crazytrain
Folks,
I was able to successfully configure my Windows client to VPN in to my Linux (Ubuntu) server. I'm using iptables rules on the Linux box to perform Masq. and control where this client can access. I set up a python web service (python -m http.server) on the Windows client box, which says it is listening on 0.0.0.0 port 8000. However, when I attempt to connect to this using my web browser on the Ubuntu box and the connected client's IP (i.e.: 10.8.1.1), I'm not getting any responses. Further, running wireshark on both the Ubuntu and Windows boxes, I discover that the Syn packet for the port 8000 connection arrives at the Windows box but never gets answered.
I have attempted completely disabling the Windows firewall but that doesn't change the result of no Syn-Ack to the request.
My guess is that there's something I'm not doing correctly with respect to the Windows TAP adapter, but I'm not sure what.
Thanks
Traffic
Did you enable IP Forwarding ?
crazytrain
Just enabled IP Forwarding on the Windows side (it was already on the Linux side). Now, the packet capture on the Windows side shows the Windows box attempting to reply with Syn-Ack to the request. However, on the Linux box packet capture that syn-ack isn't getting through. The Windows side does have a route for the 10.8.0.1 openvpn router.
crazytrain
Looking closer at the Wireshark dump on the Windows side, I see that the Windows box is trying to reply with the Wifi router directly, and isn't going through the OpenVPN interface. The routing table looks like this:
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.2.1 192.168.2.2 25
10.8.0.0 255.255.255.0 10.8.0.1 192.168.2.2 26
10.8.0.1 255.255.255.255 10.8.0.1 192.168.2.2 26
10.8.2.0 255.255.255.252 On-link 10.8.2.1 276
10.8.2.1 255.255.255.255 On-link 10.8.2.1 276
10.8.2.3 255.255.255.255 On-link 10.8.2.1 276
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.1.0 255.255.255.0 10.8.0.1 192.168.2.2 26
192.168.2.0 255.255.255.0 On-link 192.168.2.2 281
192.168.2.2 255.255.255.255 On-link 192.168.2.2 281
192.168.2.255 255.255.255.255 On-link 192.168.2.2 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.8.2.1 276
224.0.0.0 240.0.0.0 On-link 192.168.2.2 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 10.8.2.1 276
255.255.255.255 255.255.255.255 On-link 192.168.2.2 281
===========================================================================
Persistent Routes:
None
Notice that the 10.8.0.1 is set to go out interface 192.168.2.1, not to the 10.8.2.1 interface (even though the gateway is 10.8.0.1). I tried adding a static route to it so that 10.8.0.1 goes through 10.8.2.1 interface, but the wireshark dump indicated that the route was not being used.
crazytrain
Discovered one more thing. If I set the IP of the Windows machine to the base range (10.8.0.x), I can talk to it and it responds correctly. However, even when it's on the 10.8.0.x address, I have an iroute of 192.168.2.x assigned to it. That IP doesn't route back correctly. Only the 10.8.0.x will.
In summary, it looks like the only address that is properly getting back is the 10.8.0.x. The rest are trying to go out the router instead of the OpenVPN tunnel.
