Hi,
I want to connect two private networks through vpn. I just want them to access each other without any nat.
It seems that the client can ping the server, (and with proper routing the server's network), but the server cannot ping the client.
(both can ping the endpoints of the tunnel)
I've been playing around with tcpdump and it seems that the packets from server go to the tunnel but they don't appear at the client's endpoint.
Here is my setup:
LAN Client: 10.0.1.0/24
vpnclient: 10.0.1.5
LAN Server: 192.168.1.0/24
vpnserver: 192.168.1.7
Server config:
port 1194
proto udp
dev tun
ca ca.crt
cert MyVPN.crt
key MyVPN.key # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
push "route 192.168.1.0 255.255.255.0"
route 10.0.1.0 255.255.255.0
client-config-dir ccd
client-to-client
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
Client config:
client
dev tun
proto udp
remote myhostname 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca ca.crt
cert rasp.crt
key rasp.key
ns-cert-type server
comp-lzo
verb 3
Server routing table:
/etc/openvpn $ route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.1.254 0.0.0.0 UG 0 0 0 eth0
10.0.1.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
10.8.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
Client routing table:
route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 10.0.1.1 0.0.0.0 UG 202 0 0 eth0
10.0.1.0 0.0.0.0 255.255.255.0 U 202 0 0 eth0
10.8.0.0 10.8.0.5 255.255.255.0 UG 0 0 0 tun0
10.8.0.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
192.168.1.0 10.8.0.5 255.255.255.0 UG 0 0 0 tun0
I have all iptables rules as ACCEPT.
Client pinging Server:
ping -c 2 192.168.1.7
PING 192.168.1.7 (192.168.1.7) 56(84) bytes of data.
64 bytes from 192.168.1.7: icmp_seq=1 ttl=64 time=3.24 ms
64 bytes from 192.168.1.7: icmp_seq=2 ttl=64 time=2.94 ms
--- 192.168.1.7 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 2.949/3.097/3.245/0.148 ms
tcpdump -i tun0 @ client:
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 262144 bytes
19:15:35.890820 IP 10.8.0.6 > 192.168.1.7: ICMP echo request, id 727, seq 1, length 64
19:15:35.893897 IP 192.168.1.7 > 10.8.0.6: ICMP echo reply, id 727, seq 1, length 64
19:15:36.892786 IP 10.8.0.6 > 192.168.1.7: ICMP echo request, id 727, seq 2, length 64
19:15:36.895627 IP 192.168.1.7 > 10.8.0.6: ICMP echo reply, id 727, seq 2, length 64
tcpdump -i tun0 @ server:
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 262144 bytes
19:15:35.890550 IP 10.8.0.6 > 192.168.1.7: ICMP echo request, id 727, seq 1, length 64
19:15:35.890741 IP 192.168.1.7 > 10.8.0.6: ICMP echo reply, id 727, seq 1, length 64
19:15:36.892310 IP 10.8.0.6 > 192.168.1.7: ICMP echo request, id 727, seq 2, length 64
19:15:36.892453 IP 192.168.1.7 > 10.8.0.6: ICMP echo reply, id 727, seq 2, length 64
Server pinging Client:
ping -c 2 10.0.1.5
PING 10.0.1.5 (10.0.1.5) 56(84) bytes of data.
--- 10.0.1.5 ping statistics ---
2 packets transmitted, 0 received, 100% packet loss, time 1007ms
tcpdump -i tun0 @ client: nothing appears
tcpdump -i tun0 @ server:
19:18:17.605007 IP 10.8.0.1 > 10.0.1.5: ICMP echo request, id 5086, seq 1, length 64
19:18:18.612822 IP 10.8.0.1 > 10.0.1.5: ICMP echo request, id 5086, seq 2, length 64
From several tests I made with iptables and different hosts, it seems that packets only pass through the tunnel:
- from client to server if the source IP is the client tunnel endpoint, i.e., 10.8.0.6
- from server to client if destination IP is the client tunnel endpoint, i.e., 10.8.0.6
Can anyone have any idea of what is happening? Both server and client are running raspbian on raspberrypi's and are up-to-date...
Openvpn version: OpenVPN 2.3.4 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Nov 19 2015
Thanks,
Best João
