There are two interconnected LANs through openVPN [list] 192.168.131.0 192.168.131.100 router, default gateway 192.168.131.1 openVPN server, ubuntu linux 192.168.131.59 RDP server [/list] [list] 192.168.132.0 192.168.132.100 - router with openWRT, default gateway and VPN client. 192.168.132.101 - RDP client [/list] My goal is to connect from RDP client to RDP server. On openVPN server, with ubuntu, forwarding is enabled [code] cat /proc/sys/net/ipv4/ip_forward 1 [/code] On router(192.168.131.100) on server side I have static route: [list] 192.168.132.0 mask 255.255.255.0 gw 192.168.131.1 [/list] On openVPN server(192.168.131.1) server.conf [url]http://paste.ubuntu.com/9916610/[/url] [list] iroute 192.168.132.0 255.255.255.0 #push "route 192.168.133.0 255.255.255.0" [/list] On VPN client(192.168.131.100) client.conf [url]http://paste.ubuntu.com/9916638/[/url] So... From RDP server I can ping 192.168.132.101(RDP client) without any troubles. But from RDP client I can't ping 192.168.131.59(RDP server) And I could not understand why, help me please. P.S. On RDP client [code] mtr -r -c1 --no-dns 192.168.131.1 HOST: RDP client Loss% Snt Last Avg Best Wrst StDev 1.|-- 192.168.132.100 0.0% 1 0.3 0.3 0.3 0.3 0.0 2.|-- 192.168.131.1 0.0% 1 25.6 25.6 25.6 25.6 0.0 [/code] [code] mtr -r -c1 --no-dns 192.168.131.59 HOST: RDP client Loss% Snt Last Avg Best Wrst StDev 1.|-- 192.168.132.100 0.0% 1 0.4 0.4 0.4 0.4 0.0 2.|-- 10.10.12.1 0.0% 1 25.5 25.5 25.5 25.5 0.0 3.|-- ??? 100.0 1 0.0 0.0 0.0 0.0 0.0 [/code]

I posted it, but forgot to say that it was content of gws file, sorry /etc/openvpn/ccd/gws [code] iroute 192.168.132.0 255.255.255.0 #push "route 192.168.133.0 255.255.255.0" [/code]

[quote]From RDP server I can ping 192.168.132.101(RDP client) without any troubles. But from RDP client I can't ping 192.168.131.59(RDP server)[/quote] is rdp server running a firewall? also can you post the output of iptables -L -t nat -v on your openvpn server? Michael.

Routing to LANs

oslyak

There are two interconnected LANs through openVPN

192.168.131.0
192.168.131.100 router, default gateway
192.168.131.1 openVPN server, ubuntu linux
192.168.131.59 RDP server

192.168.132.0
192.168.132.100 - router with openWRT, default gateway and VPN client.
192.168.132.101 - RDP client

My goal is to connect from RDP client to RDP server.

On openVPN server, with ubuntu, forwarding is enabled

cat /proc/sys/net/ipv4/ip_forward
1

On router(192.168.131.100) on server side I have static route:

192.168.132.0 mask 255.255.255.0 gw 192.168.131.1

On openVPN server(192.168.131.1)
server.conf http://paste.ubuntu.com/9916610/

iroute 192.168.132.0 255.255.255.0
#push "route 192.168.133.0 255.255.255.0"

On VPN client(192.168.131.100)
client.conf http://paste.ubuntu.com/9916638/

So...
From RDP server I can ping 192.168.132.101(RDP client) without any troubles.

But from RDP client I can't ping 192.168.131.59(RDP server)

And I could not understand why, help me please.

P.S.
On RDP client

mtr -r -c1  --no-dns 192.168.131.1
HOST: RDP client            Loss%   Snt   Last   Avg  Best  Wrst StDev
  1.|-- 192.168.132.100     0.0%     1    0.3   0.3   0.3   0.3   0.0
  2.|-- 192.168.131.1       0.0%     1   25.6  25.6  25.6  25.6   0.0

mtr -r -c1  --no-dns 192.168.131.59
HOST: RDP client            Loss%   Snt   Last   Avg  Best  Wrst StDev
  1.|-- 192.168.132.100     0.0%     1    0.4   0.4   0.4   0.4   0.0
  2.|-- 10.10.12.1          0.0%     1   25.5  25.5  25.5  25.5   0.0
  3.|-- ???                100.0     1    0.0   0.0   0.0   0.0   0.0

maikcat

please post the contents of ccd file named gws.

for reference:

client config

client
script-security 2
ns-cert-type server
tls-client
dev tun0
proto udp 
remote monolith.sirius.if.ua 31194
remote 194.126.183.223 31194
resolv-retry infinite 
nobind 
ca   /etc/openvpn/keys/sirius/ca.crt 
cert /etc/openvpn/keys/sirius/gws.crt 
key  /etc/openvpn/keys/sirius/gws.key 
log    /var/log/openvpn-sirius.log
status /var/log/openvpn-sirius-status.log
comp-lzo 
persist-tun 
persist-key 
verb 4

server config

mode server
script-security 2
port  1194
proto udp
dev   tun
ca   /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key  /etc/openvpn/keys/server.key
dh   /etc/openvpn/keys/dh1024.pem
tls-server
duplicate-cn
ifconfig-pool-persist /etc/openvpn/ipp.txt
server 10.10.12.0 255.255.255.0
push "route 192.168.131.0 255.255.255.0"
push "route 192.168.132.0 255.255.255.0"
client-config-dir /etc/openvpn/ccd
route 192.168.132.0 255.255.255.0
client-to-client
comp-lzo
persist-key
persist-tun
verb 4
keepalive 10 120
log    /var/log/openvpn.log
status /var/log/openvpn-status.log

Michael.

oslyak

I posted it, but forgot to say that it was content of gws file, sorry

/etc/openvpn/ccd/gws

iroute 192.168.132.0 255.255.255.0
#push "route 192.168.133.0 255.255.255.0"

maikcat

From RDP server I can ping 192.168.132.101(RDP client) without any troubles.

But from RDP client I can't ping 192.168.131.59(RDP server)

is rdp server running a firewall?

also can you post the output of

iptables -L -t nat -v

on your openvpn server?

Michael.

oslyak

iptables -L -t nat -v

Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

ping 192.168.131.59

ping 192.168.131.59
PING 192.168.131.59 (192.168.131.59) 56(84) bytes of data.
64 bytes from 192.168.131.59: icmp_seq=1 ttl=128 time=0.380 ms
64 bytes from 192.168.131.59: icmp_seq=2 ttl=128 time=0.309 ms
64 bytes from 192.168.131.59: icmp_seq=3 ttl=128 time=0.365 ms

firewall is off.

maikcat

from where are you pinging 192.168.131.59 and it responds?

also when traffic is working one way but not the other way around
something is blocking traffic , except if you use NAT somewhere
but from your iptables output this is not happening.

what OS is your server?
any chance that runs any antivirus program which performs network filtering?

Michael.

oslyak

I pinged from openVNP server,
100% have no troubles with antiviruses, becaus...

Recently I had openVPN server on Office router, with openWRT and everything worked perfectly.
But suddenly Office Router has died.
I just replaced it with another TPLink router but without openWRT.
Moved openVPN server from dead router to ubuntu linux(192.168.131.1)
On new Office Router set port forwarding and one static route: 192.168.132.0 mask 255.255.255.0 gw 192.168.131.1

on ubuntu linux enabled ip forward:

cat /proc/sys/net/ipv4/ip_forward
1

So now I can ping from RDP server to RDP client just fine.
But not in opposite direction.

On RDP server OS Windows 7 Ultimate with turned off firewall and without antivirus(for test purpose).

From ubuntu linux I can connect to RDP server without any troubles and ping it.