I have 2 remote offices connecting to a main office. The remote offices are running the client on the router. The main office is running the OVPN server on a separate box from the router. I am trying to pass traffic between the 3 sub nets. Currently I am able to successfully connect the clients to the server and can access the server lan from the clients lan and I can connect from remote office A to remote office B but not from remote office B to remote office A or from server lan to A.
The problem appears to be that the route is not being added to the OVPN routing table. Office B's subnet is added and both OVPN subnets are added but Office A's subnet is not added according to the status log.
OpenVPN CLIENT LIST
Updated,Thu Feb 25 17:18:32 2016
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
shane-home,xx.xx.xx.212:32872,237595,1839754,Thu Feb 25 17:14:05 2016
shane-cabin,xx.xx.xx.119:50478,1840149,202312,Thu Feb 25 17:14:08 2016
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
192.168.6.0/24,shane-cabin,68.190.128.119:50478,Thu Feb 25 17:14:09 2016
10.8.0.2,shane-home,xx.xx.xx.212:32872,Thu Feb 25 17:18:27 2016
192.168.6.1C,shane-cabin,xx.xx.xx.119:50478,Thu Feb 25 17:18:27 2016
10.8.0.6,shane-cabin,xx.xx.xx.119:50478,Thu Feb 25 17:14:09 2016
GLOBAL STATS
Max bcast/mcast queue length,1
END
Following are the configs:
Server Config:
port 1194
proto udp
dev tun
topology subnet
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ccd
route 192.168.6.0 255.255.255.0
route 192.168.0.0 255.255.255.0
route 192.168.1.0 255.255.255.0
client-to-client
keepalive 10 120
tls-auth ta.key 0
cipher BF-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log /var/log openvpn.log
verb 5
mute 20
Client Config:
client
dev tun11
proto udp
remote xx.xx.xx.114 1194
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo adaptive
cipher BF-CBC
script-security 2
route-delay 2
route-up vpnrouting.sh
route-pre-down vpnrouting.sh
verb 3
tls-auth static.key 1
ca ca.crt
cert client.crt
key client.key
status-version 2
status status 10
remote-cert-tls server
mute-replay-warnings
mute 20
pull
topology subnet
route 192.168.1.0 255.255.255.0
route 192.168.6.0 255.255.255.0
CCD
iroute 192.168.0.0 255.255.255.0
ifconfig-push 10.8.0.2 255.255.255.0
push "route 192.168.1.0 255.255.255.0"
push "route 192.168.6.0 255.255.255.0"
Routing table for OVPN Server
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0
10.8.0.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0
192.168.1.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
192.168.6.0 10.8.0.6 255.255.255.0 UG 0 0 0 tun0
This is how it appears after I add routes for the two remote subnets, I was under the impression that those routes would be added to the kernel routing table by OVPN???
The log file for the server is empty.
Client Log:
eb 25 17:33:11 rc_service: httpd 444:notify_rc start_vpnclient1
Feb 25 17:33:13 openvpn[2109]: OpenVPN 2.3.8 arm-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Dec 24 2015
Feb 25 17:33:13 openvpn[2109]: library versions: OpenSSL 1.0.2e 3 Dec 2015, LZO 2.08
Feb 25 17:33:13 openvpn[2110]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Feb 25 17:33:13 openvpn[2110]: Control Channel Authentication: using 'static.key' as a OpenVPN static key file
Feb 25 17:33:13 openvpn[2110]: Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Feb 25 17:33:13 openvpn[2110]: Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Feb 25 17:33:13 openvpn[2110]: Socket Buffers: R=[122880->131072] S=[122880->131072]
Feb 25 17:33:13 openvpn[2110]: UDPv4 link local: [undef]
Feb 25 17:33:13 openvpn[2110]: UDPv4 link remote: [AF_INET]xx.xx.xx.114:1194
Feb 25 17:33:13 openvpn[2110]: TLS: Initial packet from [AF_INET]xx.xx.xx.114:1194, sid=81a72e78 88150f32
Feb 25 17:33:13 openvpn[2110]: VERIFY OK: depth=1, C=US, ST=MN, L=Minneapolis, O=., OU=., CN=ovpn.securisinsurance.com, name=server, emailAddress=vpn@securisinsurance.com
Feb 25 17:33:13 openvpn[2110]: Validating certificate key usage
Feb 25 17:33:13 openvpn[2110]: ++ Certificate has key usage 00a0, expects 00a0
Feb 25 17:33:13 openvpn[2110]: VERIFY KU OK
Feb 25 17:33:13 openvpn[2110]: Validating certificate extended key usage
Feb 25 17:33:13 openvpn[2110]: ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Feb 25 17:33:13 openvpn[2110]: VERIFY EKU OK
Feb 25 17:33:13 openvpn[2110]: VERIFY OK: depth=0, C=US, ST=MN, L=Minneapolis, O=., OU=., CN=ovpn.securisinsurance.com, name=server, emailAddress=vpn@securisinsurance.com
Feb 25 17:33:14 openvpn[2110]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Feb 25 17:33:14 openvpn[2110]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Feb 25 17:33:14 openvpn[2110]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Feb 25 17:33:14 openvpn[2110]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Feb 25 17:33:14 openvpn[2110]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Feb 25 17:33:14 openvpn[2110]: [ovpn.securisinsurance.com] Peer Connection Initiated with [AF_INET]xx.xx.xx.114:1194
Feb 25 17:33:16 openvpn[2110]: SENT CONTROL [ovpn.securisinsurance.com]: 'PUSH_REQUEST' (status=1)
Feb 25 17:33:16 openvpn[2110]: PUSH: Received control message: 'PUSH_REPLY,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0'
Feb 25 17:33:16 openvpn[2110]: OPTIONS IMPORT: timers and/or timeouts modified
Feb 25 17:33:16 openvpn[2110]: OPTIONS IMPORT: --ifconfig/up options modified
Feb 25 17:33:16 openvpn[2110]: OPTIONS IMPORT: route-related options modified
Feb 25 17:33:16 openvpn[2110]: TUN/TAP device tun11 opened
Feb 25 17:33:16 openvpn[2110]: TUN/TAP TX queue length set to 100
Feb 25 17:33:16 openvpn[2110]: do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Feb 25 17:33:16 openvpn[2110]: /usr/sbin/ip link set dev tun11 up mtu 1500
Feb 25 17:33:16 openvpn[2110]: /usr/sbin/ip addr add dev tun11 10.8.0.2/24 broadcast 10.8.0.255
Feb 25 17:33:18 openvpn[2110]: /usr/sbin/ip route add 192.168.1.0/24 via 10.8.0.1
Feb 25 17:33:18 openvpn[2110]: /usr/sbin/ip route add 192.168.6.0/24 via 10.8.0.1
Feb 25 17:33:19 openvpn-routing: Skipping, client 1 not in routing policy mode
Feb 25 17:33:19 openvpn[2110]: Initialization Sequence Completed
I am assuming the main issue is the lack of a route in OVPN routing table but cannot figure out why it is not being added.
Any help would be greatly appreciated.
On a side note I am confused by the entry for 192.168.6.1C in the routing table shown in the status log. What is that about?
