Trouble routing over tap properly

wmassingham

I'm trying to set up a VPN into my pfSense firewall, using a DHCP server on the remote network. The VPN connects, I get a DHCP lease of 158.65.110.49, but there's something wrong with routing that means when the VPN is connected, I can't reach any hosts through the VPN. And since the client is adding a default route, I can't reach other hosts when it's connected either.

I'm having a bit of trouble understanding how exactly routing works here anyway. I'm trying to VPN all traffic to at least 158.65.110.0/24, but all of 158.65.0.0/16 would be preferable. The gateway is 158.65.110.2, so it should be routable. There are other hosts, like DNS servers provided by DHCP, on other networks (158.65.12.x), but I don't really care about reaching them.

As you can see in the route table, there definitely is a route for 158.65.110.0/24, but it's still not working properly.

I hope this is enough information. If not, I'd be happy to provide more.

Server config:

dev ovpns1
verb 1
dev-type tap
dev-node /dev/tap1
writepid /var/run/openvpn_server1.pid
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp
cipher AES-256-CBC
auth RSA-SHA1
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
client-connect /usr/local/sbin/openvpn.attributes.sh
client-disconnect /usr/local/sbin/openvpn.attributes.sh
local 158.65.110.20
engine cryptodev
tls-server
mode server
username-as-common-name
auth-user-pass-verify "/usr/local/sbin/ovpn_auth_verify user 'Local Database' false server1" via-env
tls-verify "/usr/local/sbin/ovpn_auth_verify tls 'KSC+CS+VPN' 1 "
lport 1194
management /var/etc/openvpn/server1.sock unix
push "route 158.65.0.0 255.255.0.0"
client-to-client
ca /var/etc/openvpn/server1.ca 
cert /var/etc/openvpn/server1.cert 
key /var/etc/openvpn/server1.key 
dh /etc/dh-parameters.2048
tls-auth /var/etc/openvpn/server1.tls-auth 0
comp-lzo adaptive

Client config:

dev tap
persist-tun
persist-key
cipher AES-256-CBC
auth RSA-SHA1
tls-client
client
resolv-retry infinite
remote 158.65.110.20 1194 udp
lport 0
verify-x509-name "KSC CS VPN" name
auth-user-pass
pkcs12 firewall-udp-1194-wmassingham.p12
tls-auth firewall-udp-1194-wmassingham-tls.key 1
ns-cert-type server
comp-lzo adaptive

Client log:

Tue Jan 12 13:46:32 2016 OpenVPN 2.3.8 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Aug  4 2015
Tue Jan 12 13:46:32 2016 library versions: OpenSSL 1.0.1p 9 Jul 2015, LZO 2.08
Enter Management Password:
Tue Jan 12 13:46:38 2016 Control Channel Authentication: using 'firewall-udp-1194-wmassingham-tls.key' as a OpenVPN static key file
Tue Jan 12 13:46:38 2016 UDPv4 link local (bound): [undef]
Tue Jan 12 13:46:38 2016 UDPv4 link remote: [AF_INET]158.65.110.20:1194
Tue Jan 12 13:46:38 2016 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Jan 12 13:46:40 2016 [KSC CS VPN] Peer Connection Initiated with [AF_INET]158.65.110.20:1194
Tue Jan 12 13:46:43 2016 OpenVPN ROUTE: OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options
Tue Jan 12 13:46:43 2016 OpenVPN ROUTE: failed to parse/resolve route for host/network: 158.65.0.0
Tue Jan 12 13:46:43 2016 open_tun, tt->ipv6=0
Tue Jan 12 13:46:43 2016 TAP-WIN32 device [KSC CS VPN] opened: \\.\Global\{C757E93B-F2D4-4215-AC91-B01B1AAD9C0C}.tap
Tue Jan 12 13:46:43 2016 Successful ARP Flush on interface [14] {C757E93B-F2D4-4215-AC91-B01B1AAD9C0C}
Tue Jan 12 13:46:48 2016 Initialization Sequence Completed

Client interface info:

Ethernet adapter KSC CS VPN:

   Connection-specific DNS Suffix  . : student.keene.edu
   Description . . . . . . . . . . . : TAP-Windows Adapter V9
   Physical Address. . . . . . . . . : 00-FF-C7-57-E9-3B
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 158.65.110.149(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Tuesday, 12 January, 2016 12:13:50
   Lease Expires . . . . . . . . . . : Tuesday, 19 January, 2016 13:46:48
   Default Gateway . . . . . . . . . : 158.65.110.2
   DNS Servers . . . . . . . . . . . : 158.65.12.103
                                       158.65.12.123
   Primary WINS Server . . . . . . . : 158.65.100.14
   Secondary WINS Server . . . . . . : 158.65.100.15
   NetBIOS over Tcpip. . . . . . . . : Enabled

Client route table:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1    192.168.1.100     25
          0.0.0.0          0.0.0.0     158.65.110.2   158.65.110.149     20
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
     158.65.110.0    255.255.255.0         On-link    158.65.110.149    276
   158.65.110.149  255.255.255.255         On-link    158.65.110.149    276
   158.65.110.255  255.255.255.255         On-link    158.65.110.149    276
      192.168.1.0    255.255.255.0         On-link     192.168.1.100    281
    192.168.1.100  255.255.255.255         On-link     192.168.1.100    281
    192.168.1.255  255.255.255.255         On-link     192.168.1.100    281
     192.168.56.0    255.255.255.0         On-link      192.168.56.1    266
     192.168.56.1  255.255.255.255         On-link      192.168.56.1    266
   192.168.56.255  255.255.255.255         On-link      192.168.56.1    266
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link      192.168.56.1    266
        224.0.0.0        240.0.0.0         On-link     192.168.1.100    281
        224.0.0.0        240.0.0.0         On-link    158.65.110.149    276
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link      192.168.56.1    266
  255.255.255.255  255.255.255.255         On-link     192.168.1.100    281
  255.255.255.255  255.255.255.255         On-link    158.65.110.149    276

Traffic

wmassingham wroteTue Jan 12 13:46:43 2016 OpenVPN ROUTE: OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options
Tue Jan 12 13:46:43 2016 OpenVPN ROUTE: failed to parse/resolve route for host/network: 158.65.0.0

Your server config is not complete .. See --server and --topology in The Manual v23x

wmassingham

Hmm... the manual says "Don't use --server if you are ethernet bridging. Use --server-bridge instead." So I added "server-bridge" and "topology subnet" to my server config. But according to the manual, "server-bridge" without parameters just expands to

mode server
tls-server
route-gateway dhcp

which, except for the route-gateway directive, is already in my config. Either way, adding those just resulted in a DHCP lease with no gateway information.

I tried adding just "topology subnet", and for a second, everything seemed to be working perfectly, traceroutes and everything! But then it stopped, and everything over the VPN was unreachable again, and I had to disconnect it.

Nothing showed up in the client log, but here's the server log. Anything in here jump out at you?

Jan 12 15:10:51	openvpn[23757]: OpenVPN 2.3.8 amd64-portbld-freebsd10.1 [SSL (OpenSSL)] [LZO] [MH] [IPv6] built on Aug 21 2015
Jan 12 15:10:51	openvpn[23757]: library versions: OpenSSL 1.0.1l-freebsd 15 Jan 2015, LZO 2.09
Jan 12 15:10:51	openvpn[24053]: /usr/local/sbin/ovpn-linkup ovpns1 1500 1590 init
Jan 12 15:10:51	openvpn[24053]: Control Channel Authentication: using '/var/etc/openvpn/server1.tls-auth' as a OpenVPN static key file
Jan 12 15:10:51	openvpn[24053]: Initialization Sequence Completed
Jan 12 15:10:51	openvpn[24053]: Initializing OpenSSL support for engine 'cryptodev'
Jan 12 15:10:51	openvpn[24053]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Jan 12 15:10:51	openvpn[24053]: TUN/TAP device /dev/tap1 opened
Jan 12 15:10:51	openvpn[24053]: TUN/TAP device ovpns1 exists previously, keep at program end
Jan 12 15:10:51	openvpn[24053]: UDPv4 link local (bound): [AF_INET]158.65.110.20:1194
Jan 12 15:10:51	openvpn[24053]: UDPv4 link remote: [undef]
Jan 12 15:11:20	openvpn: user 'wmassingham' authenticated
Jan 12 15:11:20	openvpn[24053]: 74.69.213.160:65144 [wmassingham] Peer Connection Initiated with [AF_INET]74.69.213.160:65144
Jan 12 15:11:20	openvpn[24053]: wmassingham/74.69.213.160:65144 MULTI: no dynamic or static remote --ifconfig address is available for wmassingham/74.69.213.160:65144
Jan 12 15:11:22	openvpn[24053]: wmassingham/74.69.213.160:65144 send_push_reply(): safe_cap=940

Traffic

Please post details of how you create your bridge.

wmassingham

I'm using pfSense as a transparent firewall, so the bridge is between the WAN, LAN, and tap interfaces. Creation is handled automatically by pfSense, so I'm not sure exactly what it does to create the bridge, but here's the output of ifconfig. vmx0 is the WAN interface, vmx1 is the LAN interface, bridge0 is the bridge, and ovpns1 is the OpenVPN tap interface. Hopefully this is informative.

vmx0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
	options=60009b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
	ether 00:0c:29:86:a2:31
	inet6 fe80::20c:29ff:fe86:a231%vmx0 prefixlen 64 scopeid 0x1 
	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
	media: Ethernet autoselect
	status: active
vmx1: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
	options=600099<RXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
	ether 00:0c:29:86:a2:3b
	inet6 fe80::20c:29ff:fe86:a23b%vmx1 prefixlen 64 scopeid 0x2 
	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
	media: Ethernet autoselect
	status: active
pflog0: flags=100<PROMISC> metric 0 mtu 33144
pfsync0: flags=0<> metric 0 mtu 1500
	syncpeer: 224.0.0.240 maxupd: 128 defer: on
	syncok: 1
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
	options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
	inet 127.0.0.1 netmask 0xff000000 
	inet6 ::1 prefixlen 128 
	inet6 fe80::1%lo0 prefixlen 64 scopeid 0x5 
	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
enc0: flags=0<> metric 0 mtu 1536
	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
bridge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
	ether 02:cb:53:65:ea:00
	inet 158.65.110.20 netmask 0xffff0000 broadcast 158.65.255.255 
	nd6 options=1<PERFORMNUD>
	id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
	maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200
	root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
	member: ovpns1 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
	        ifmaxaddr 0 port 8 priority 128 path cost 2000000
	member: vmx1 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
	        ifmaxaddr 0 port 2 priority 128 path cost 2000
	member: vmx0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
	        ifmaxaddr 0 port 1 priority 128 path cost 2000
ovpns1: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
	options=80000<LINKSTATE>
	ether 00:bd:f1:01:00:01
	inet6 fe80::2bd:f1ff:fe01:1%ovpns1 prefixlen 64 scopeid 0x8 
	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
	media: Ethernet autoselect
	status: active
	Opened by PID 24053

Traffic

wmassingham wroteI'm using pfSense as a transparent firewall, so the bridge is between the WAN, LAN, and tap interfaces

A bridge between WAN and LAN and TAP sounds like a bad idea .. You need to read the pfsense documentation .. we cannot provide support for their product.