[Solved]OpenVPN - Home Network - Cannot ping local devices

brudnypiotr

Hello 🙂 My name is Piotr, I have a problem with OpenVPN setup...

On Server0 there are samba, kodi, transmission configured. I would like to have secured access from PC2 (on the picture below it is in 192.168.0.0 subnet, but in general it will be remote connection) to all this stuff on Server0 and PC1 (i.e. windows RDP – not configured yet).
I established OpenVPN connection between PC2 and Server0. From PC2 I can ping 10.8.0.1 and 192.168.0.1 only. I cannot ping any device from 192.168.1.0 subnet.
If I use wireshark on PC2 I can see that only 10.8.0.1 pings goes through "Karta Ethernet Połączenie lokalne 2" interface. It looks like “Karta Ethernet Połączenie lokalne” is more important, and all traffic go through it.

What I did:
1. generated keys,
2. sat up OpenVPN,
3. sysctl -w net.ipv4.ip_forward=1
4. iptables -I FORWARD -i tun0 -o p2p1 -s 10.8.0.0/24 -d 192.168.1.0/24 -m conntrack --ctstate NEW -j ACCEPT
5. iptables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

Thanks for your help!

Network:

PC2 (Windows 7 Pro):

Ipconfig:

C:\Users\Piotrek>ipconfig
Karta Ethernet Połączenie lokalne 2:

   Sufiks DNS konkretnego połączenia :
   Adres IPv6 połączenia lokalnego . : fe80::2808:d1ac:733d:1dd7%16
   Adres IPv4. . . . . . . . . . . . . : 10.8.0.6
   Maska podsieci. . . . . . . . . . : 255.255.255.252
   Brama domyślna. . . . . . . . . . : 10.8.0.1

Karta Ethernet Połączenie lokalne:

   Sufiks DNS konkretnego połączenia : lan
   Adres IPv6 połączenia lokalnego . : fe80::c4ea:a9a1:dc55:7e68%11
   Adres IPv4. . . . . . . . . . . . . : 192.168.1.129
   Maska podsieci. . . . . . . . . . : 255.255.255.0
   Brama domyślna. . . . . . . . . . : 192.168.1.1

OpenVPN settings:

remote publicIP 1193
proto udp
dev tun
client
comp-lzo
resolv-retry infinite
nobind
remote-cert-tls server
ca ca.crt
cert ultrabook-piotrek.crt
key ultrabook-piotrek.key

OpenVPN logs:

Sun Feb 08 17:49:06 2015 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec  1 2014
Sun Feb 08 17:49:06 2015 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08
Sun Feb 08 17:49:07 2015 UDPv4 link local: [undef]
Sun Feb 08 17:49:07 2015 UDPv4 link remote: [AF_INET]publicIP:1193
Sun Feb 08 17:49:07 2015 [nuc] Peer Connection Initiated with [AF_INET] publicIP:1193
Sun Feb 08 17:49:09 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Feb 08 17:49:09 2015 open_tun, tt->ipv6=0
Sun Feb 08 17:49:09 2015 TAP-WIN32 device [Połączenie lokalne 2] opened: \\.\Global\{35B4DE46-B006-4FBF-9B09-ED027BF603BD}.tap
Sun Feb 08 17:49:09 2015 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {35B4DE46-B006-4FBF-9B09-ED027BF603BD} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Sun Feb 08 17:49:09 2015 Successful ARP Flush on interface [16] {35B4DE46-B006-4FBF-9B09-ED027BF603BD}
Sun Feb 08 17:49:14 2015 Initialization Sequence Completed

Server0 (Ubuntu Server 14.04 headless):

brudnypiotr@nuc:~$ ifconfig

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:348791 errors:0 dropped:0 overruns:0 frame:0
          TX packets:348791 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:180292993 (180.2 MB)  TX bytes:180292993 (180.2 MB)

p2p1      Link encap:Ethernet  HWaddr c0:3f:d5:65:4f:e4
          inet addr:192.168.1.200  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::c23f:d5ff:fe65:4fe4/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:123735139 errors:0 dropped:0 overruns:0 frame:0
          TX packets:91557378 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:152953927495 (152.9 GB)  TX bytes:80240284227 (80.2 GB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:29 errors:0 dropped:0 overruns:0 frame:0
          TX packets:29 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:1740 (1.7 KB)  TX bytes:1740 (1.7 KB)

brudnypiotr@nuc:~$ sudo iptables -L

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:openvpn
ACCEPT     udp  --  anywhere             anywhere             udp dpt:openvpn

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  10.8.0.0/24          192.168.1.0/24       ctstate NEW

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

OpenVPN settings:

port 1193
proto udp
dev tun
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/nuc.crt
key /etc/openvpn/easy-rsa/keys/nuc.key  # This file should be kept secret
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

maikcat

you will need to add to your openvpn server config:

push "route 192.168.1.0 255.255.255.0"

also your client has the same lan? (192.168.1.0)

a good approach is to disable your firewalls for now and enable them
when you will know your setup works.

Michael.

Traffic

brudnypiotr wroteI would like to have secured access from PC2 (on the picture below it is in 192.168.0.0 subnet, but in general it will be remote connection) to all this stuff on Server0 and PC1

These HOWTOs will help:

Also:

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

brudnypiotr

maikcat wroteyou will need to add to your openvpn server config:

push "route 192.168.1.0 255.255.255.0"

also your client has the same lan? (192.168.1.0)

Thank you! After writing my last post I figured out, that I missed routing configuration on my windows client. I've added static route similar to your command, but this is much more usefull! Now, everything works like a charm.

My client network (subnet) is different than server one.

Traffic wrote
brudnypiotr wroteI would like to have secured access from PC2 (on the picture below it is in 192.168.0.0 subnet, but in general it will be remote connection) to all this stuff on Server0 and PC1
These HOWTOs will help:
HOWTO: Expanding the scope of the VPN to include additional machines

HOWTO: Routing all client traffic (including web-traffic) through the VPN
Also:
NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

Thanks. I've faced this issue today. I have to change my local subnet (server one) to avoid this problems.

maikcat

Marked as Solved.

Closing topic,

regards,

Michael.