iic1tls
Good day. I appreciate your time to review this post and your response.
I am attempting the installation of OpenVPN AS v2.1.2 on Ubuntu 16.x 64bit, and immediately after installation, I:
- run the ovpn-init tool and setup the base installation
- set the passwd on user openvpn
- Setup the basic configuration through the UI: <ipaddress>:943
NOTE that the platform is a multi-homed host: three adapters, with eth0 pointing to the dirty side (internet connection). NICs eth1 and eth2 are pointing at internal (clean) subnets.
At this point, I start a Windows10 workstation, and point MSIE11 at eth0:443, and make it to the Web Based client login. I successfully login.
At this point, on the Windows 10 workstation,I start a CLI, and attempt to ping any addresses on the clean subnets (through the VPN); I am unable to ping.
Note that in the graphical setup, VPN SETTINGS / ROUTING / YES - USE NAT option is selected.
I suspect that either:
- there is no route defined from either of these clean subnets to the default assigned User subnet pool (172.27.224.0/24)
- there is no route defined from the user subnet pool to the external interface
- When I perform an iptables -S, I see no rules defined for either the NAT or the MANGLE tables
So, out-of-the-box, this release of OpenVPNAS appears to need some "help" before it actually works...
Can someone point at a document defining what basic IPTables config will work with an out of the box installation of OpenVPN AS?
Are additional route(s) required to make OpenVPN AS work?
THANK YOU
Regards!
iic1tls
OK - did some more digging.
Again, running:
- Ubuntu 16.04 64bit LTS
- OpenVPN AS 2.1.2
Looking at the routing table on the host machine, I see:
172.27.224.0/20 dev as0t0 proto kernel scope link src 172.27.224.1
Have setup a wireshark instance at one of the two subnets - 101.100.100.253. There is also a target at 101.100.100.254
NOTE that external facing interface is address: 100.100.100.200
When I ping from the external host (Windows 7 Workstation) that is logged in through CONNECT (OpenVPN AS assigned address is: 172.27.224.2), and try to ping 101.100.100.253, WireShark shows the ICMP from 100.100.100.200 arriving at 101.100.100.253, but Destination Unreachable is being returned to 184.25.114.76...
What is this 184 Address? I have no such subnet anywhere in this env...
The Johan
> Note that in the graphical setup, VPN SETTINGS / ROUTING / YES - USE NAT option is selected.
In the box there enter the private subnets that you want your clients to be able to reach in CIDR notation. For example:
192.168.70.0/24
172.16.30.0/24
And under VPN Settings disable pushing DNS and disable routing all client internet traffic through the server. Unless you want to do that, of course, then leave it in.
iic1tls
Thanks novaflash for the quick reply. Thanks for taking the time to look into this train wreck...
As it would turn out, digging into the client log (capi.log), I found CONNECTION TIMEOUT errors. Another symptom was that the browser page, after logging into OpenVPNAS, WOULD NOT display the assigned IP address to the client.
Working with other protocols (ie NTP), I had observed that when there was a fault in the local hardware, other protocols would report connection problems/timeout errors.
None were found on this platform, and the hardware appeared to be working exactly as expected.
However, I pulled all three NICs from the box and replaced them.
After reconfiguring Ubuntu networking, a re-test of the OpenVPNAS connectivity worked perfectly.
So, chalk this one up to bad hardware.
THANK YOU
The Johan
Oh, okay. Well, glad you found the issue! Now send those bad NICs to your worst enemy as a peace offering.
