I have been trying to bring up an OpenVPN server for use for centralizing traffic from multiple clients into my local network so that they can use local resources. I have multiple Linux, Windows, iOS, and OSX clients that can all authenticate to the server and open the tunnel, but after that, none of them are able to reach the locally configured network. As far as I can tell, there are no obvious errors in the server.conf. In case someone asks, I am using a generated certificate along with a local login for each client.
server.conf
mode server
tls-server
dev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
#server 172.20.0.0 255.255.0.0
topology "subnet"
#ifconfig-pool-persist ipp.txt 3600
ifconfig 172.20.0.1 255.255.0.0
ifconfig-pool 172.20.1.0 172.20.1.255 255.255.0.0
route 172.20.0.0 255.255.0.0
route-gateway 172.20.0.1
push "redirect-gateway"
push "topology subnet"
push "route-gateway 172.20.0.1"
push "route 172.20.0.0 255.255.0.0"
push "route 172.20.0.1 255.255.255.255"
push "route [Home Network and Netmask]"
push "dhcp-option DNS [Omitted]"
push "dhcp-option DNS [Omitted]"
client-to-client
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
keepalive 1 5
persist-key
persist-tun
persist-local-ip
persist-remote-ip
push "persist-key"
push "persist-tun"
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 1
plugin /usr/lib/openvpn/openvpn-auth-pam.so login
client-config-dir [Omitted]/ccd
ccd-exclusive
script-security 2
Server startup log
Mon Sep 21 01:20:49 2015 OpenVPN 2.2.1 arm-linux-gnueabihf [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Dec 1 2014
Mon Sep 21 01:20:49 2015 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Mon Sep 21 01:20:49 2015 Control Channel Authentication: using '/etc/openvpn/easy-rsa/keys/ta.key' as a OpenVPN static key file
Mon Sep 21 01:20:49 2015 TUN/TAP device tun0 opened
Mon Sep 21 01:20:49 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Sep 21 01:20:49 2015 /sbin/ifconfig tun0 172.20.0.1 netmask 255.255.0.0 mtu 1500 broadcast 172.20.255.255
Mon Sep 21 01:20:49 2015 GID set to nogroup
Mon Sep 21 01:20:49 2015 UID set to nobody
Mon Sep 21 01:20:49 2015 UDPv4 link local (bound): [undef]
Mon Sep 21 01:20:49 2015 UDPv4 link remote: [undef]
Mon Sep 21 01:20:49 2015 Initialization Sequence Completed
Default .ovpn file (All clients built from this)
client
tls-client
dev tun
proto udp
remote [Omitted] 1194
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ns-cert-type server
auth-user-pass
key-direction 1
cipher AES-128-CBC
comp-lzo
verb 1
mute 20
script-security 2
pull
Output on a CentOS machine after running "sudo openvpn --config centosclient.ovpn" (Sanitized). Debian-based device had similar errors.
OpenVPN 2.3.8 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Aug 4 2015
library versions: OpenSSL 1.0.1e-fips 11 Feb 2013, LZO 2.03
Enter Auth Username:[Omitted]
Enter Auth Password:
Enter Private Key Password:
WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Control Channel Authentication: tls-auth using INLINE static key file
UDPv4 link local: [undef]
UDPv4 link remote: [AF_INET]{Server IP Address}:1194
[server] Peer Connection Initiated with [AF_INET]{Server IP Address}:1194
TUN/TAP device tun0 opened
do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
/sbin/ip link set dev tun0 up mtu 1500
/sbin/ip addr add dev tun0 172.16.0.200/16 broadcast 172.16.255.255
RTNETLINK answers: Network is unreachable
ERROR: Linux route add command failed: external program exited with error status: 2
RTNETLINK answers: Network is unreachable
ERROR: Linux route add command failed: external program exited with error status: 2
RTNETLINK answers: Network is unreachable
ERROR: Linux route add command failed: external program exited with error status: 2
RTNETLINK answers: Network is unreachable
ERROR: Linux route add command failed: external program exited with error status: 2
Initialization Sequence Completed
iOS shows no errors at all, but cannot ping the default gateway 172.20.0.1.
I cannot test a Windows machine due to OpenVPN GUI breaking when I install it, but that's another issue.
Apple device (using Tunnelblic) gives "VPN Appears to not be able to reach internet" message and disconnects automatically after a bit. No errors, but the ifconfig gave an interesting clue:
utun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1500
inet 172.20.0.102 --> 172.20.0.102 netmask 0xffff0000
Going back to the other Linux devices, it appears that all the interfaces are trying to connect in a P2P configuration, instead of as a subnet as defined in the config. Whether this is a bug or something in my config files, I don't know.
IPtables rules. IPv4 forwarding is enabled in sysctl as well.
-- [Internal Rules Omitted] --
#Allow all TUN
iptables -A INPUT -i tun+ -j ACCEPT
iptables -A OUTPUT -o tun+ -j ACCEPT
iptables -A FORWARD -o tun+ -j ACCEPT
#Accept connections on 1194
iptables -A INPUT -p udp --dport 1194 -j ACCEPT
#Apply forwarding
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 172.20.0.0/16 -j ACCEPT
iptables -A FORWARD -j REJECT
iptables -t nat -A POSTROUTING -s 172.20.0.0/16 -o eth0 -j MASQUERADE
# Defaults
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
To summarize, clients can connect to the server just fine, but cannot send or receive traffic due to lack of routes being generated. Also, all Linux clients drop the connection into P2P mode instead of subnet mode like they should. I don't have the time to play around with this anymore, so I'm leaving it up to you lot.
