0.x:53368 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Dec 8 10:26:04 2014 us=302661 2.x.0.x:53368 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Dec 8 10:26:04 2014 us=302691 2.x.0.x:53368 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher DES-EDE3-CBC,auth SHA1,keysize 192,key-method 2,tls-server'
Mon Dec 8 10:26:04 2014 us=302698 2.x.0.x:53368 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher DES-EDE3-CBC,auth SHA1,keysize 192,key-method 2,tls-client'
Mon Dec 8 10:26:04 2014 us=302718 2.x.0.x:53368 Local Options hash (VER=V4): '974bef3f'
Mon Dec 8 10:26:04 2014 us=302728 2.x.0.x:53368 Expected Remote Options hash (VER=V4): '827c9ed0'
RMon Dec 8 10:26:04 2014 us=302763 2.x.0.x:53368 TLS: Initial packet from [AF_INET]2.235.0.227:53368, sid=594ccbdf a5577e7e
WRRWRWRWWWWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRRRRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRMon Dec 8 10:26:06 2014 us=652423 2.x.0.x:53368 VERIFY OK: depth=1, /C=IT/ST=BG/L=Be/O=Be/OU=future-division/CN=name=/emailAddress=
Mon Dec 8 10:26:06 2014 us=652618 2.x.0.x:53368 VERIFY OK: depth=0, /C=IT/ST=BG/L=Be/O=Be/OU=future-division/CN=zeus/name=/emailAddress=
WRWRWRWRWRWRWWWWRWRWRWRWRWRWRWRWRWRWRWRWRRRRWRWRWRMon Dec 8 10:26:07 2014 us=364457 2.x.0.x:53368 Data Channel Encrypt: Cipher 'DES-EDE3-CBC' initialized with 192 bit key
Mon Dec 8 10:26:07 2014 us=364542 2.x.0.x:53368 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Dec 8 10:26:07 2014 us=364628 2.x.0.x:53368 Data Channel Decrypt: Cipher 'DES-EDE3-CBC' initialized with 192 bit key
Mon Dec 8 10:26:07 2014 us=364680 2.x.0.x:53368 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
WWWRRRMon Dec 8 10:26:07 2014 us=504197 2.x.0.x:53368 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mon Dec 8 10:26:07 2014 us=504286 2.x.0.x:53368 [zeus] Peer Connection Initiated with [AF_INET]2.x.0.x:53368
....

i think to have problems to see (need some trick ) to check when it works the forwarding on the server ... , telll me if you need more. Thanks

maikcat

did you enabled ip forwarding on your openvpn server?

Michael.

ciccio

Yes of course ...

~$ cat /proc/sys/net/ipv4/ip_forward
1

i can't use intermediate trick to understand how forward the packets between the interfaces on server side, i use tcpdump icmp request
sended from the client on tun0 interface :

ping -I tun0 google.com

i see the packets on the server tun0 interface ..... but i'm looking for the next step to follow them !!

// server
$ ip route show
default via 10.240.0.1 dev eth0
10.8.0.0/24 dev tun0 proto kernel scope link src 10.8.0.1
10.240.0.1 dev eth0 scope link

Traffic

ciccio wrotesended from the client on tun0 interface :

ping -I tun0 google.com

i see the packets on the server tun0 interface ..... but i'm looking for the next step to follow them !!

Try (On the server): tcpdump -i eth0 icmp (Change eth0 to the name of your server ethernet)

Post a small example of the result.

ciccio

Ok ok ... we are near !!

I can see on the eth0 interface the icmp packet forwarded, but in the client i cannot get the oing response. On the server with the
same ping operation to the same address i can get the response not on the client.

// ping from client
ping -I tun0 google.com

// tcpdump -i eth0 -q -n
$ sudo tcpdump -i eth0 icmp -n -q
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
21:13:56.909678 IP 10.240.79.17 > 173.194.67.113: ICMP echo request, id 10283, seq 6, length 64
21:13:57.018493 IP 173.194.67.113 > 10.240.79.17: ICMP echo reply, id 10283, seq 6, length 64

// ping from server
ping -eth0 google.com

// tcpdump -i eth0 icmp
21:11:45.905451 IP 74.125.69.101 > 10.240.79.17: ICMP echo reply, id 10498, seq 30, length 64
21:11:46.904437 IP 10.240.79.17 > 74.125.69.101: ICMP echo request, id 10498, seq 31, length 64

On iptables all traffic are ACCEPT , so maybe only a route problem on the client can get my last problem to see the response to ping on the client ?

Traffic

Have you read the HOWTO for this problem:
HOWTO: Expanding the scope of the VPN to include additional machines

ciccio

Yes i did it, now looks like all ok for the icmp traffic, i can ping all the nodes in and out the tun0 network, i face only one problem
i cannot navigate with the browsers when the VPN is active on the client , is quite strange because i can use the wget on the same address
i'm tring to navigate with the browsers !

// route table (where 192.168.0.1 is the client LAN gateway, 192.168.0.104 client LAN addr, 14x.xxx.xxx.108 is the OpenVPN server addr )
sudo ip route
0.0.0.0/1 via 10.8.0.1 dev tun0
default via 192.168.0.1 dev wlan0 proto static
10.8.0.0/24 dev tun0 proto kernel scope link src 10.8.0.4
10.240.0.0/16 via 10.8.0.1 dev tun0
128.0.0.0/1 via 10.8.0.1 dev tun0
14x.xxx.xxx.108 via 192.168.0.1 dev wlan0
192.168.0.0/24 dev wlan0 proto kernel scope link src 192.168.0.104 metric 9

// route table with the OpenVPN service down
sudo ip route
default via 192.168.0.1 dev wlan0 proto static
14x.xxx.xxx.108 via 192.168.0.1 dev wlan0
192.168.0.0/24 dev wlan0 proto kernel scope link src 192.168.0.104 metric 9

...

Traffic

What are the real networks in use at your server and client (not the VPN network) ?

ciccio

I cannot understand what does it means real network ..... eth0 on server and wlan0 on PC ?

Traffic

Real IP:

Server eth0: 10.240.79.17/16 gw 10.240.0.1
Client eth0: 192.168.0.104/24 gw 192.168.0.1

This is suitable ..

ciccio wrote// client.conf
client
...
route no-pull

The Manual wrote--route-nopull

When used with --client or --pull, accept options pushed by server EXCEPT for routes and dhcp options like DNS servers.

When used on the client, this option effectively bars the server from adding routes to the client's routing table, however note that this option still allows the server to set the TCP/IP properties of the client's TUN/TAP interface.

ciccio

I think i cannot want to disable the server push, i ca't understand why the icmp traffic follow the right path and i can see the answear at
ping command , the same for a wget request (eg wget www.facebook.com) that work (slowly), but when i try to navigate through a browser
i can see "established secure connection " on bottom toolbar but i can't navigate !!!

With tcpdump i can see the traffic in both case (wget - browser) go out from the server interface tun0 -> eth0 -> server(with web page requested)
but the browser hold on waiting and it does NOT display the page .... it strange because i can see that some tcp packets arriving and for example
if a request a page like www.nike.com i get (slowly) only the header :

<html>
<head>
<title>NIKE, Inc.— Inspiration and Innovation for Every Athlete in the World.</title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="description" content="Experience sports, training, shopping and everything else that's new at Nike.">
<script type="text/javascript" src="http://store.nike.com/NikeScriptManager.js?assets=nike,jQuery,nike.ScriptLoader,nike.EventBus,nike.page.OneNikeShell,nike.page.OneNikePageLayout,nike.fonts.glyphPolyfill,nike.exp.global.Ad,nike.exp.util.shared.desktop.CookieSettings,nike.style.exp.exp-desktop&assetType=SCRIPT&buildRev=023edc279f1434f07a1044547cfcf222b23e39ac"></script>
<head>
<html>

and get a Timeout error :

Failed to load resource: net::ERR_CONNECTION_TIMED_OUT

..... so i have no ideas for the moment !

THKs

maikcat

MTU issue? :?

Michael.

ciccio

Perfect .... thanks guys !! I solve the problem (MTU issue ) easy adding the following in both client.conf and server.conf :

mssfix 1200

Now my OpenVPN client-server architecture works very well, i hope to get an help to other persons with the same issue !!

Thanks for the Help ... !!

Traffic

ciccio wrote// log file on client
Mon Dec 8 11:13:34 2014 OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Dec 1 2014
..
Mon Dec 8 11:13:40 2014 RESOLVE: Cannot resolve host address: no-pull: Name or service not known
Mon Dec 8 11:13:40 2014 OpenVPN ROUTE: failed to parse/resolve route for host/network: no-pull