ssh across vpn

dgermann

Friends--

Have set up a vpn in a production environment. I want to be able to ssh into the client from other clients on the server side (192.168.0.0/24), but cannot. Nor does ping work. Server can ping to other stations on server side.

The client is able to log in to the server and view and edit files there.

mariah = server, on a synology nas; local address 192.168.0.202
air = client

server.conf:

push "route 10.8.1.0 255.255.255.0"
route 192.168.1.0 255.255.255.0
route 10.8.1.0 255.255.255.0
client-config-dir /usr/syno/etc/packages/VPNCenter/openvpn/ccd

dev tun

management 127.0.0.1 1195
server 10.8.1.0 255.255.255.0

dh /usr/syno/etc/packages/VPNCenter/openvpn/dh2048.pem
ca /usr/syno/etc/packages/VPNCenter/openvpn/ca.crt
cert /usr/syno/etc/packages/VPNCenter/openvpn/server.crt
key /usr/syno/etc/packages/VPNCenter/openvpn/server.key

max-clients 3

comp-lzo

persist-tun
persist-key
verb 3
log-append /var/log/openvpn.log
keepalive 10 60
reneg-sec 0

status-version 2
proto udp6
port [blanked]

user nobody
group nobody

ccd/air2:

iroute 192.168.1.0      255.255.255.0
ifconfig-push 10.8.1.6 10.8.1.5

The router on the server side has these routes set up:
10.8.1.1 255.255.255.255 gw 192.168.0.202
10.8.1.0 255.255.255.0 gw 192.168.0.202

client.conf:

client
dev tun1
proto udp
remote [blanked]
resolv-retry infinite
nobind
persist-key
persist-tun
dh dh2048.pem
ca /etc/openvpn/synca.crt
cert /etc/openvpn/air2.crt
key /etc/openvpn/air2.key
remote-cert-tls server
comp-lzo
verb 3

Seems like there should be a simple fix to this, but I have not found it. I have checked this post https://community.openvpn.net/openvpn/wiki/RoutedLans#no1 and this https://openvpn.net/index.php/open-source/documentation/howto.html and at least one other thread here, but am not finding the answer to make this work.

What good advice do you have, please?

Thanks!

maikcat

some things to check,

is ip forwarding on BOTH sides enabled?
did you disabled any firewalls running on both sides?
also assign 10.8.1.10 ip to your client to verify that ccd file is parsed correctly

after that try to use ping to get an idea where the traffic stops,

f.e from your client can you ping:
servers vpn ip?
servers lan ip?
server side pc?

from a pc behind your client can you ping

client vpn ip?
server vpn ip?
server lan ip?
server side lan ip?

Michael.

dgermann

Michael--

Thank you for your help.

ip forwarding on both sides:
Currently both machines are behind the same router so I can have hands on them each. I am guessing that the normal routing of this router will handle the client's ipaddress of 192.168.0.211 (router's ip is 192.168.0.1). The other routes of 10.8.1.1 and 10.8.1.0 both to 192.168.0.202 (the server) look like they are what you need. Am I missing something to try here?

Firewalls:
On air/client: ufw status inactive
On mariah/server: was set to allow vpn server udp and access to the specified vpn port, as well as 10.8.1.1 to 10.8.1.254, and 192.168.0.1 to 192.168.0.254; however at your suggestion I have disabled the firewall entirely.

At this point I tried all the pings you suggested and all failed, 100% packet loss. Well, not quite. I thought server was 10.8.1.0 and that failed; when I tried 10.8.1.1 ping worked.

Then I renamed ccd/air2 to ccd/air, disabled and enabled openvpn server on server. Now 10.8.1.1 ping does not work. So I renamed ccd/air back to ccd/air2.

Not sure how to assign 10.8.1.10 to client. In the ccd/air2 file I commented out the ifconfig-push and added a new line to read ifconfig-push 10.8.1.10 10.8.1.9

After doing this I tried the pinging again and all show 100% packet loss. Also, the vpn connection on the client side hung trying to resolve the address of the server ("host not found"). So I put the ccd/air2 file back the way it was, disabled and then enabled openvpn on the server, and the client is still giving me "host not found." (I can ping the host address from another computer, so that is working.) There is no tun1 connection on ifconfig on client.

Rebooted client (it hung for 5 minutes or so and had to do ctrl-alt-del to get it going). Still no tun1.

From client I can ping some but not all hosts on the lan. From server I can ping several other hosts on the lan, but not the client. Maybe I have some other setting wrong in client?

I'm frustrated. Must be doing something wrong, but after I put things back the way they were, why no connection at all? I am activating the firewall again on server for now.

Thanks, Michael. Hope this all is giving *you* some clues!

BTW, does notify when a reply is posted work? I am not getting notified.

dgermann

Michael--

Here might be a clue.

On client I am running another vpn, and that has been working. I disabled that, and then started this one, and it connected right off. All pinging works except 10.8.0.1.

The server.conf on the tun0 (the other connection) has these entries:

server 10.8.0.0 255.255.255.0
push "route 192.168.0.0 255.255.255.0"
route 192.168.1.0   255.255.255.0
push “route 10.8.0.0 255.255.255.0”
push “route 192.168.1.0 255.255.255.0”

Its ccd/air is:

iroute 192.168.1.0      255.255.255.0
ifconfig-push 10.8.0.42 10.8.0.41

Now the server.conf on tun1 (the one we have been working on) has these entries:

route 192.168.1.0 255.255.255.0
route 10.8.1.0 255.255.255.0
server 10.8.1.0 255.255.255.0

Its ccd/air2 is:

iroute 192.168.1.0      255.255.255.0
ifconfig-push 10.8.1.6 10.8.1.5

I am thinking there is a conflict with both of them naming 192.168.1.0.

But I am not sure what to change where. If this is a clue.

Thanks, Michael!