Routing issue between 2 openvpn networks

juju

Hello,

I have a current setup of 2 star networks with each one having an openvpn server and some children
openvpn server is set with ansible and https://github.com/Stouts/Stouts.openvpn
there is a client-to-client option, so each children can communicate between each other for one star network

server1 has 10.1.0.0/24 network and is 10.1.0.1
server2 has 10.2.0.0/24 and is 10.2.0.2
I added a route push inside clients from server like 'push "route 10.1.0.0 255.255.255.0"'
platform is ubuntu trusty w openvpn 2.3.2 (default repository)

I'm trying to link the two and second server is set as children of first openvpn server.
Pinging each other with IP address space of server1 is OK
Pinging with IP address space of server2 NOK. route missing in server1

server1# route add -net 10.2.0.0/24 gw 10.1.0.14 
SIOCADDRT: Network is unreachable
server1# route add -net 10.2.0.0/24 dev tun0
server1# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         x.y.z.1    0.0.0.0         UG    0      0        0 eth0
10.1.0.0        10.1.0.2        255.255.255.0   UG    0      0        0 tun0
10.1.0.2        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
10.2.0.0       0.0.0.0         255.255.255.0   U     0      0        0 tun0
x.y.z.1    0.0.0.0         255.255.255.255 UH    0      0        0 eth0
server1# ping 10.2.0.1
PING 10.2.0.1 (10.2.0.1) 56(84) bytes of data.
^C
--- 10.2.0.1 ping statistics ---
14 packets transmitted, 0 received, 100% packet loss, time 13096ms
server2# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         n.m.l.1   0.0.0.0         UG    0      0        0 eth0
10.1.0.0        10.1.0.13       255.255.255.0   UG    0      0        0 tun1
10.1.0.13       0.0.0.0         255.255.255.255 UH    0      0        0 tun1
10.2.0.0       10.2.0.2       255.255.255.0   UG    0      0        0 tun0
10.2.0.2       0.0.0.0         255.255.255.255 UH    0      0        0 tun0
n.m.l.0   0.0.0.0         255.255.255.0   U     0      0        0 eth0
server2# tcpdump -nl -i tun1 icmp
[see nothing...]

If I try to specify server2 IP inside vpn1

server1# ip route add 10.2.0.0/24 via 10.1.0.14
RTNETLINK answers: Network is unreachable
server1# ping 10.1.0.14
PING 10.1.0.14 (10.1.0.14) 56(84) bytes of data.
64 bytes from 10.1.0.14: icmp_seq=1 ttl=64 time=9.80 ms
server1# ip route add 10.2.0.0/24 via 10.1.0.2
server1# ping 10.2.0.1
PING 10.2.0.1 (10.2.0.1) 56(84) bytes of data.
^C
--- 10.2.0.1 ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 2999ms

or from a client of server2

client$ ping 10.1.0.1
server2# tcpdump -nl -i tun1 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun1, link-type RAW (Raw IP), capture size 65535 bytes
23:46:33.080529 IP 10.2.0.6 > 10.1.0.1: ICMP echo request, id 5923, seq 1, length 64
23:46:34.087810 IP 10.2.0.6 > 10.1.0.1: ICMP echo request, id 5923, seq 2, length 64
[see this traffic on both tun* interface of server2]
server1# tcpdump -nl -i tun0 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 65535 bytes
[get nothing]

Any hints to get those route working ?

Thanks

Traffic

Are your eth0 IPs public IP addresses ?

juju

yes, eth0 is public IP/internet facing
no other interface outside of tun* (and loopback of course)

most of those systems are cloud-based

Traffic

You cannot route RFC1918 networks over the public internet .. :geek:

juju

I'm not...
I want to route those 10.[12].0.0/24 through the tun* interface.
eth0 is the default/internet route but should obviously not be used for RFC1918 traffic.

Problem is even if I say route through tun0 on server1, it does not seem to get the traffic from a client to server2 even if I saw it leaving server2 on both tun interface (the one with client and the one with server1)

juju

any ideas?

Thanks

Traffic

Please see the Forum rules (top of page)

juju

Goal: connect 2 networks made each with an openvpn server over public internet. each branch should be able to contact other server's branch unless firewall rules or other control (none at this point).

server1: /etc/openvpn/server.conf for network1

port 1194
proto udp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key  # This file should be kept secret
dh /etc/openvpn/keys/dh2048.pem
server 10.1.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
log-append  /var/log/openvpn/openvpn.log
verb 3
max-clients 100
user nobody
group nogroup
client-to-client
route 192.168.1.0 255.255.255.0
push "route 10.10.0.0 255.255.255.0"
client-config-dir /etc/openvpn/client.d
cipher AES-256-CBC
auth SHA512
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-256-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA

server1: client.d for server2 (ensure vpn IP are static and push route for server2 subnets on server1)

/etc/openvpn/client.d/mhntop 
ifconfig-push 10.1.0.14 10.1.0.13
route 10.2.0.0 255.255.255.0

server2: client conf of server1

client
dev tun
proto udp
remote PUBLIC_IP_SERVER1 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert server2.crt
key server2.key
ns-cert-type server
comp-lzo
verb 3
user nobody
group nogroup
cipher AES-256-CBC
auth SHA512
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-256-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA

server2: server.conf for network2

port PORT2
proto udp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key  # This file should be kept secret
dh /etc/openvpn/keys/dh2048.pem
server 10.2.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
log-append  /var/log/openvpn/openvpn2.log
verb 3
max-clients 100
user nobody
group nogroup
client-to-client
push "route 10.1.0.0 255.255.255.0"
client-config-dir /etc/openvpn/client.d
cipher AES-256-CBC
auth SHA512
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-256-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA

As said previously, each network is working fine in itself but communication between them not.
it seems just a routing issue but I may have overlooked something.

Thanks for comments

Traffic

Please read this carefully:
HOWTO: Expanding the scope of the VPN to include additional machines