Hello all,
My friend and I have been working on our individual home labs for some time now and we decided we wanted to connect them using OpenVPN so we can do things like direct access to each others labs, domain trusts with AD and such. First I will go into a brief description on how our networks are laid out and I will also post configurations from both ends. After that I will describe the problems that we are having with as much information that I can think of.
We both have R710's and currently the endpoint for the OpenVPN server is on my end running on CentOS VM. This particular CentOS is also my transparent proxy. The connections on this machine are Eth0 - WAN, Eth1 - LAN, and Tun0 for the OpenVPN connection. My LAN Subnet is 192.168.2.0/24. On his end, he is using a AC66R Asus router as the OpenVPN client. His LAN is 192.168.1.0/24.
OVPN Server Config -------------
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.2.0 255.255.255.0"
client-config-dir ccd
route 192.168.1.0 255.255.255.0
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
log /var/log/openvpn.log
verb 3
OVPN Client Config -----------------
client
dev tun
proto udp
remote *.*.*.* 1194
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo
verb 3
The keys were added via the AC66R gui.
For testing the path is as follows, My PC -> CentOS OVPN Server -> AC66R OVPN Client -> LAN Client (Either webserver or windows server 2012).
My PC is 192.168.2.2 and I can ping his clients of 192.168.1.13 (Ubuntu Webserver), 192.168.1.185 (ADDS), 192.168.1.1 (GW). I can also web to 192.168.1.13 and see his Apache default web page. However, I cannot SSH to 192.168.1.13. I cannot telnet to any of the Active Directory ports such as 636, 389, or 53.
When I web to his webserver I see traffic with a tcpdump on both my CentOS interfaces of Eth1 and Tun0. When I try to SSH, or telnet over those ports, I ONLY see traffic on mt CentOS Eth1 interface. The traffic never appears on the tun0 interface. Traceroutes from my PC show the correct hops over the tunnel as seen below.
1 <1 ms <1 ms <1 ms 192.168.2.1
2 75 ms 71 ms 71 ms 10.8.0.6
3 72 ms 72 ms 71 ms 192.168.1.13
When I SSH to that same IP address I see this on my Eth1 Interface --------
03:40:58.287826 IP 192.168.2.2.41359 > 192.168.1.13.ssh: Flags [S], seq 5353433, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
03:41:01.287355 IP 192.168.2.2.41359 > 192.168.1.13.ssh: Flags [S], seq 5353433, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
03:41:07.286515 IP 192.168.2.2.41359 > 192.168.1.13.ssh: Flags [S], seq 5353433, win 8192, options [mss 1460,nop,nop,sackOK], length 0
I do not see ANY traffic across the tun0 interface for port 22. This is the same when I try to telnet to any of the AD ports I need access to as well.
I am running firewallD on my CentOS box and I have added tun0 to my Internal firewall and also allowed the ports. I just don't understand why the traffic does not even try to get across the tun0 interface. Below is the output for my internal firewalld setup. As you can see I have allowed services such as SSH and individual ports for ADDS and a few other things.
internal (active)
interfaces: eth1 tun0
sources:
services: dhcpv6-client http https ipp-client mdns samba-client ssh
ports: 53/udp 3126/tcp 3127/tcp 636/udp 389/tcp 53/tcp 389/udp 8822/tcp 3128/tcp 636/tcp
masquerade: no
forward-ports:
icmp-blocks:
rich rules:
IP Forwarding is also turned on.
/sbin/sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1
I cannot find anything in the AC66R that has to do with ip forwarding so I am assuming it is turned on. Again, I can ping across the tun from my LAN Client to His LAN Client. I can web from my LAN Client to his Webserver over the tun. Not sure what else to check.
If anyone has any ideas, please let me know.
