Making private subnet communicate via VPN

fm75

Hi all,

I am playing with OpenVPN. In order to do so I setup some VirtualBox machines on which I installed OpenVPN

This is my setup:

VPN Server S-> 192.168.10.1 (eth1)
               10.9.8.1 (tun0)

VPN Client C1 -> 192.168.10.2 (eth1)
                 10.9.8.4 (tun0)
                 172.20.10.1 (eth2)

VPN Client C2 -> 192.168.10.3 (eth1)
                 10.9.8.8 (tun0)
                 172.21.30.1 (eth2)


Host1 -> 172.20.10.2 (eth1)

Host2 -> 172.21.30.2 (eth1)

Basically I would like to make Host1 reach Host2

VPN Server conf:

port 1194
proto udp
dev tun
topology subnet

ca      ca.crt    # generated keys
cert    vpn-server.crt
key     vpn-server.key  # keep secret
dh      dh1024.pem

server 10.9.8.0 255.255.255.0  
ifconfig-pool-persist ipp.txt

client-config-dir ccd
route 172.20.10.0 255.255.255.0
push "route 172.20.10.0 255.255.255.0"
route 172.20.30.0 255.255.255.0
push "route 172.20.30.0 255.255.255.0"

keepalive 10 120

comp-lzo       
persist-key
persist-tun

status openvpn-status.log
log openvpn.log

verb 3 
client-to-client

I have also the two iroutes in /ccd

C1 : iroute 172.20.10.0 255.255.255.0

C2 : iroute 172.21.30.0 255.255.255.0

VPN Client conf:

client
dev tun
port 1194
proto udp

remote 192.168.10.1 1194  
nobind

ca ca.crt
cert c1.crt/c2.crt
key c1.key/c2.key

comp-lzo
persist-key
persist-tun

log openvpn.log
status openvpn-status.log

verb 3

I can ping 10.9.8.X from S, C1 or C2 - so the VPN is working

However pinging 172.20.10.2 from S, C1, C2 or H2 doesn't work.

Any hint?

Thanks.

maikcat

you must verify if your ccd files are parsed correctly,

to do this you can:

1)use ccd-exclusive in your server config, if you get an AUTH_FAILED then your ccds are ignored -or-

2)check your server log file if an OPTIONS IMPORT line appears...

also ip forwarding must be enabled in both server/clients

Michael.

Traffic

Also, see this HOWTO:
HOWTO: Expanding the scope of the VPN to include additional machines

fm75

Hi,

thank you very much for your answers... I did some additional tests and I think that it works. Let me recap and add some information (actual data), maybe it can be useful for other people in the future.

This is the status before starting OpenVPN daemons (eth0, 10.0.2.15 are network interfaces used by Vagrant/Virtualbox to enable host->guest NAT networking, so we can ignore them)

vpn-server
----------
eth0      Link encap:Ethernet  HWaddr 08:00:27:b0:5e:92  
          inet addr:10.0.2.15  Bcast:10.0.2.255  Mask:255.255.255.0

eth1      Link encap:Ethernet  HWaddr 08:00:27:5b:d6:8b  
          inet addr:192.168.10.1  Bcast:192.168.10.255  Mask:255.255.255.0

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.0.2.0        *               255.255.255.0   U     0      0        0 eth0
192.168.10.0    *               255.255.255.0   U     0      0        0 eth1



gateway1
--------
eth0      Link encap:Ethernet  HWaddr 08:00:27:b0:5e:92  
          inet addr:10.0.2.15  Bcast:10.0.2.255  Mask:255.255.255.0

eth1      Link encap:Ethernet  HWaddr 08:00:27:ee:d1:bf  
          inet addr:192.168.10.2  Bcast:192.168.10.255  Mask:255.255.255.0

eth2      Link encap:Ethernet  HWaddr 08:00:27:08:5a:bd  
          inet addr:172.20.10.1  Bcast:172.20.10.255  Mask:255.255.255.0

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.0.2.0        *               255.255.255.0   U     0      0        0 eth0
172.20.10.0     *               255.255.255.0   U     0      0        0 eth2
192.168.10.0    *               255.255.255.0   U     0      0        0 eth1


gateway2
--------
eth0      Link encap:Ethernet  HWaddr 08:00:27:b0:5e:92  
          inet addr:10.0.2.15  Bcast:10.0.2.255  Mask:255.255.255.0

eth1      Link encap:Ethernet  HWaddr 08:00:27:1e:0b:98  
          inet addr:192.168.10.3  Bcast:192.168.10.255  Mask:255.255.255.0

eth2      Link encap:Ethernet  HWaddr 08:00:27:4b:ab:65  
          inet addr:172.21.30.1  Bcast:172.21.30.255  Mask:255.255.255.0

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.0.2.0        *               255.255.255.0   U     0      0        0 eth0
172.21.30.0     *               255.255.255.0   U     0      0        0 eth2
192.168.10.0    *               255.255.255.0   U     0      0        0 eth1


host1
-----
eth0      Link encap:Ethernet  HWaddr 08:00:27:b0:5e:92  
          inet addr:10.0.2.15  Bcast:10.0.2.255  Mask:255.255.255.0

eth1      Link encap:Ethernet  HWaddr 08:00:27:4f:d5:d8  
          inet addr:172.20.10.2  Bcast:172.20.10.255  Mask:255.255.255.0

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         172.20.10.1     0.0.0.0         UG    0      0        0 eth1
10.0.2.0        *               255.255.255.0   U     0      0        0 eth0
172.20.10.0     *               255.255.255.0   U     0      0        0 eth1


host2
-----
eth0      Link encap:Ethernet  HWaddr 08:00:27:b0:5e:92  
          inet addr:10.0.2.15  Bcast:10.0.2.255  Mask:255.255.255.0          

eth1      Link encap:Ethernet  HWaddr 08:00:27:85:32:fe  
          inet addr:172.21.30.2  Bcast:172.21.30.255  Mask:255.255.255.0

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         172.21.30.1     0.0.0.0         UG    0      0        0 eth1
10.0.2.0        *               255.255.255.0   U     0      0        0 eth0
172.21.30.0     *               255.255.255.0   U     0      0        0 eth1

At this point pings works as expected

vpn-server <-> gateway1
vpn-server <-> gateway2
gateway1 <-> gateway2
gateway1 <-> host1
gateway2 <-> host2

After starting OpenVPN on vpn-server, gateway1, and gateway2 I have the following in the logs:

...
Thu Jul 23 15:03:33 2015 gateway1/192.168.10.2:33585 OPTIONS IMPORT: reading client specific options from: ccd/gateway1
Thu Jul 23 15:03:33 2015 gateway1/192.168.10.2:33585 MULTI_sva: pool returned IPv4=10.9.8.2, IPv6=10d2:77a2:707f:0:3d1b:cc9f:707f:0
Thu Jul 23 15:03:33 2015 gateway1/192.168.10.2:33585 MULTI: Learn: 10.9.8.2 -> gateway1/192.168.10.2:33585
Thu Jul 23 15:03:33 2015 gateway1/192.168.10.2:33585 MULTI: primary virtual IP for gateway1/192.168.10.2:33585: 10.9.8.2
Thu Jul 23 15:03:33 2015 gateway1/192.168.10.2:33585 MULTI: internal route 172.20.10.0/24 -> gateway1/192.168.10.2:33585
Thu Jul 23 15:03:33 2015 gateway1/192.168.10.2:33585 MULTI: Learn: 172.20.10.0/24 -> gateway1/192.168.10.2:33585
Thu Jul 23 15:03:33 2015 gateway1/192.168.10.2:33585 REMOVE PUSH ROUTE: 'route 172.20.10.0 255.255.255.0'
Thu Jul 23 15:03:36 2015 gateway1/192.168.10.2:33585 PUSH: Received control message: 'PUSH_REQUEST'
Thu Jul 23 15:03:36 2015 gateway1/192.168.10.2:33585 send_push_reply(): safe_cap=960
Thu Jul 23 15:03:36 2015 gateway1/192.168.10.2:33585 SENT CONTROL [gateway1]: 'PUSH_REPLY,route 172.21.30.0 255.255.255.0,route-gateway 10.9.8.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.9.8.2 255.255.255.0' (status=1)
...
Thu Jul 23 15:04:37 2015 gateway2/192.168.10.3:49497 OPTIONS IMPORT: reading client specific options from: ccd/gateway2
Thu Jul 23 15:04:37 2015 gateway2/192.168.10.3:49497 MULTI_sva: pool returned IPv4=10.9.8.3, IPv6=d0d6:79a2:707f:0:3d1b:cc9f:707f:0
Thu Jul 23 15:04:37 2015 gateway2/192.168.10.3:49497 MULTI: Learn: 10.9.8.3 -> gateway2/192.168.10.3:49497
Thu Jul 23 15:04:37 2015 gateway2/192.168.10.3:49497 MULTI: primary virtual IP for gateway2/192.168.10.3:49497: 10.9.8.3
Thu Jul 23 15:04:37 2015 gateway2/192.168.10.3:49497 MULTI: internal route 172.21.30.0/24 -> gateway2/192.168.10.3:49497
Thu Jul 23 15:04:37 2015 gateway2/192.168.10.3:49497 MULTI: Learn: 172.21.30.0/24 -> gateway2/192.168.10.3:49497
Thu Jul 23 15:04:37 2015 gateway2/192.168.10.3:49497 REMOVE PUSH ROUTE: 'route 172.21.30.0 255.255.255.0'
Thu Jul 23 15:04:40 2015 gateway2/192.168.10.3:49497 PUSH: Received control message: 'PUSH_REQUEST'
Thu Jul 23 15:04:40 2015 gateway2/192.168.10.3:49497 send_push_reply(): safe_cap=960
Thu Jul 23 15:04:40 2015 gateway2/192.168.10.3:49497 SENT CONTROL [gateway2]: 'PUSH_REPLY,route 172.20.10.0 255.255.255.0,route-gateway 10.9.8.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.9.8.3 255.255.255.0' (status=1)

Looking at the routing tables I notice that now I have:

vpn-server
----------
tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.9.8.1  P-t-P:10.9.8.1  Mask:255.255.255.0

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.0.2.0        *               255.255.255.0   U     0      0        0 eth0
10.9.8.0        *               255.255.255.0   U     0      0        0 tun0
192.168.10.0    *               255.255.255.0   U     0      0        0 eth1

IP Forward enabled. No firewall rules.


gateway1 
--------
tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.9.8.2  P-t-P:10.9.8.2  Mask:255.255.255.0

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.0.2.0        *               255.255.255.0   U     0      0        0 eth0
10.9.8.0        *               255.255.255.0   U     0      0        0 tun0
172.20.10.0     *               255.255.255.0   U     0      0        0 eth2
172.21.30.0     10.9.8.1        255.255.255.0   UG    0      0        0 tun0
192.168.10.0    *               255.255.255.0   U     0      0        0 eth1

IP Forward enabled. No firewall rules.


gateway2
--------
tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.9.8.3  P-t-P:10.9.8.3  Mask:255.255.255.0

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.0.2.0        *               255.255.255.0   U     0      0        0 eth0
10.9.8.0        *               255.255.255.0   U     0      0        0 tun0
172.20.10.0     10.9.8.1        255.255.255.0   UG    0      0        0 tun0
172.21.30.0     *               255.255.255.0   U     0      0        0 eth2
192.168.10.0    *               255.255.255.0   U     0      0        0 eth1

IP Forward enabled. No firewall rules.

Which seems correct. And in fact:

host1 (172.20.10.2) <-> host2 (172.31.30.2) works
gateway2 <-> host1  works
gateway1 <-> host2  works

Which was exactly what I wanted to achieve.

Actually there were some glitches at the beginning. So I will retest the setup to see if it's really OK.

Thank you very much for your help.