Hi Everyone,
I've been having a real hard time getting this configuration to work. The certificate section and everything checks out fine, as I am able to connect to the OpenVPN server both internally (LAN) and externally (from the net.) However, I am unable to ping any machines on the LAN nor am I able to ping the OpenVPN gateway's (TAP adapter) IP. I also cannot reach the internet from the VPN.
In other words, my VPN is essentially useless.
Here is my configuration:
LAN: 192.168.4.0/22
VPN Host Server: 192.168.4.11 (br0)
VPN subnet: 10.90.10.0/24
ifconfig from host machine (192.168.4.11):
br0 Link encap:Ethernet HWaddr 00:10:18:18:01:42
inet addr:192.168.4.11 Bcast:192.168.7.255 Mask:255.255.252.0
inet6 addr: fe80::210:18ff:fe18:142/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:26616 errors:0 dropped:0 overruns:0 frame:0
TX packets:18221 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:2525154 (2.4 MiB) TX bytes:3319584 (3.1 MiB)
eth0 Link encap:Ethernet HWaddr 00:10:18:18:01:42
inet6 addr: fe80::210:18ff:fe18:142/64 Scope:Link
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:104957 errors:0 dropped:0 overruns:0 frame:0
TX packets:19156 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:76182783 (72.6 MiB) TX bytes:3511889 (3.3 MiB)
Interrupt:16
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:1081 errors:0 dropped:0 overruns:0 frame:0
TX packets:1081 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:255395 (249.4 KiB) TX bytes:255395 (249.4 KiB)
tap0 Link encap:Ethernet HWaddr 52:54:EE:08:94:B3
inet addr:10.90.10.1 Bcast:10.90.10.255 Mask:255.255.255.0
inet6 addr: fe80::5054:eeff:fe08:94b3/64 Scope:Link
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:839 errors:0 dropped:0 overruns:0 frame:0
TX packets:24920 errors:0 dropped:5 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:79922 (78.0 KiB) TX bytes:2716839 (2.5 MiB)
Routing table from VPN host (192.168.4.11):
10.90.10.0/24 dev tap0 proto kernel scope link src 10.90.10.1
192.168.4.0/22 dev br0 proto kernel scope link src 192.168.4.11
default via 192.168.4.1 dev br0
iptables rules on host machine (192.168.4.11):
Chain INPUT (policy ACCEPT 268 packets, 18981 bytes)
pkts bytes target prot opt in out source destination
11428 1160K ACCEPT udp -- any any anywhere anywhere
0 0 ACCEPT all -- tap+ any anywhere anywhere
0 0 ACCEPT all -- tun+ any anywhere anywhere
Chain FORWARD (policy ACCEPT 47 packets, 13961 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- tap+ any anywhere anywhere
0 0 ACCEPT all -- tun+ any anywhere anywhere
0 0 ACCEPT all -- tap+ br0 anywhere anywhere state RELATED,ESTABLISHED
0 0 ACCEPT all -- br0 tap+ anywhere anywhere state RELATED,ESTABLISHED
0 0 ACCEPT all -- br0 tap0 anywhere anywhere state RELATED,ESTABLISHED
0 0 ACCEPT all -- tap0 br0 anywhere anywhere
Chain PREROUTING (policy ACCEPT 11454 packets, 1451K bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 13 packets, 5371 bytes)
pkts bytes target prot opt in out source destination
115 8740 SNAT all -- any br0 anywhere anywhere to:192.168.4.11
Chain OUTPUT (policy ACCEPT 116 packets, 8856 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- any tap+ 10.90.10.0/24 anywhere
My /etc/openvpn/server.conf:
;local 192.168.4.11
port 11944
proto udp
dev tap0
topology subnet
crl-verify crl.pem
ca forza_ca.crt
cert forza_server.crt
key forza_server.key # This file should be kept secret
dh forza_dh1024.pem
ifconfig-pool-persist forza_ipp.txt
server-bridge 10.90.10.1 255.255.255.0 10.90.10.5 10.90.10.50
#push "route 10.90.10.0 255.255.255.0"
push "route 192.168.4.0 255.255.252.0"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 192.168.4.3"
push "dhcp-option DOMAIN forza"
client-to-client
keepalive 10 120
comp-lzo
;user nobody
;group nobody
persist-key
persist-tun
tun-mtu 1500
tun-mtu-extra 32
fragment 0
mssfix 1450
reneg-sec 0
status openvpn-status.log
push "redirect-gateway def1"
verb 4
#mute 20
log-append openvpn.log
There is a static route in the pf-sense firewall for 10.90.10.0/24 to 192.168.4.11
As I stated before, I cannot ping the OpenVPN gateway (10.90.10.1), but oddly enough, I can ping (10.90.10.0). Of course, from the client side, I am able to ping 10.90.10.5 (my IP assigned by the VPN server.)
I did try one other thing with the routing table that did give me access to the LAN from the VPN, but not to the internet. I added a route on the host machine for the VPN subnet (10.90.10.0/24) via 192.168.4.11 which gave my client access to all of the LAN, but not the internet (which is what we need.)
I know I am just missing some small piece of the config in either iptables or ip route (or both) and I have been racking my brain for four days. If anyone has any insight, it would be greatly appreciated.
