Thanks for nudging me.
Ping now works. The error I made earlier was an incorrect ifconfig specification.
Hopefully this will help someone else.
Step 1. Make sure that ping works before VPN is setup (in both directions)
Server to client:
[root@vpn-client-02 openvpn]# ping -c 2 -W 1 -W 5 10.0.3.16
PING 10.0.3.16 (10.0.3.16) 56(84) bytes of data.
64 bytes from 10.0.3.16: icmp_seq=1 ttl=64 time=0.229 ms
64 bytes from 10.0.3.16: icmp_seq=2 ttl=64 time=0.250 ms
--- 10.0.3.16 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1000ms
rtt min/avg/max/mdev = 0.229/0.239/0.250/0.018 ms
Client to server:
[root@vpn-client-01 ~]# ping -c 2 -W 1 -W 5 10.0.3.15
PING 10.0.3.15 (10.0.3.15) 56(84) bytes of data.
64 bytes from 10.0.3.15: icmp_seq=1 ttl=64 time=0.239 ms
64 bytes from 10.0.3.15: icmp_seq=2 ttl=64 time=0.328 ms
--- 10.0.3.15 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 999ms
rtt min/avg/max/mdev = 0.239/0.283/0.328/0.047 ms
Step 2. Generate the secret key.
[root@vpn-client-01 ~]# openvpn --genkey --secret static.key
[root@vpn-client-01 ~]# readlink -m static.key
/root/static.key
Step 3. Copy the secret key to the other host.
[root@vpn-client-01 ~]# scp static.key vpn-client-02:/root/static.key
static.key 100% 636 0.6KB/s 00:00
Step 4. Verify that IP forwarding is enabled on the server.
[root@vpn-client-02 openvpn]# sysctl -p
net.ipv4.ip_forward = 1
Step 5. Verify that the firewall is stopped on both hosts.
[root@vpn-client-01 ~]# ping -c 2 -W 1 -W 5 10.0.3.15
PING 10.0.3.15 (10.0.3.15) 56(84) bytes of data.
--- 10.0.3.15 ping statistics ---
2 packets transmitted, 0 received, 100% packet loss, time 1000ms
[root@vpn-client-01 ~]# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
Active: inactive (dead)
Apr 05 11:42:46 vpn-client-01.test.org systemd[1]: Starting firewalld - dynamic firewall daemon...
Apr 05 11:42:47 vpn-client-01.test.org systemd[1]: Started firewalld - dynamic firewall daemon.
Apr 05 16:06:13 vpn-client-01.test.org systemd[1]: Stopping firewalld - dynamic firewall daemon...
Apr 05 16:06:14 vpn-client-01.test.org systemd[1]: Stopped firewalld - dynamic firewall daemon.
[root@vpn-client-02 openvpn]# sysctemctl status firewalld
bash: sysctemctl: command not found...
[root@vpn-client-02 openvpn]# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
Active: inactive (dead)
Apr 05 11:42:53 vpn-client-02 systemd[1]: Starting firewalld - dynamic firewall daemon...
Apr 05 11:42:54 vpn-client-02 systemd[1]: Started firewalld - dynamic firewall daemon.
Apr 05 12:23:41 vpn-client-02 systemd[1]: Stopping firewalld - dynamic firewall daemon...
Apr 05 12:23:42 vpn-client-02 systemd[1]: Stopped firewalld - dynamic firewall daemon.
Apr 05 16:06:21 vpn-client-02 systemd[1]: Stopped firewalld - dynamic firewall daemon.
Step 6. Created the server.conf file with the same lines as the HOWTO
[root@vpn-client-02 openvpn]# cat server.conf
dev tun
ifconfig 10.0.3.16 10.0.3.15
secret /root/static.key
Step 7. Created the client.conf with the same lines as the HOWTO
[root@vpn-client-01 openvpn]# cat client.conf
remote vpn-client-02
dev tun
ifconfig 10.0.3.15 10.0.3.16
secret /root/static.key
Step 8. Started the server VPN.
[root@vpn-client-02 openvpn]# openvpn --config server.conf
Wed Apr 6 11:13:16 2016 OpenVPN 2.3.10 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jan 4 2016
Wed Apr 6 11:13:16 2016 library versions: OpenSSL 1.0.1e-fips 11 Feb 2013, LZO 2.06
Wed Apr 6 11:13:16 2016 TUN/TAP device tun0 opened
Wed Apr 6 11:13:16 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Apr 6 11:13:16 2016 /usr/sbin/ip link set dev tun0 up mtu 1500
Wed Apr 6 11:13:16 2016 /usr/sbin/ip addr add dev tun0 local 10.0.3.15 peer 10.0.3.16
Wed Apr 6 11:13:16 2016 UDPv4 link local (bound): [undef]
Wed Apr 6 11:13:16 2016 UDPv4 link remote: [undef]
Step 9. Started the client VPN.
[root@vpn-client-01 openvpn]# openvpn --config client.conf
Wed Apr 6 11:13:24 2016 OpenVPN 2.3.10 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jan 4 2016
Wed Apr 6 11:13:24 2016 library versions: OpenSSL 1.0.1e-fips 11 Feb 2013, LZO 2.06
Wed Apr 6 11:13:24 2016 WARNING: --remote address [10.0.3.15] conflicts with --ifconfig address pair [10.0.3.16, 10.0.3.15]. (silence this warning with --ifconfig-nowarn)
Wed Apr 6 11:13:24 2016 WARNING: potential conflict between --remote address [10.0.3.15] and --ifconfig address pair [10.0.3.16, 10.0.3.15] -- this is a warning only that is triggered when local/remote addresses exist within the same /24 subnet as --ifconfig endpoints. (silence this warning with --ifconfig-nowarn)
Wed Apr 6 11:13:24 2016 TUN/TAP device tun0 opened
Wed Apr 6 11:13:24 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Apr 6 11:13:24 2016 /usr/sbin/ip link set dev tun0 up mtu 1500
Wed Apr 6 11:13:24 2016 /usr/sbin/ip addr add dev tun0 local 10.0.3.16 peer 10.0.3.15
Wed Apr 6 11:13:24 2016 UDPv4 link local (bound): [undef]
Wed Apr 6 11:13:24 2016 UDPv4 link remote: [AF_INET]10.0.3.15:1194
The warnings can be ignored.
Step 10. Try the ping operations again.
Server to client:
[root@vpn-client-02 openvpn]# ping -c 2 -W 1 -W 5 10.0.3.16
PING 10.0.3.16 (10.0.3.16) 56(84) bytes of data.
64 bytes from 10.0.3.16: icmp_seq=1 ttl=64 time=0.015 ms
64 bytes from 10.0.3.16: icmp_seq=2 ttl=64 time=0.028 ms
--- 10.0.3.16 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 999ms
rtt min/avg/max/mdev = 0.015/0.021/0.028/0.008 ms
Client to server:
[[root@vpn-client-01 ~]# !ping
ping -c 2 -W 1 -W 5 10.0.3.15
PING 10.0.3.15 (10.0.3.15) 56(84) bytes of data.
64 bytes from 10.0.3.15: icmp_seq=1 ttl=64 time=0.018 ms
64 bytes from 10.0.3.15: icmp_seq=2 ttl=64 time=0.024 ms
--- 10.0.3.15 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 999ms
rtt min/avg/max/mdev = 0.018/0.021/0.024/0.003 ms
Both now work.
