I have an OpenVPN configuration working beautifully. I'm using it to link our companies network with a couple of VM's hosted on Microsoft's Azure service. The VPN server is hosted on Azure, and machines on the corporate network, and elsewhere are clients. Now I'm trying to set up a routed LAN configuration. But every time I add:
route 179.201.76.0 255.255.255.0
push "route 179.201.76.0 255.255.255.0"
to the config I break the corporate connection to the VPN, it doesn't seem to have an effect on external connections.
From what I can tell my iroute in the ccd file is being picked up and read under normal circumstances:
us=390453 main-vpn-client/179.201.76.37:56795 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/main-vpn-client
but it doesn't get that far once I add the above route to the server.conf
It seems like adding that route causes my client to have trouble finding the server, but I'm not sure why that would be happening.
I'm primarily using this guide:
https://community.openvpn.net/openvpn/wiki/RoutedLans
I've used find and replace to hide some details in these files, but I think I've preserved all the important info, just let me know if something looks really odd.
The azure network is
10.31.0.0 255.255.0.0
The corporate network is
179.201.76.0 255.255.255.0
The vpn network is
10.8.0.0 255.255.0.0
The public ip of the VPN is
18.82.17.49
with domain
my-vpn-server.eastus.cloudapp.azure.com
10.31.0.5 is its private ip on Azure
I can ping the 10.31, and 10.8 networks from vpn clients without issue
I can also ping 10.8 clients from within the azure network
I want to be able to ping clients using their native 179.201.76 addresses, hence the routed lan.
I'm using this client
malcombaldricsurface 49.29.223.82
and attempting to ping
179.201.76.37
keep in mind I can normally ping it at 10.8.0.10 without issue.
server.conf
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.31.0.0 255.255.0.0"
route 179.201.76.0 255.255.255.0
push "route 179.201.76.0 255.255.255.0"
client-config-dir /etc/openvpn/ccd
push "dhcp-option DNS 10.31.1.5"
push "dhcp-option DNS 208.67.222.222"
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
log openvpn.log
verb 4
client.conf
client
dev tun
proto udp
remote my-vpn-server.eastus.cloudapp.azure.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
ns-cert-type server
comp-lzo
verb 3
/etc/openvpn/ccd/main-vpn-client
iroute 179.201.76.0 255.255.255.0
here's my client log for the failure case
us=614814 Current Parameter Settings:
us=614945 config = 'client.conf'
us=614964 mode = 0
us=614977 persist_config = DISABLED
us=614987 persist_mode = 1
us=614998 show_ciphers = DISABLED
us=615008 show_digests = DISABLED
us=615018 show_engines = DISABLED
us=615029 genkey = DISABLED
us=615039 key_pass_file = '[UNDEF]'
us=615050 show_tls_ciphers = DISABLED
us=615061 Connection profiles [default]:
us=615072 proto = udp
us=615082 local = '[UNDEF]'
us=615093 local_port = 0
us=615103 remote = 'my-vpn-server.eastus.cloudapp.azure.com'
us=615114 remote_port = 1194
us=615124 remote_float = DISABLED
us=615134 bind_defined = DISABLED
us=615144 bind_local = DISABLED
us=615154 connect_retry_seconds = 5
us=615164 connect_timeout = 10
us=615175 connect_retry_max = 0
us=615186 socks_proxy_server = '[UNDEF]'
us=615197 socks_proxy_port = 0
us=615207 socks_proxy_retry = DISABLED
us=615217 tun_mtu = 1500
us=615227 tun_mtu_defined = ENABLED
us=615238 link_mtu = 1500
us=615248 link_mtu_defined = DISABLED
us=615258 tun_mtu_extra = 0
us=615268 tun_mtu_extra_defined = DISABLED
us=615278 mtu_discover_type = -1
us=615289 fragment = 0
us=615299 mssfix = 1450
us=615309 explicit_exit_notification = 0
us=615319 Connection profiles END
us=615332 remote_random = DISABLED
us=615342 ipchange = '[UNDEF]'
us=615352 dev = 'tun'
us=615362 dev_type = '[UNDEF]'
us=615372 dev_node = '[UNDEF]'
us=615382 lladdr = '[UNDEF]'
us=615392 topology = 1
us=615402 tun_ipv6 = DISABLED
us=615412 ifconfig_local = '[UNDEF]'
us=615423 ifconfig_remote_netmask = '[UNDEF]'
us=615433 ifconfig_noexec = DISABLED
us=615443 ifconfig_nowarn = DISABLED
us=615453 ifconfig_ipv6_local = '[UNDEF]'
us=615463 ifconfig_ipv6_netbits = 0
us=615473 ifconfig_ipv6_remote = '[UNDEF]'
us=615483 shaper = 0
us=615493 mtu_test = 0
us=615503 mlock = DISABLED
us=615513 keepalive_ping = 0
us=615523 keepalive_timeout = 0
us=615533 inactivity_timeout = 0
us=615543 ping_send_timeout = 0
us=615562 ping_rec_timeout = 0
us=615576 ping_rec_timeout_action = 0
us=615586 ping_timer_remote = DISABLED
us=615596 remap_sigusr1 = 0
us=615606 persist_tun = ENABLED
us=615616 persist_local_ip = DISABLED
us=615627 persist_remote_ip = DISABLED
us=615637 persist_key = ENABLED
us=615647 passtos = DISABLED
us=615657 resolve_retry_seconds = 1000000000
us=615674 username = '[UNDEF]'
us=615685 groupname = '[UNDEF]'
us=615695 chroot_dir = '[UNDEF]'
us=615705 cd_dir = '[UNDEF]'
us=615715 writepid = '[UNDEF]'
us=615725 up_script = '[UNDEF]'
us=615735 down_script = '[UNDEF]'
us=615745 down_pre = DISABLED
us=615755 up_restart = DISABLED
us=615765 up_delay = DISABLED
us=615775 daemon = DISABLED
us=615785 inetd = 0
us=615795 log = DISABLED
us=615805 suppress_timestamps = DISABLED
us=615815 nice = 0
us=615826 verbosity = 6
us=615836 mute = 0
us=615845 gremlin = 0
us=615856 status_file = '[UNDEF]'
us=615866 status_file_version = 1
us=615876 status_file_update_freq = 60
us=615886 occ = ENABLED
us=615896 rcvbuf = 0
us=615906 sndbuf = 0
us=615916 mark = 0
us=615926 sockflags = 0
us=615936 fast_io = DISABLED
us=615946 lzo = 7
us=615956 route_script = '[UNDEF]'
us=615969 route_default_gateway = '[UNDEF]'
us=615980 route_default_metric = 0
us=615990 route_noexec = DISABLED
us=616001 route_delay = 0
us=616011 route_delay_window = 30
us=616022 route_delay_defined = DISABLED
us=616032 route_nopull = DISABLED
us=616045 route_gateway_via_dhcp = DISABLED
us=616056 max_routes = 100
us=616066 allow_pull_fqdn = DISABLED
us=616076 management_addr = '[UNDEF]'
us=616086 management_port = 0
us=616097 management_user_pass = '[UNDEF]'
us=616107 management_log_history_cache = 250
us=616118 management_echo_buffer_size = 100
us=616128 management_write_peer_info_file = '[UNDEF]'
us=616139 management_client_user = '[UNDEF]'
us=616149 management_client_group = '[UNDEF]'
us=616160 management_flags = 0
us=616170 shared_secret_file = '[UNDEF]'
us=616181 key_direction = 0
us=616191 ciphername_defined = ENABLED
us=616201 ciphername = 'BF-CBC'
us=616212 authname_defined = ENABLED
us=616222 authname = 'SHA1'
us=616233 prng_hash = 'SHA1'
us=616243 prng_nonce_secret_len = 16
us=616253 keysize = 0
us=616263 engine = DISABLED
us=616274 replay = ENABLED
us=616284 mute_replay_warnings = DISABLED
us=616294 replay_window = 64
us=616305 replay_time = 15
us=616315 packet_id_file = '[UNDEF]'
us=616325 use_iv = ENABLED
us=616335 test_crypto = DISABLED
us=616346 tls_server = DISABLED
us=616356 tls_client = ENABLED
us=616366 key_method = 2
us=616376 ca_file = '[[INLINE]]'
us=616391 ca_path = '[UNDEF]'
us=616402 dh_file = '[UNDEF]'
us=616412 cert_file = '[[INLINE]]'
us=616423 extra_certs_file = '[UNDEF]'
us=616433 priv_key_file = '[[INLINE]]'
us=616444 pkcs12_file = '[UNDEF]'
us=616454 cipher_list = '[UNDEF]'
us=616464 tls_verify = '[UNDEF]'
us=616475 tls_export_cert = '[UNDEF]'
us=616485 verify_x509_type = 0
us=616495 verify_x509_name = '[UNDEF]'
us=616506 crl_file = '[UNDEF]'
us=616516 ns_cert_type = 1
us=616526 remote_cert_ku[i] = 0
us=616536 remote_cert_ku[i] = 0
us=616546 remote_cert_ku[i] = 0
us=616586 remote_cert_ku[i] = 0
us=616596 remote_cert_ku[i] = 0
us=616604 remote_cert_ku[i] = 0
us=616619 remote_cert_ku[i] = 0
us=616636 remote_cert_ku[i] = 0
us=616646 remote_cert_ku[i] = 0
us=616655 remote_cert_ku[i] = 0
us=616664 remote_cert_ku[i] = 0
us=616673 remote_cert_ku[i] = 0
us=616682 remote_cert_ku[i] = 0
us=616691 remote_cert_ku[i] = 0
us=616700 remote_cert_ku[i] = 0
us=616709 remote_cert_ku[i] = 0
us=616718 remote_cert_eku = '[UNDEF]'
us=616728 ssl_flags = 0
us=616737 tls_timeout = 2
us=616746 renegotiate_bytes = 0
us=616756 renegotiate_packets = 0
us=616765 renegotiate_seconds = 3600
us=616774 handshake_window = 60
us=616783 transition_window = 3600
us=616793 single_session = DISABLED
us=616802 push_peer_info = DISABLED
us=616811 tls_exit = DISABLED
us=616821 tls_auth_file = '[UNDEF]'
us=616830 pkcs11_protected_authentication = DISABLED
us=616840 pkcs11_protected_authentication = DISABLED
us=616849 pkcs11_protected_authentication = DISABLED
us=616858 pkcs11_protected_authentication = DISABLED
us=616867 pkcs11_protected_authentication = DISABLED
us=616877 pkcs11_protected_authentication = DISABLED
us=616886 pkcs11_protected_authentication = DISABLED
us=616895 pkcs11_protected_authentication = DISABLED
us=616904 pkcs11_protected_authentication = DISABLED
us=616914 pkcs11_protected_authentication = DISABLED
us=616923 pkcs11_protected_authentication = DISABLED
us=616932 pkcs11_protected_authentication = DISABLED
us=616941 pkcs11_protected_authentication = DISABLED
us=616951 pkcs11_protected_authentication = DISABLED
us=616960 pkcs11_protected_authentication = DISABLED
us=616969 pkcs11_protected_authentication = DISABLED
us=616979 pkcs11_private_mode = 00000000
us=616989 pkcs11_private_mode = 00000000
us=616998 pkcs11_private_mode = 00000000
us=617007 pkcs11_private_mode = 00000000
us=617016 pkcs11_private_mode = 00000000
us=617025 pkcs11_private_mode = 00000000
us=617040 pkcs11_private_mode = 00000000
us=617050 pkcs11_private_mode = 00000000
us=617059 pkcs11_private_mode = 00000000
us=617068 pkcs11_private_mode = 00000000
us=617077 pkcs11_private_mode = 00000000
us=617086 pkcs11_private_mode = 00000000
us=617095 pkcs11_private_mode = 00000000
us=617104 pkcs11_private_mode = 00000000
us=617113 pkcs11_private_mode = 00000000
us=617122 pkcs11_private_mode = 00000000
us=617131 pkcs11_cert_private = DISABLED
us=617140 pkcs11_cert_private = DISABLED
us=617149 pkcs11_cert_private = DISABLED
us=617159 pkcs11_cert_private = DISABLED
us=617168 pkcs11_cert_private = DISABLED
us=617177 pkcs11_cert_private = DISABLED
us=617186 pkcs11_cert_private = DISABLED
us=617195 pkcs11_cert_private = DISABLED
us=617204 pkcs11_cert_private = DISABLED
us=617213 pkcs11_cert_private = DISABLED
us=617223 pkcs11_cert_private = DISABLED
us=617232 pkcs11_cert_private = DISABLED
us=617241 pkcs11_cert_private = DISABLED
us=617250 pkcs11_cert_private = DISABLED
us=617259 pkcs11_cert_private = DISABLED
us=617268 pkcs11_cert_private = DISABLED
us=617278 pkcs11_pin_cache_period = -1
us=617287 pkcs11_id = '[UNDEF]'
us=617297 pkcs11_id_management = DISABLED
us=617314 server_network = 0.0.0.0
us=617325 server_netmask = 0.0.0.0
us=617338 server_network_ipv6 = ::
us=617348 server_netbits_ipv6 = 0
us=617358 server_bridge_ip = 0.0.0.0
us=617369 server_bridge_netmask = 0.0.0.0
us=617379 server_bridge_pool_start = 0.0.0.0
us=617390 server_bridge_pool_end = 0.0.0.0
us=617399 ifconfig_pool_defined = DISABLED
us=617410 ifconfig_pool_start = 0.0.0.0
us=617420 ifconfig_pool_end = 0.0.0.0
us=617431 ifconfig_pool_netmask = 0.0.0.0
us=617440 ifconfig_pool_persist_filename = '[UNDEF]'
us=617450 ifconfig_pool_persist_refresh_freq = 600
us=617460 ifconfig_ipv6_pool_defined = DISABLED
us=617470 ifconfig_ipv6_pool_base = ::
us=617479 ifconfig_ipv6_pool_netbits = 0
us=617489 n_bcast_buf = 256
us=617498 tcp_queue_limit = 64
us=617507 real_hash_size = 256
us=617517 virtual_hash_size = 256
us=617526 client_connect_script = '[UNDEF]'
us=617535 learn_address_script = '[UNDEF]'
us=617547 client_disconnect_script = '[UNDEF]'
us=617567 client_config_dir = '[UNDEF]'
us=617577 ccd_exclusive = DISABLED
us=617587 tmp_dir = '/tmp'
us=617596 push_ifconfig_defined = DISABLED
us=617606 push_ifconfig_local = 0.0.0.0
us=617617 push_ifconfig_remote_netmask = 0.0.0.0
us=617626 push_ifconfig_ipv6_defined = DISABLED
us=617642 push_ifconfig_ipv6_local = ::/0
us=617652 push_ifconfig_ipv6_remote = ::
us=617662 enable_c2c = DISABLED
us=617671 duplicate_cn = DISABLED
us=617681 cf_max = 0
us=617690 cf_per = 0
us=617699 max_clients = 1024
us=617709 max_routes_per_client = 256
us=617718 auth_user_pass_verify_script = '[UNDEF]'
us=617728 auth_user_pass_verify_script_via_file = DISABLED
us=617738 port_share_host = '[UNDEF]'
us=617747 port_share_port = 0
us=617756 client = ENABLED
us=617766 pull = ENABLED
us=617776 auth_user_pass_file = '[UNDEF]'
us=617788 OpenVPN 2.3.10 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jan 4 2016
us=617806 library versions: OpenSSL 1.0.1e-fips 11 Feb 2013, LZO 2.06
us=618994 LZO compression initialized
us=619106 Control Channel MTU parms [ L:1542 D:1212 EF:38 EB:0 ET:0 EL:3 ]
us=619177 Socket Buffers: R=[212992->212992] S=[212992->212992]
us=697610 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:143 ET:0 EL:3 AF:3/1 ]
us=697653 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
us=697658 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
us=697672 Local Options hash (VER=V4): '41690919'
us=697678 Expected Remote Options hash (VER=V4): '530fdded'
us=697686 UDPv4 link local: [undef]
us=697692 UDPv4 link remote: [AF_INET]18.82.17.49:1194
us=697716 UDPv4 WRITE [14] to [AF_INET]18.82.17.49:1194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
us=710035 UDPv4 WRITE [14] to [AF_INET]18.82.17.49:1194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
us=734587 UDPv4 WRITE [14] to [AF_INET]18.82.17.49:1194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
us=827309 UDPv4 WRITE [14] to [AF_INET]18.82.17.49:1194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
us=916871 UDPv4 WRITE [14] to [AF_INET]18.82.17.49:1194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
us=488067 event_wait : Interrupted system call (code=4)
us=488174 TCP/UDP: Closing socket
us=488197 SIGINT[hard,] received, process exiting
I have the server log but it doesn't look like main-vpn-client's ip:
179.201.76.37
shows up at all, so I don't think the server knows anything about the connection attempt
Does anything with my configuration look wrong?
