[deleted]
My configuration was working fine, but after a restart of the OpenVPN server, my subnet 192.168.2.0/24 cannot ping non-Windows clients on 192.168.1.0/24.
I verified the client connected over to the server and the certification CN is correct. I have have the non-Windows clients learned in the router, but still cannot access their resources.
client.ovpn
client
dev tun
proto udp
remote vpn.xxx.com
persist-key
persist-tun
key /etc/openvpn/client.key
cert /etc/openvpn/client.crt
ca /etc/openvpn/ca.crt
comp-lzo
verb 4
server.conf
# Automatically generated configuration
daemon
server 10.6.0.0 255.255.255.0
proto udp
port 1194
dev tun21
comp-lzo adaptive
keepalive 15 60
verb 3
push "route 192.168.2.0 255.255.255.0"
client-config-dir ccd
client-to-client
route 192.168.1.0 255.255.255.0
ca ca.crt
dh dh.pem
cert server.crt
key server.key
status-version 2
status status
# Custom Configuration
topology subnet
push "route 192.168.0.0 255.255.255.0 10.6.0.1"
push "route 192.168.2.0 255.255.255.0 10.6.0.1"
[deleted]
Here's some more info from tcpdump icmp:
tcpdump icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 262144 bytes
21:53:54.954026 IP 192.168.2.154 > 192.168.1.9: ICMP echo request, id 1, seq 23310, length 40
21:53:59.936905 IP 192.168.2.154 > 192.168.1.9: ICMP echo request, id 1, seq 23311, length 40
21:54:03.455668 IP 192.168.2.154 > 192.168.1.1: ICMP echo request, id 1, seq 23312, length 40
21:54:03.455987 IP 192.168.1.1 > 192.168.2.154: ICMP echo reply, id 1, seq 23312, length 40
21:54:04.462855 IP 192.168.2.154 > 192.168.1.1: ICMP echo request, id 1, seq 23313, length 40
21:54:04.463150 IP 192.168.1.1 > 192.168.2.154: ICMP echo reply, id 1, seq 23313, length 40
I confirmed that both 192.168.1.9 and 192.168.1.1 both have the correct gateway. This was working last week. I had to update a certificate.
[deleted]
Okay, I was able to find a Windows client that was not reply to my pings, even though Wireshark showed it replying. Strangely when I added the computer to the domain, it started replying? It then stopped when it was removed from the domain.
[deleted]
FIXED!
Let's start by saying a failed ping request with this scenario would usually point to routing in Iptables.
It turned on the the OpenVPN client from 192.168.1.0/24 that connects to 192.168.2.0/24 network was missing a POSTROUTING rule:
iptables -I POSTROUTING -t nat -s 192.168.2.0/24 -j MASQUERADE
Now I can ping all IP addresses on 192.168.1.0/24 from 192.168.2.0/24
It was weird, but probably by design that some clients were replying, but some were not, Windows clients that were non-domain members would not reply, while domain members would reply. I was even able to get a non-domain computer to reply after running a tracert to the client on 192.168.2.0/24 that was trying to ping it, it would start responding after the trace and then quit again.
