Hello!
I'm having problems getting openvpn working.. I'm almost sure it's a minor detail in my firewall configuration, but have been poking with it for hours and can't find a solution.
Network Diagram:
* The Main Routers and PBX are all running CentOS 7.
My current configuration has a router at each site, both with WAN Links (with Public IPv4 IPs) acting as NAT/gateways/OpenVPN Server/Client for their LANs (this part works ok).
In each LAN there's a PBX, which until now had been communicating with each other through the Sites Routers OpenVPN connection, which use the Main WAN Links.
Since VOIP traffic is affected by network lag, we added a second WAN Link at each site (with Public IPv4 IPs), and connected it directly to the PBX's. The idea is that this Secondary PBX WAN Links are *only* used for the network traffic between PBX at each site. So any internet traffic for the PBX host would go through the Main Site WAN Link, but the communication between the PBX through the Secondary PBX WAN Link (e.g.: PBX yum updates would use the Main Site WAN Links, but VOIP calls would go through the PBX WAN Link).
At each PBX, I added a static route for the other PBX public WAN IP. If from a PBX I do traceroute Other_PBX_WAN_IP, it goes straight to that IP, and doesn't go through the Main Site WAN Link.. So this part is working fine..
I started an OpenVPN Server on PBX Site A and a Client on PBX Site B. The client is connecting Ok to the server. The problem is that the client can ping the server fine, but the server cannot ping the client (times out). The strage thing is that tcpdump on the client shows the icmp request/reply when the server is doing ping, as if everything was ok.. But on the server side, it just times out. I already added the PBX Subnet at the Main Routers Routing tables to point to the PBXs (although I think this is not required in this case).
Config files:
** Config files **
**************
PBX (Site A) - Server:
LAN Interface: enp0s25
LAN IP: 10.30.51.4
LAN Gateway: 10.30.51.1
PBX WAN Interface: br0
PBX WAN IP: 1.1.1.2
PBX WAN Gateway: 1.1.1.1
* Changed WAN public IPs for security purposes.
**************
>> OpenVPN Server Config file:
server 10.30.71.0 255.255.255.0
dev tun0
proto udp
port 1194
comp-lzo
keepalive 10 120
daemon
dh /etc/openvpn/dh.pem
ca /etc/openvpn/ca.crt
cert /etc/openvpn/Server.crt
key /etc/openvpn/Server.key
tls-auth /etc/openvpn/ta.key 0
verb 3
# mute 20
log openvpn.log
>> route -n
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 10.30.51.1 0.0.0.0 UG 0 0 0 enp0s25
10.30.51.0 0.0.0.0 255.255.255.0 U 0 0 0 enp0s25
10.30.53.4 10.30.71.1 255.255.255.255 UGH 0 0 0 tun0
10.30.71.0 10.30.71.2 255.255.255.0 UG 0 0 0 tun0
10.30.71.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
169.254.0.0 0.0.0.0 255.255.0.0 U 1002 0 0 enp0s25
169.254.0.0 0.0.0.0 255.255.0.0 U 1005 0 0 br0
2.2.2.2 1.1.1.1 255.255.255.255 UGH 0 0 0 br0
1.1.1.0 0.0.0.0 255.255.252.0 U 0 0 0 br0
>> iptables script
# OpenVPN Settings
$ipt -A FORWARD -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
$ipt -A FORWARD -s 10.30.71.0/24 -j ACCEPT
$ipt -t nat -A PREROUTING -d 10.30.71.0/24 -j DNAT --to 10.30.51.4
$ipt -A FORWARD -j REJECT
$ipt -A INPUT -i br0 -p udp --dport 1194 -j ACCEPT
>> ping response to Site B PBX WAN link
# ping 2.2.2.2
PING pbx2-public.dns.com (2.2.2.2) 56(84) bytes of data.
64 bytes from pbx2-public.dns.com (2.2.2.2): icmp_seq=1 ttl=60 time=38.8 ms
64 bytes from pbx2-public.dns.com (2.2.2.2): icmp_seq=2 ttl=60 time=26.0 ms
>> ping response to OpenVPN client
# ping 10.30.71.6
^C
--- 10.30.71.6 ping statistics ---
7 packets transmitted, 0 received, 100% packet loss, time 5999ms
>> tcpdump while doing ping to client (Same result running this command from PBX Site A or Site B during ping):
# tcpdump -i tun0
01:17:17.794321 IP pbx.SiteA.local > 10.30.71.6: ICMP echo request, id 1629, seq 1, length 64
01:17:17.817369 IP 10.30.71.6 > pbx.SiteA.local: ICMP echo reply, id 1629, seq 1, length 64
01:17:18.793774 IP pbx.SiteA.local > 10.30.71.6: ICMP echo request, id 1629, seq 2, length 64
01:17:18.816025 IP 10.30.71.6 > pbx.SiteA.local: ICMP echo reply, id 1629, seq 2, length 64
* Note: tcpdump does show the icmp request/reply, but the ping result times out. Not sure why.
**************
PBX (Site B) - Client:
LAN Interface: enp0s25
LAN IP: 10.30.51.4
LAN Gateway: 10.30.51.1
PBX WAN Interface: br0
PBX WAN IP: 2.2.2.2
PBX WAN Gateway: 2.2.2.1
* Changed WAN public IPs for security purposes.
**************
>> OpenVPN Server Config file
client
remote 1.1.1.2
proto udp
port 1194
dev tun0
verb 3
comp-lzo
keepalive 15 60
resolv-retry infinite
mute-replay-warnings
nobind
persist-key
persist-tun
float
remote-cert-tls server
ca /etc/openvpn/ca.crt
cert /etc/openvpn/Client.crt
key /etc/openvpn/Client.key
tls-auth /etc/openvpn/ta.key 1
log openvpn.log
>> route -n
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 10.30.53.1 0.0.0.0 UG 0 0 0 enp0s25
10.30.51.4 10.30.71.5 255.255.255.255 UGH 0 0 0 tun0
10.30.53.0 0.0.0.0 255.255.255.0 U 0 0 0 enp0s25
10.30.71.1 10.30.71.5 255.255.255.255 UGH 0 0 0 tun0
10.30.71.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
169.254.0.0 0.0.0.0 255.255.0.0 U 1002 0 0 enp0s25
169.254.0.0 0.0.0.0 255.255.0.0 U 1005 0 0 br0
2.2.2.0 0.0.0.0 255.255.254.0 U 0 0 0 br0
1.1.1.2 2.2.2.1 255.255.255.255 UGH 0 0 0 br0
>> iptables script
# OpenVPN Settings
$ipt -A FORWARD -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
$ipt -A FORWARD -s 10.30.71.0/24 -j ACCEPT
$ipt -t nat -A PREROUTING -d 10.30.71.0/24 -j DNAT --to 10.30.53.4
$ipt -A FORWARD -j REJECT
$ipt -A INPUT -i br0 -p udp --dport 1194 -j ACCEPT
>> ping response to Site B PBX WAN link
# ping 1.1.1.2
PING pbx1-public.dns.com (1.1.1.2) 56(84) bytes of data.
64 bytes from pbx1-public.dns.com (1.1.1.2): icmp_seq=1 ttl=60 time=38.8 ms
64 bytes from pbx1-public.dns.com (1.1.1.2): icmp_seq=2 ttl=60 time=26.0 ms
>> ping response to OpenVPN server
# ping 10.30.71.1
PING 10.30.71.1 (10.30.71.1) 56(84) bytes of data.
64 bytes from 10.30.71.1: icmp_seq=1 ttl=64 time=38.6 ms
64 bytes from 10.30.71.1: icmp_seq=2 ttl=64 time=22.6 ms
>> tcpdump while doing ping to server (Same result running this command from PBX Site A or Site B during ping):
# tcpdump -i tun0
01:39:57.596351 IP pbx.SiteB.local > 10.30.71.1: ICMP echo request, id 19049, seq 1, length 64
01:39:57.622631 IP 10.30.71.1 > pbx.SiteB.local: ICMP echo reply, id 19049, seq 1, length 64
01:39:58.597741 IP pbx.SiteB.local > 10.30.71.1: ICMP echo request, id 19049, seq 2, length 64
01:39:58.621315 IP 10.30.71.1 > pbx.SiteB.local: ICMP echo reply, id 19049, seq 2, length 64
What am I missing here to get ping working both ways? Once they're working, I want to use the 10.30.71.x OpenVPN IPs or the 10.30.51.4 <> 10.30.53.4 IPs, for the PBX to communicate with each other.
Thanks!
