Hi All,
I thought that I am an OpenVPN expert but I am now looking at my boxes for over six hours and I am unable to track down the problem, so any idea is appreciated:
Setup:
Application Server IP (192.0.26.50) -> VPN Server (192.0.26.52), connected via Layer 2 switch
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
# openssl dhparam -out dh1024.pem 1024
dh dh2048.pem
# This was the active line till yesterday
#server 10.49.0.0 255.255.255.0
# those two lines are the replacement as we wanted to have routed networks
server 172.16.0.0 255.255.255.0
route 10.49.0.0 255.255.240.0
push "route 192.0.26.0 255.255.255.0"
client-config-dir ccd
ccd-exclusive
keepalive 10 120
#comp-lzo
user nobody
group nobody
persist-key
persist-tun
status /var/run/openvpn-status.log
log /var/log/openvpn.log
verb 3
mute 5
management localhost 7777
There are ccds for all clients with a single line (with its own ip pair of course)
ifconfig-push 10.49.0.50 10.49.0.49
Problem:
The App-Server is not able to ping any client and vice-versa and I am unable to explain my obervations. I used "tcpdump -i any -n icmp" to catch traffic.
1) Ping from VPN Server to Client: Works, even with "ping -I 192.0.26.52"
2) Ping from Client to Server: I can see the ping and package reply on the Appserver but I am unable to see the reply on the VPN server.
3a) Ping from Server to Client: Nothing at all seen on VPN Server
3b) Ping from Server to non-existing Client IP in range: I can see TTL exceeded reply on the VPN Server!
4a) Tracepath from Server to Client: First Hop = Server, Second Hop = no reply
4b) tracepath with non-existing IP: Second Hop is the VPN Server
5) Ping from Server to VPN Base address works
ip_forward is set, iptables is empty, as said in 2 the routing from Client to Server seems to work and 3b/4b/5 indicates that routing is also fine. To me it looks like OpenVPN simply decides not to route the packages via the VPN.
The most ridiculous thing: It worked until yesterday - I had to rework the config and restartet but even with the old config it is not working any longer.
Any insight is welcome.
Oliver
PS: I know that the 192.0 are "public" IPs, for whatever reason the customer uses them inside the company but this shouldnt be part of the problem.
