[Solved]OpenVPN connects, but can't access servers on subnet

gutter007

I installed openvpn on a centos7 server:

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 10.10.10.76"
push "dhcp-option DNS 10.10.10.107"
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log         openvpn.log
log-append  openvpn.log
verb 5

I uncommented:
push "dhcp-option DNS 10.10.10.76"
push "dhcp-option DNS 10.10.10.107"

and changed the default values with our subnet's dns servers.

I also updated iptables to the following:

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  10.8.0.0/24          anywhere

On my client (mac), the client.ovpn is as follows:

client
dev tun
proto udp
remote gatekeeper 1194
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo
verb 3
ca client-keys/ca.crt
cert client-keys/client.crt
key client-keys/client.key

I can connect to the vpn, and here is the output (I changed my external ips to 555.555.555)

sudo openvpn --config client.ovpn
Tue Sep 29 16:22:30 2015 OpenVPN 2.3.6 x86_64-apple-darwin13.4.0 [SSL (OpenSSL)] [LZO] [MH] [IPv6] built on Dec  2 2014
Tue Sep 29 16:22:30 2015 library versions: OpenSSL 1.0.2a 19 Mar 2015, LZO 2.08
Tue Sep 29 16:22:30 2015 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Tue Sep 29 16:22:30 2015 Socket Buffers: R=[196724->65536] S=[9216->65536]
Tue Sep 29 16:22:30 2015 UDPv4 link local: [undef]
Tue Sep 29 16:22:30 2015 UDPv4 link remote: [AF_INET]555.555.555.72:1194
Tue Sep 29 16:22:30 2015 TLS: Initial packet from [AF_INET]555.555.555.72:1194, sid=bf1881ff 3dcdc7c7
Tue Sep 29 16:22:30 2015 VERIFY OK: depth=1, C=US, ST=VA, L=Falls Church, O=example, OU=Dev, CN=gateway.colo.example.com, name=gateway, emailAddress=mmerrell@example.com
Tue Sep 29 16:22:30 2015 VERIFY OK: depth=0, C=US, ST=VA, L=Falls Church, O=example, OU=Dev, CN=gateway.colo.example.com, name=gateway, emailAddress=mmerrell@example.com
Tue Sep 29 16:22:30 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Sep 29 16:22:30 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Sep 29 16:22:30 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Sep 29 16:22:30 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Sep 29 16:22:30 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Tue Sep 29 16:22:30 2015 [gateway.colo.example.com] Peer Connection Initiated with [AF_INET]555.555.555.72:1194
Tue Sep 29 16:22:33 2015 SENT CONTROL [gateway.colo.example.com]: 'PUSH_REQUEST' (status=1)
Tue Sep 29 16:22:33 2015 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 10.10.10.76,dhcp-option DNS 10.10.10.107,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Tue Sep 29 16:22:33 2015 OPTIONS IMPORT: timers and/or timeouts modified
Tue Sep 29 16:22:33 2015 OPTIONS IMPORT: --ifconfig/up options modified
Tue Sep 29 16:22:33 2015 OPTIONS IMPORT: route options modified
Tue Sep 29 16:22:33 2015 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Sep 29 16:22:33 2015 Opened utun device utun0
Tue Sep 29 16:22:33 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Sep 29 16:22:33 2015 /sbin/ifconfig utun0 delete
ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
Tue Sep 29 16:22:33 2015 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
Tue Sep 29 16:22:33 2015 /sbin/ifconfig utun0 10.8.0.6 10.8.0.5 mtu 1500 netmask 255.255.255.255 up
Tue Sep 29 16:22:33 2015 /sbin/route add -net 555.555.555.72 10.10.50.1 255.255.255.255
add net 555.555.555.72: gateway 10.10.50.1
Tue Sep 29 16:22:33 2015 /sbin/route add -net 0.0.0.0 10.8.0.5 128.0.0.0
add net 0.0.0.0: gateway 10.8.0.5
Tue Sep 29 16:22:33 2015 /sbin/route add -net 128.0.0.0 10.8.0.5 128.0.0.0
add net 128.0.0.0: gateway 10.8.0.5
Tue Sep 29 16:22:33 2015 /sbin/route add -net 10.8.0.1 10.8.0.5 255.255.255.255
add net 10.8.0.1: gateway 10.8.0.5
Tue Sep 29 16:22:33 2015 Initialization Sequence Completed

After I connect I can ping the openvpn server:
ping 10.8.0.1 and my client/self
ping 10.8.0.6

I cannot ping external servers, internal servers on the openvpn subnet, or resolve ips.
ping 10.10.10.25 (server on openvpn subnet)
ping yahoo.com (won't resolve)
ping 98.138.253.109 (yahoos ip)

Any help trouble shooting this would be really helpful. I'd like to be able connect and access the servers on the subnet, and I'd like to be able to also have external internet access.

thanks.
myles.

maikcat

did you enabled ip forwarding?

also what is the output of sestatus?

Michael.

gutter007

I did enable port forwarding.

I added:

net.ipv4.ip_forward = 1

to vi /etc/sysctl.conf

Selinux is enabled:

[root@gatekeeper ~]# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Max kernel policy version:      28

thanks.
myles.

maikcat

can you for testing switch selinux to permissive?

gutter007

I tried setting it to permissive mode, and disabling selinux.

In both modes, I can only connect to the vpn, not to anything beyond it.

thanks.
myles.

gutter007

I tried both permissive mode and disabled mode for selinux, and I still can't connect to to other servers in the subnet.

thanks.

maikcat

please post the output of ifconfig on your openvpn server

also can you ping your openvpn server lan ip?

Michael.

gutter007

Just to clarify, I'm on my office network and I want to connect to another network.

Office LAN - 10.0.50.0/24
Colo LAN - 10.1.1.0/24

The VPN server is on the colo network.

The VPN Network is setup as - 10.8.0.0/24

ifconfig on the vpn server is:

ens18: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.10.10.24  netmask 255.255.255.0  broadcast 10.10.10.255
        inet6 fe80::e8a9:34ff:feec:5ac2  prefixlen 64  scopeid 0x20<link>
        ether ea:a9:34:ec:5a:c2  txqueuelen 1000  (Ethernet)
        RX packets 49065  bytes 9489230 (9.0 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 27535  bytes 3104658 (2.9 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 0  (Local Loopback)
        RX packets 2  bytes 276 (276.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 2  bytes 276 (276.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 10.8.0.1  netmask 255.255.255.255  destination 10.8.0.2
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
        RX packets 10786  bytes 720012 (703.1 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 73  bytes 6132 (5.9 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

When connected to the VPN, I can ping the vpn server (10.8.0.1), but I cannot ping anything in the 10.0.10.0/subnet, or anything external like google.com.

thanks.
myles.

maikcat

you didnt answer this...

also can you ping your openvpn server lan ip?

so can you ping 10.10.10.24?

also post the exact rule used for NAT

Michael.

gutter007

Sorry about that. When Connected, I CAN ping 10.10.10.24, but I cannot ping anything else on the 10.10.10.x subnet.

Here are my forwarding rules.

[root@gatekeeper ~]# iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  10.8.0.0/24          anywhere

maikcat

if others do not respond there is something wrong with your NAT rule.

please flush the tables and post the exact command used for the NAT..

Michael.

gutter007

[root@gatekeeper ~]# iptables --flush
[root@gatekeeper ~]# iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
[root@gatekeeper ~]# iptables-save > /etc/sysconfig/iptables

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  10.8.0.0/24          anywhere

This is within a network with a firewall. I was wondering if the firewall could be stopping the traffic from being routed.

Here is the routing table on my openvpn server:

[root@gatekeeper ~]# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.10.10.1      0.0.0.0         UG    100    0        0 ens18
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.8.0.2        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
10.10.10.0      0.0.0.0         255.255.255.0   U     100    0        0 ens18

I was wondering why the destination server for 10.8.0.0 subnet is 10.8.0.2? I don't get a ping response from the 10.8.0.2 ip.

maikcat

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

you are natting traffic from interface eth0

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.10.10.1      0.0.0.0         UG    100    0        0 ens18
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.8.0.2        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
10.10.10.0      0.0.0.0         255.255.255.0   U     100    0        0 ens18

but your nic is called ens18....

please correct your rule to use ens18 interface instead of eth0

Michael.

gutter007

That was it.

I can't believe I missed that.

Thank You very much!

maikcat

You Welcome,

Marked as Solved

Closing topic

Regards,

Michael.