Route between two OpenVPN tunnels

ptl

I need to set-up something like this:

Clients - OpenVPN_tun0 - Int_Server - OpenVPN_tun1 - Ext_Servers - public_internet

Both OpenVPN tunnels are up and running using 'dev tun', but I have difficulties routing the traffic between the tunnels.

OpenVPN_tun0 server is Int_Server, and Int_Server is a client in OpenVPN_tun1. I can admin Int_Server, but not Ext_servers.

OpenVPN_tun0 is 10.20.30.0/24 (just one server) and OpenVPN_tun1 IP address varies (several servers, 'remote-random' currently present in OpenVN_tun1 client configuration).

Int_Server is running Fedora21, so it has firewalld.

Int_server OpenVPN server configuration has 'push "redirect-gateway def1"' so all traffic from Clients is routed to OpenVN_tun0.

The problem is that Client(s) do not have internet access unless I enable masquerading for public zone in the Int_Server ('firewall-cmd --zone=public --add-masquerade') and then the traffic goes out from 'eth0' interface.

This is what I have now (without public zone masquerading):

Int_Server # firewall-cmd --list-all-zones | grep -v -e ": $" -e "masquerade: no$"
...
external (active)
  interfaces: tun1
  masquerade: yes
...
internal (active)
  interfaces: tun0

public (default, active)
  interfaces: eth0
  services: xxx yyy zzz ssh
...

Int_Server # firewall-cmd --direct --get-all-rules
ipv4 filter FORWARD 10 -i tun0 -o tun1 -m conntrack --ctstate NEW -j ACCEPT
ipv4 filter FORWARD 20 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

Int_Server # cat /etc/openvpn/openvpn.log | grep ROUTE_GATEWAY | tail -1
Thu Jan 29 11:40:13 2015 ROUTE_GATEWAY x.y.z.1/255.255.255.0 IFACE=eth0 HWADDR=ff:aa:bb:cc:ee:ee

Any help is appreciated, starting from the confirmation that routing between two OpenVPN tunnels is possible in the first place.

-Paavo

maikcat

post your configs, your server(s) routing tables and we will help you out.

Michael.

ptl

OpenVPN_tun0 Int_Server config:

port 1194
proto tcp
dev tun0 # fixed tun device
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.20.30.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
keepalive 30 300
tls-auth ta.key 0
cipher AES-256-CBC
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log-append openvpn.log
verb 3

OpenVPN_tun0 Client config:

client
dev tun
proto tcp
remote int-server.domain.com 1194
resolv-retry infinite
nobind
user nobody
group nobody
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
ns-cert-type server
tls-auth ta.key 1
cipher AES-256-CBC
comp-lzo
verb 3

OpenVPN_tun0 Client route before starting OpenVPN_tun0:

# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.0.1     0.0.0.0         UG    1024   0        0 wls3
192.168.0.0     0.0.0.0         255.255.255.0   U     0      0        0 wls3

OpenVPN_tun0 Client route after starting OpenVPN_tun0:

# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.20.30.5      128.0.0.0       UG    0      0        0 tun0
default         192.168.0.1     0.0.0.0         UG    1024   0        0 wls3
10.20.30.1      10.20.30.5      255.255.255.255 UGH   0      0        0 tun0
10.20.30.5      0.0.0.0         255.255.255.255 UH    0      0        0 tun0
int-server.doma 192.168.0.1     255.255.255.255 UGH   0      0        0 wls3
128.0.0.0       10.20.30.5      128.0.0.0       UG    0      0        0 tun0
192.168.0.0     0.0.0.0         255.255.255.0   U     0      0        0 wls3

OpenVPN_tun0 Int_Server route when both tunnels are down:

# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         gateway1        0.0.0.0         UG    0      0        0 eth0
22.33.44.0      0.0.0.0         255.255.255.0   U     0      0        0 eth0

OpenVPN_tun0 Int_Server route when only OpenVPN_tun0 is up:

# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         gateway1        0.0.0.0         UG    0      0        0 eth0
10.20.30.0      10.20.30.2      255.255.255.0   UG    0      0        0 tun0
10.20.30.2      0.0.0.0         255.255.255.255 UH    0      0        0 tun0
22.33.44.0      0.0.0.0         255.255.255.0   U     0      0        0 eth0

OpenVPN_tun0 Int_Server route when both tunnels are up:

# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         gateway1        0.0.0.0         UG    0      0        0 eth0
10.0.0.33       0.0.0.0         255.255.255.255 UH    0      0        0 tun1
10.20.30.0      10.20.30.2      255.255.255.0   UG    0      0        0 tun0
10.20.30.2      0.0.0.0         255.255.255.255 UH    0      0        0 tun0
22.33.44.0      0.0.0.0         255.255.255.0   U     0      0        0 eth0

OpenVPN_tun1 Int_Server client config (server config not available):

client
proto udp
resolv-retry infinite
nobind
key-direction 1
persist-key
persist-tun
ns-cert-type server
mute 10
comp-lzo
verb 3
pull
fast-io
auth-nocache
cipher AES-128-CBC
remote-random
dev tun1 # fixed tun device
route-noexec # do not allow overwriting default route
auth-user-pass "/etc/openvpn/client.login" # user/pass

remote server1 port1
remote server2 port2
remote server3 port3
...
remote serverN portN

<ca>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</ca>

<tls-auth>
-----BEGIN OpenVPN Static key V1-----
...
-----END OpenVPN Static key V1-----
</tls-auth>

-Paavo

maikcat

Both OpenVPN tunnels are up and running using 'dev tun', but I have difficulties routing the traffic between the tunnels.

due to the fact that the second vpn tunnel is not managed by you then the "external" server
has no idea about the ip networks you route behind the external vpn client,

so NAT is the only way to go if you want your internal vpn clients to have access to external vpn server.

The problem is that Client(s) do not have internet access unless I enable masquerading for public zone in the Int_Server ('firewall-cmd --zone=public --add-masquerade') and then the traffic goes out from 'eth0' interface.

btw your server lan ip is a private or public based ip?

Michael.

ptl

Hi Michael,

maikcat wrotedue to the fact that the second vpn tunnel is not managed by you then the "external" server
has no idea about the ip networks you route behind the external vpn client,

so NAT is the only way to go if you want your internal vpn clients to have access to external vpn server.

This is why I have (tried to se-up) masquerade for external zone (OpenVPN_tun1 to Ext_Servers).

Int_Server # firewall-cmd --list-all-zones | grep -v -e ": $" -e "masquerade: no$"
...
external (active)
  interfaces: tun1
  masquerade: yes
...
internal (active)
  interfaces: tun0

public (default, active)
  interfaces: eth0
  services: xxx yyy zzz ssh
...

maikcat wrotebtw your server lan ip is a private or public based ip?

Int_Server eth0 is a static public IP address, the Clients have no problems getting OpenVPN_tun0 to Int_Server established.

I think both tunnels are up and running OK, so my (somewhat limited) understanding is that routing/forwarding does not work.

I have (tried) to set-up the firewalld direct rules that IMHO should take care of it:

Int_Server # firewall-cmd --direct --get-all-rules
ipv4 filter FORWARD_direct 10 -i tun0 -o tun1 -m conntrack --ctstate NEW -j ACCEPT
ipv4 filter FORWARD_direct 20 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

Note: now using FORWARD_direct instead of plain FORWARD, but not sure what difference (if any) that makes.

But ifconfig does not show any packets going to or coming from tun1, the counters are empty.

Int_Server # ifconfig
...
tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 10.20.30.1  netmask 255.255.255.255  destination 10.20.30.2
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
        RX packets 769  bytes 47468 (46.3 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 599  bytes 53992 (52.7 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

tun1: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 10.0.0.198  netmask 255.255.255.255  destination 10.0.0.197
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Client does not have internet connecticity unless I enable masquerading for eth0

Client $ wget www.google.fi
--2015-02-01 11:31:42--  http://www.google.fi/
Resolving www.google.fi (www.google.fi)... 74.125.133.94, 2a00:1450:400c:c07::5e
Connecting to www.google.fi (www.google.fi)|74.125.133.94|:80... failed: No route to host.
Connecting to www.google.fi (www.google.fi)|2a00:1450:400c:c07::5e|:80... failed: Network is unreachable.

Int_Server # firewall-cmd --zone=public --add-masquerade
success

Client $ get www.google.fi
--2015-02-01 11:36:34--  http://www.google.fi/
Resolving www.google.fi (www.google.fi)... 74.125.133.94, 2a00:1450:400c:c07::5e
Connecting to www.google.fi (www.google.fi)|74.125.133.94|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/html]
Saving to: ‘index.html’

index.html              [ <=>                  ]  17,86K  --.-KB/s   in 0,1s   

2015-02-01 11:36:34 (131 KB/s) - ‘index.html’ saved [18288]

Int_Server # firewall-cmd --zone=public --remove-masquerade
success

Client $ wget www.google.fi
--2015-02-01 11:38:10--  http://www.google.fi/
Resolving www.google.fi (www.google.fi)... 74.125.133.94, 2a00:1450:400c:c07::5e
Connecting to www.google.fi (www.google.fi)|74.125.133.94|:80... failed: No route to host.
Connecting to www.google.fi (www.google.fi)|2a00:1450:400c:c07::5e|:80... failed: Network is unreachable.

Int_Server has this:

# cat /etc/openvpn/openvpn.log | grep ROUTE_GATEWAY | tail -1
Sat Jan 31 10:45:05 2015 ROUTE_GATEWAY 22.33.44.1/255.255.255.0 IFACE=eth0 HWADDR=ff:aa:bb:cc:dd:ee

I tried adding this to Int_Server OpenVPN_tun0 server config:

route-gateway 10.0.0.197

Where 10.0.0.197 comes from

Int_Server # systemctl restart openvpn@OpenVPN_tun1.service
Int_Server # sleep 30 && TUN0_GW="$(route | grep tun1 | awk '{print $1}')"
Int_Server # echo $TUN0_GW
10.0.0.197
Int_Server # route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         gateway1        0.0.0.0         UG    0      0        0 eth0
10.0.0.197      0.0.0.0         255.255.255.255 UH    0      0        0 tun1
10.20.30.0      10.20.30.2      255.255.255.0   UG    0      0        0 tun0
10.20.30.2      0.0.0.0         255.255.255.255 UH    0      0        0 tun0
22.33.44.0      0.0.0.0         255.255.255.0   U     0      0        0 eth0

But routing tun0 <-> tun1 still did not work.

Does it matter if I'm using proto tcp or udp? Does it have to be the same for tun0 and tun1?
Is using 'dev tun' OK? I'm totally unexperienced with taps...

-Paavo

maikcat

is ip forwarding enabled on openvpn server?

Michael.

ptl

Hi,

maikcat wroteis ip forwarding enabled on openvpn server?

Yes it is.

Int_Server # cat /proc/sys/net/ipv4/ip_forward
1

-Paavo

maikcat

so without using NAT , from a client can you ping openvpns server tun1 ip?
can you post the output of tracert to tun1 ip from one of your clients?

also for testing DISABLE any filtering rules on openvpn server itself.

Michael.

ptl

Sorry I have been (and still am) busy with some other stuff...

I'll test with another/dedicated "Int_Server" which does not need route-noexec in the OpenVPN_tun1 client config.

-Paavo