Internal OpenVPN server: routing issues and no LAN access

skiglades

I'm not able to access the LAN from the OpenVPN subnet, despite having port-forwarding, IPv4 forwarding, iptables, and routes configured. Likely the routing or iptables portions are incorrect in some way.

Network Summary:
LAN: 192.168.1.0/24
OpenVPN: 10.8.0.0/24
DD-WRT router: 192.168.1.2
OpenVPN server: 192.168.1.50 (10.8.0.1)

OpenVPN server.conf

port 1194
proto udp
dev tun
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key  # This file should be kept secret
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.1.0 255.255.255.0"
push "redirect-gateway def1"
push "dhcp-option DNS 10.8.0.1"
client-to-client
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3

Ifconfig output looks OK with the tun0 interface showing up:

eth0      Link encap:Ethernet  HWaddr 00:1f:c6:2b:ff:a0  
          inet addr:192.168.1.50  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::21f:c6ff:fe2b:ffa0/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:117758 errors:0 dropped:46 overruns:0 frame:0
          TX packets:69806 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:152725368 (152.7 MB)  TX bytes:5382982 (5.3 MB)
          Interrupt:17 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:5833 errors:0 dropped:0 overruns:0 frame:0
          TX packets:5833 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:3010738 (3.0 MB)  TX bytes:3010738 (3.0 MB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

IPv4 Forwarding enabled via these configs:

echo 1 > /proc/sys/net/ipv4/ip_forward

# Controls IP packet forwarding
net.ipv4.ip_forward = 1

iptables configuration in rc.local (pulled from various write-ups in hopes of making it work)

iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to 192.168.1.50
iptables -A FORWARD -j REJECT
service dnsmasq restart

Figured I may need a route on the DD-WRT router:

Destination LAN NET    Subnet Mask                Gateway
10.8.0.0             255.255.255.0                192.168.1.50

Added a route to 10.8.0.0 on my OpenVPN Ubuntu server. Not sure however if routes to the OpenVPN subnet are meant to go through the OpenVPN server IP (10.8.0.1), OpenVPN server P-T-P IP (10.8.0.2) or the OpenVPN server LAN IP (192.168.1.50).

So not sure which command:

route add -net 10.8.0.0/24 gw 192.168.1.50
route add -net 10.8.0.0/24 gw 10.8.0.1

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.2     0.0.0.0         UG    0      0        0 eth0
10.8.0.0        10.8.0.1        255.255.255.0   UG    0      0        0 tun0
10.8.0.0        192.168.1.50    255.255.255.0   UG    0      0        0 eth0 # <-- THIS ONE
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.8.0.2        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
192.168.1.0     0.0.0.0         255.255.255.0   U     1      0        0 eth0

Attempting to ping the LAN from the OpenVPN subnet is failing:

ping -I tun0 192.168.1.50
PING 192.168.1.50 (192.168.1.50) from 10.8.0.1 tun0: 56(84) bytes of data.

--- 192.168.1.50 ping statistics ---
2 packets transmitted, 0 received, 100% packet loss, time 999ms

ping -I tun0 192.168.1.2
PING 192.168.1.2 (192.168.1.2) from 10.8.0.1 tun0: 56(84) bytes of data.

--- 192.168.1.2 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2015ms

ping -I tun0 yahoo.com
PING yahoo.com (98.138.253.109) from 10.8.0.1 tun0: 56(84) bytes of data.

--- yahoo.com ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2015ms

Overall I'm not sure if I require static routes on both the Ubuntu OpenVPN server and the DD-WRT router. I've read at least the guides below but am struggling to make it work. Any help would be appreciated.

http://grantcurell.com/2014/07/22/setting-up-a-vpn-server-on-ubuntu-14-04/
http://www.unixmen.com/setup-configure-openvpn-server-ubuntu-13-10/
http://parabing.com/2014/06/openvpn-on-ubuntu/
http://stackoverflow.com/questions/26539719/openvpn-and-iptables
http://allanmcrae.com/2013/09/routing-traffic-with-openvpn/
http://blog.remibergsma.com/2013/01/13/howto-connect-to-hosts-on-a-remote-network-using-openvpn-and-some-routing/

Traffic

You can not ping 192.168.1.50 (or any other host on that subnet) from the server tun device.
You can, however do: ping 192.168.0.50 -I 10.8.0.1

iptables; clear all other rules except:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQERADE

skiglades wroteFigured I may need a route on the DD-WRT router:

Code:
Destination LAN NET Subnet Mask Gateway
10.8.0.0 255.255.255.0 192.168.1.50

This is correct.

skiglades wroteAdded a route to 10.8.0.0 on my OpenVPN Ubuntu server. Not sure however if routes to the OpenVPN subnet are meant to go through the OpenVPN server IP (10.8.0.1), OpenVPN server P-T-P IP (10.8.0.2) or the OpenVPN server LAN IP (192.168.1.50).

So not sure which command:
Code:
route add -net 10.8.0.0/24 gw 192.168.1.50
route add -net 10.8.0.0/24 gw 10.8.0.1

This is not correct.

Your OpenVPN server config will add the correct routes, you do not add any further routes manually.

Questions:
1. From your VPN client can you ping your VPN server 10.8.0.6 -> 10.8.0.1 ?
2. From your VPN client can you ping your VPN server default gateway 10.8.0.6 -> 192.168.0.1 ?

skiglades

Traffic, thanks so much.

Questions:
1. From your VPN client can you ping your VPN server 10.8.0.6 -> 10.8.0.1 ?
2. From your VPN client can you ping your VPN server default gateway 10.8.0.6 -> 192.168.0.1 ?

Once connected with my client (10.8.0.6) I was able to ping (using "Ping" iOS app) the OpenVPN IP (10.8.0.1) and my default gateway (192.168.1.2). I think my issue was around my server.conf DHCP options, as ping to hostnames and web hosts did not work until I pushed a DHCP server of 192.168.1.2 (my gateway) vs. just my OpenVPN Server IP (10.8.0.1)

server.conf changed from this:

push "dhcp-option DNS 10.8.0.1"

to this:

push "dhcp-option DNS 10.8.0.1"
push "dhcp-option DNS 192.168.1.2"  # <--added default gateway

Not sure if that config is totally ideal but it resolved the DNS-based issues I was having. Thanks for pointing me in the right direction, concerning not being able to ping straight from the tun0 device. Much appreciated!

Traffic

If you push a DNS server address to your client then the server must be running either a full DNS server or a DNS Proxy.

Your Linux server 193.168.1.50 is obviously not running either but your DD-WRT 192.168.1.2 router is ...

skiglades

Correct, Linux server isn't running full DNS which makes sense now. Cleaned up server.conf to remove non-DNS option. Thanks again.

push "dhcp-option DNS 192.168.1.2"