[Solved] Routes are pushed to client but don't work

zipmaster07

I've setup OpenVPN 2.3.4 on a Debian server in my sandbox environment. My server.conf file is below:

root@barracks:~# cat /etc/openvpn/server.conf | grep -v '^[#;]' | tr -s [:space:]

port 1194
proto udp
dev tun
ca /etc/ssl/certs/chain.harmonywave.com.pem
cert /etc/ssl/certs/vpn.harmonywave.com.crt
key /etc/ssl/private/vpn.harmonywave.com.key # This file should be kept secret
dh /etc/openvpn/dh.vpn.pem
server 10.1.60.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.1.30.0 255.255.255.0"
push "route 10.1.32.0 255.255.255.0"
push "dhcp-option DNS 10.1.30.2"
keepalive 10 120
tls-auth /etc/openvpn/ta.key 0 # This file is secret
cipher AES-256-CBC # AES
comp-lzo
max-clients 25
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log-append /var/log/openvpn.log
verb 4
mute 20

I'm testing my VPN connection from completely outside my own network on a Windows 10 desktop which has OpenVPN 2.3.11 installed (latest Windows 10 64-bit download from the OpenVPN website). Not sure if the minor version difference between client and server is an issue. My client config is below:

client
dev tun
proto udp
remote vpn.harmonywave.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca C:\\Users\\jschaeffer\\Documents\\certificates\\chain.harmonywave.com.pem
cert C:\\Users\\jschaeffer\\Documents\\certificates\\jschaeffer.vpn.crt
key C:\\Users\\jschaeffer\\Documents\\keys\\jschaeffer.vpn.key
remote-cert-tls server
tls-auth C:\\Users\\jschaeffer\\Documents\\keys\\ta.key 1
cipher AES-256-CBC
comp-lzo
verb 4

I can successfully connect to my VPN from my desktop and I get an IP address (10.1.60.6). In my server.conf file you can see that I'm pushing two routes to clients:

- 10.1.30.0/24
- 10.1.32.0/24

After I connect on my desktop I can see these routes, but I cannot ping or connect to them at all.

PS C:\Users\jschaeffer> route PRINT -4
===========================================================================
Interface List
  9...6c 3b e5 27 f2 db ......Intel(R) 82579LM Gigabit Network Connection
  4...0a 00 27 00 00 04 ......VirtualBox Host-Only Ethernet Adapter
  2...00 ff 42 bd 60 e2 ......TAP-Windows Adapter V9
  1...........................Software Loopback Interface 1
 22...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
  6...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
  7...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0     10.192.120.1    10.192.120.66    266
        10.1.30.0    255.255.255.0        10.1.60.5        10.1.60.6     20
        10.1.32.0    255.255.255.0        10.1.60.5        10.1.60.6     20
        10.1.60.1  255.255.255.255        10.1.60.5        10.1.60.6     20
        10.1.60.4  255.255.255.252         On-link         10.1.60.6    276
        10.1.60.6  255.255.255.255         On-link         10.1.60.6    276
        10.1.60.7  255.255.255.255         On-link         10.1.60.6    276
     10.192.120.0    255.255.252.0         On-link     10.192.120.66    266
    10.192.120.66  255.255.255.255         On-link     10.192.120.66    266
   10.192.123.255  255.255.255.255         On-link     10.192.120.66    266
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
     192.168.56.0    255.255.255.0         On-link      192.168.56.1    266
     192.168.56.1  255.255.255.255         On-link      192.168.56.1    266
   192.168.56.255  255.255.255.255         On-link      192.168.56.1    266
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link      192.168.56.1    266
        224.0.0.0        240.0.0.0         On-link     10.192.120.66    266
        224.0.0.0        240.0.0.0         On-link         10.1.60.6    276
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link      192.168.56.1    266
  255.255.255.255  255.255.255.255         On-link     10.192.120.66    266
  255.255.255.255  255.255.255.255         On-link         10.1.60.6    276
===========================================================================
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric
          0.0.0.0          0.0.0.0     10.192.120.1  Default
===========================================================================

PS C:\Users\jschaeffer> ping 10.1.30.1

Pinging 10.1.30.1 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 10.1.30.1:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

There are two routes which show to reach 10.1.30.0/24 and 10.1.32.0/24 to go through the gateway 10.1.60.5 on the 10.1.60.6 interface. I know the interface works because I can reach the OpenVPN server at 10.1.60.1:

PS C:\Users\jschaeffer> ping 10.1.60.1

Pinging 10.1.60.1 with 32 bytes of data:
Reply from 10.1.60.1: bytes=32 time=49ms TTL=64
Reply from 10.1.60.1: bytes=32 time=47ms TTL=64
Reply from 10.1.60.1: bytes=32 time=47ms TTL=64
Reply from 10.1.60.1: bytes=32 time=48ms TTL=64

Ping statistics for 10.1.60.1:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 47ms, Maximum = 49ms, Average = 47ms

I can also SSH into that server, I just can get to anything behind it. I know the VPN server itself can reach these networks as well:

root@barracks:~# ping 10.1.30.1
PING 10.1.30.1 (10.1.30.1) 56(84) bytes of data.
64 bytes from 10.1.30.1: icmp_seq=1 ttl=64 time=1.05 ms
64 bytes from 10.1.30.1: icmp_seq=2 ttl=64 time=1.02 ms
64 bytes from 10.1.30.1: icmp_seq=3 ttl=64 time=1.06 ms
^C
--- 10.1.30.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 1.024/1.048/1.065/0.041 ms

I also have a route setup on my router to properly send traffic back to the client:

adjutant01#show ip route
Maximum Parallel Paths: 1 (1 after reset)
IP Forwarding:          enabled

Codes: C - connected, S - static, D - DHCP

S  0.0.0.0/0          [1/1] via  10.1.100.2  340:33:0              vlan 100
C  10.1.10.0/24       is directly connected                        vlan 10
C  10.1.20.0/24       is directly connected                        vlan 20
C  10.1.30.0/24       is directly connected                        vlan 30
C  10.1.31.0/24       is directly connected                        vlan 31
C  10.1.32.0/24       is directly connected                        vlan 32
C  10.1.33.0/24       is directly connected                        vlan 33
C  10.1.50.0/24       is directly connected                        vlan 50
C  10.1.51.0/24       is directly connected                        vlan 51
S  10.1.60.0/24       [1/1] via  10.1.20.21  169:51:26             vlan 20
C  10.1.70.0/24       is directly connected                        vlan 70
C  10.1.90.0/24       is directly connected                        vlan 90
C  10.1.100.0/24      is directly connected                        vlan 100

10.1.20.21 is the IP address of my OpenVPN server:

root@barracks:~# ip addr show | grep 'inet .*'
    inet 127.0.0.1/8 scope host lo
    inet 10.1.60.1 peer 10.1.60.2/32 scope global tun0
    inet 10.1.20.21/24 brd 10.1.20.255 scope global eth0

It seems that the solution is probably a simple one, but it is evading me at the moment. Maybe somebody else can spot something I'm missing.

Thanks,
Joshua

zipmaster07

I figured out the problem. I failed to enable IP forwarding on the OpenVPN host:

root@barracks:~# cat /proc/sys/net/ipv4/ip_forward
0

root@barracks:~# echo 1 > /proc/sys/net/ipv4/ip_forward

Now I can ping the machines behind the VPN server from the client:

Pinging 10.1.30.1 with 32 bytes of data:
Reply from 10.1.30.1: bytes=32 time=49ms TTL=63
Reply from 10.1.30.1: bytes=32 time=48ms TTL=63

Ping statistics for 10.1.30.1:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 48ms, Maximum = 49ms, Average = 48ms

For those that don't know, to enable this permanently you need to edit /etc/sysctl.conf and set "net.ipv4.ip_forward=1" then run "sysctl -p" (or reboot).

Thanks,
Joshua