Ping gets stuck on server

Pippin

Hi,

Trying to help someone setup OpenVPN and we got to the point where a reply ping gets stuck on the server.

Setup:
Server LAN: 192.168.10.0/24
Gateway: 192.168.10.10
Server IP: 192.168.10.19 (10.8.0.1)
LAN host IP: 192.168.10.11

VPN: 10.8.0.0/24

Client LAN: 192.168.20.0/24 (10.8.0.2)
Gateway: 192.168.20.10
Client IP: 192.168.20.11

Server and client are both behind NAT
Server and client both have "ip_forward 1" and masquerade rule "-t nat -A POSTROUTING -o eth0 -s 10.8.0.0/24 -j MASQUERADE"
Firewalls have policy ACCEPT with no rules except for masquerading.

On server side LAN host 192.168.10.11, added a route "add -net 192.168.20.0 netmask 255.255.255.0 gw 192.168.10.19"
tcpdump shows ping request from 192.168.10.11 arrives on 192.168.20.11 which sends reply back.
As far as I can see, tcpdump on server "tcpdump -n -i tun0 | grep ICMP" shows this reply arrives.
Tcpdump on 192.168.10.11 only show request but no reply.

Tells me we`re missing something on server, or am I missing something? 😉
17:44:53.978651 IP 192.168.10.11 > 192.168.20.11: ICMP echo request, id 5160, seq 60, length 64
17:44:54.037342 IP 192.168.20.11 > 192.168.10.11: ICMP echo reply, id 5160, seq 60, length 64
17:44:54.978755 IP 192.168.10.11 > 192.168.20.11: ICMP echo request, id 5160, seq 61, length 64
17:44:55.037400 IP 192.168.20.11 > 192.168.10.11: ICMP echo reply, id 5160, seq 61, length 64 dev tun
local 192.168.10.19
proto udp
port 1194
persist-key
persist-tun
keepalive 10 120

server 10.8.0.0 255.255.255.0
topology subnet

route 192.168.10.0 255.255.255.0 192.168.10.10
route 192.168.20.0 255.255.255.0 10.8.0.1
push "route 10.8.0.0 255.255.255.0"
push "route 192.168.10.0 255.255.255.0"

push "redirect-gateway def1"
push "dhcp-option DNS 192.168.10.10" #Router IP on server side

script-security 2
up /etc/openvpn/up.sh #set ip_forward and masquerade
down /etc/openvpn/down.sh #unset ip_forward and masquerade Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.10.10 0.0.0.0 UG 202 0 0 eth0
10.8.0.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0
192.168.10.0 192.168.10.10 255.255.255.0 UG 0 0 0 eth0
192.168.10.0 0.0.0.0 255.255.255.0 U 202 0 0 eth0
192.168.20.0 10.8.0.1 255.255.255.0 UG 0 0 0 tun0 Any help appreciated, thanks.

TinCanTech

You appear to have forgotten --iroute

Pippin

Big sorry, no i have not, or did you mean i forgot to mention it here? :mrgreen:
ifconfig-push 10.8.0.2 255.255.255.0
iroute 192.168.20.0 255.255.255.0

TinCanTech

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

Pippin

:lol: :lol: :lol:

Yes, you`re right :thumbs up:
You have balls? :mrgreen:
You really should be in the dev team 8-)

Joking aside...
But ccd is in there 😃
up en down only contain enable/disable ip_forward and masquerading.

Now i think of it, he had 2.3.4 installed and we ran into ticket 55.
https://community.openvpn.net/openvpn/ticket/55
https://community.openvpn.net/openvpn/changeset/3a3da8ddd3f395f9b2bc64f84cb549d99e7c6dbd/
He then update to 2.3.11 but we did not remove both gateway`s we added before, to the two route directives.
Will try that.

I don`t think I forget something more route related.

Thanks

TinCanTech

Pippin wroteBut ccd is in there

Pippin wrote dev tun
local 192.168.10.19
proto udp
port 1194
persist-key
persist-tun
keepalive 10 120
server 10.8.0.0 255.255.255.0
topology subnet
route 192.168.10.0 255.255.255.0 192.168.10.10
route 192.168.20.0 255.255.255.0 10.8.0.1
push "route 10.8.0.0 255.255.255.0"
push "route 192.168.10.0 255.255.255.0"
push "redirect-gateway def1"
push "dhcp-option DNS 192.168.10.10" #Router IP on server side
script-security 2
up /etc/openvpn/up.sh #set ip_forward and masquerade
down /etc/openvpn/down.sh #unset ip_forward and masquerade

:?: :ugeek:

Pippin wroteI don`t think I forget something more

Logs ..

Pippin

Yes, will post log. First make fresh one so it reflects the actual config given here 🙂

Thanks

Pippin

With the above described config we now have below log.

[oconf=Server log]Fri Dec  2 16:32:40 2016 us=186021 Current Parameter Settings:
Fri Dec  2 16:32:40 2016 us=186404   config = '/etc/openvpn/server.conf'
Fri Dec  2 16:32:40 2016 us=186497   mode = 1
Fri Dec  2 16:32:40 2016 us=186569   persist_config = DISABLED
Fri Dec  2 16:32:40 2016 us=186641   persist_mode = 1
Fri Dec  2 16:32:40 2016 us=186711   show_ciphers = DISABLED
Fri Dec  2 16:32:40 2016 us=186781   show_digests = DISABLED
Fri Dec  2 16:32:40 2016 us=186853   show_engines = DISABLED
Fri Dec  2 16:32:40 2016 us=186924   genkey = DISABLED
Fri Dec  2 16:32:40 2016 us=186997   key_pass_file = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=187069   show_tls_ciphers = DISABLED
Fri Dec  2 16:32:40 2016 us=187144 Connection profiles [default]:
Fri Dec  2 16:32:40 2016 us=187219   proto = udp
Fri Dec  2 16:32:40 2016 us=187291   local = '192.168.10.19'
Fri Dec  2 16:32:40 2016 us=187362   local_port = 1194
Fri Dec  2 16:32:40 2016 us=187434   remote = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=187505   remote_port = 1194
Fri Dec  2 16:32:40 2016 us=187574   remote_float = ENABLED
Fri Dec  2 16:32:40 2016 us=187640   bind_defined = DISABLED
Fri Dec  2 16:32:40 2016 us=187709   bind_local = ENABLED
Fri Dec  2 16:32:40 2016 us=187778   connect_retry_seconds = 5
Fri Dec  2 16:32:40 2016 us=187847   connect_timeout = 10
Fri Dec  2 16:32:40 2016 us=187915   connect_retry_max = 0
Fri Dec  2 16:32:40 2016 us=187983   socks_proxy_server = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=188051   socks_proxy_port = 0
Fri Dec  2 16:32:40 2016 us=188120   socks_proxy_retry = DISABLED
Fri Dec  2 16:32:40 2016 us=188189   tun_mtu = 1500
Fri Dec  2 16:32:40 2016 us=188258   tun_mtu_defined = ENABLED
Fri Dec  2 16:32:40 2016 us=188326   link_mtu = 1500
Fri Dec  2 16:32:40 2016 us=188393   link_mtu_defined = DISABLED
Fri Dec  2 16:32:40 2016 us=188462   tun_mtu_extra = 0
Fri Dec  2 16:32:40 2016 us=188529   tun_mtu_extra_defined = DISABLED
Fri Dec  2 16:32:40 2016 us=188599   mtu_discover_type = -1
Fri Dec  2 16:32:40 2016 us=188667   fragment = 0
Fri Dec  2 16:32:40 2016 us=188736   mssfix = 1450
Fri Dec  2 16:32:40 2016 us=188802   explicit_exit_notification = 0
Fri Dec  2 16:32:40 2016 us=188872 Connection profiles END
Fri Dec  2 16:32:40 2016 us=188939   remote_random = DISABLED
Fri Dec  2 16:32:40 2016 us=189009   ipchange = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=189078   dev = 'tun'
Fri Dec  2 16:32:40 2016 us=189147   dev_type = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=189216   dev_node = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=189283   lladdr = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=189351   topology = 3
Fri Dec  2 16:32:40 2016 us=189420   tun_ipv6 = DISABLED
Fri Dec  2 16:32:40 2016 us=189488   ifconfig_local = '10.8.0.1'
Fri Dec  2 16:32:40 2016 us=189557   ifconfig_remote_netmask = '255.255.255.0'
Fri Dec  2 16:32:40 2016 us=189626   ifconfig_noexec = DISABLED
Fri Dec  2 16:32:40 2016 us=189695   ifconfig_nowarn = DISABLED
Fri Dec  2 16:32:40 2016 us=189764   ifconfig_ipv6_local = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=189833   ifconfig_ipv6_netbits = 0
Fri Dec  2 16:32:40 2016 us=189900   ifconfig_ipv6_remote = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=189968   shaper = 0
Fri Dec  2 16:32:40 2016 us=190035   mtu_test = 0
Fri Dec  2 16:32:40 2016 us=190102   mlock = DISABLED
Fri Dec  2 16:32:40 2016 us=190170   keepalive_ping = 10
Fri Dec  2 16:32:40 2016 us=190238   keepalive_timeout = 120
Fri Dec  2 16:32:40 2016 us=190306   inactivity_timeout = 0
Fri Dec  2 16:32:40 2016 us=190375   ping_send_timeout = 10
Fri Dec  2 16:32:40 2016 us=190442   ping_rec_timeout = 240
Fri Dec  2 16:32:40 2016 us=190511   ping_rec_timeout_action = 2
Fri Dec  2 16:32:40 2016 us=190581   ping_timer_remote = DISABLED
Fri Dec  2 16:32:40 2016 us=190649   remap_sigusr1 = 0
Fri Dec  2 16:32:40 2016 us=190717   persist_tun = ENABLED
Fri Dec  2 16:32:40 2016 us=190784   persist_local_ip = DISABLED
Fri Dec  2 16:32:40 2016 us=190854   persist_remote_ip = DISABLED
Fri Dec  2 16:32:40 2016 us=190922   persist_key = ENABLED
Fri Dec  2 16:32:40 2016 us=190991   passtos = DISABLED
Fri Dec  2 16:32:40 2016 us=191060   resolve_retry_seconds = 1000000000
Fri Dec  2 16:32:40 2016 us=191158   username = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=191230   groupname = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=191297   chroot_dir = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=191366   cd_dir = '/etc/openvpn'
Fri Dec  2 16:32:40 2016 us=191433   writepid = '/run/openvpn/server.pid'
Fri Dec  2 16:32:40 2016 us=191506   up_script = '/etc/openvpn/script/up.sh'
Fri Dec  2 16:32:40 2016 us=191581   down_script = '/etc/openvpn/script/down.sh'
Fri Dec  2 16:32:40 2016 us=191652   down_pre = DISABLED
Fri Dec  2 16:32:40 2016 us=191723   up_restart = DISABLED
Fri Dec  2 16:32:40 2016 us=191791   up_delay = DISABLED
Fri Dec  2 16:32:40 2016 us=191859   daemon = ENABLED
Fri Dec  2 16:32:40 2016 us=191926   inetd = 0
Fri Dec  2 16:32:40 2016 us=191994   log = ENABLED
Fri Dec  2 16:32:40 2016 us=192062   suppress_timestamps = DISABLED
Fri Dec  2 16:32:40 2016 us=192130   nice = 0
Fri Dec  2 16:32:40 2016 us=192198   verbosity = 4
Fri Dec  2 16:32:40 2016 us=192265   mute = 0
Fri Dec  2 16:32:40 2016 us=192332   gremlin = 0
Fri Dec  2 16:32:40 2016 us=192399   status_file = '/var/log/openvpn-status.log'
Fri Dec  2 16:32:40 2016 us=192470   status_file_version = 1
Fri Dec  2 16:32:40 2016 us=192536   status_file_update_freq = 30
Fri Dec  2 16:32:40 2016 us=192605   occ = ENABLED
Fri Dec  2 16:32:40 2016 us=192757   rcvbuf = 393216
Fri Dec  2 16:32:40 2016 us=192840   sndbuf = 393216
Fri Dec  2 16:32:40 2016 us=192908   mark = 0
Fri Dec  2 16:32:40 2016 us=192976   sockflags = 0
Fri Dec  2 16:32:40 2016 us=193043   fast_io = ENABLED
Fri Dec  2 16:32:40 2016 us=193110   lzo = 1
Fri Dec  2 16:32:40 2016 us=193177   route_script = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=193246   route_default_gateway = '10.8.0.2'
Fri Dec  2 16:32:40 2016 us=193314   route_default_metric = 0
Fri Dec  2 16:32:40 2016 us=193384   route_noexec = DISABLED
Fri Dec  2 16:32:40 2016 us=193453   route_delay = 0
Fri Dec  2 16:32:40 2016 us=193522   route_delay_window = 30
Fri Dec  2 16:32:40 2016 us=193591   route_delay_defined = DISABLED
Fri Dec  2 16:32:40 2016 us=193659   route_nopull = DISABLED
Fri Dec  2 16:32:40 2016 us=193729   route_gateway_via_dhcp = DISABLED
Fri Dec  2 16:32:40 2016 us=193798   max_routes = 100
Fri Dec  2 16:32:40 2016 us=193868   allow_pull_fqdn = DISABLED
Fri Dec  2 16:32:40 2016 us=193941   route 192.168.10.0/255.255.255.0/192.168.10.10/nil
Fri Dec  2 16:32:40 2016 us=194015   route 192.168.20.0/255.255.255.0/10.8.0.1/nil
Fri Dec  2 16:32:40 2016 us=194087   management_addr = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=194156   management_port = 0
Fri Dec  2 16:32:40 2016 us=194225   management_user_pass = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=194317   management_log_history_cache = 250
Fri Dec  2 16:32:40 2016 us=194394   management_echo_buffer_size = 100
Fri Dec  2 16:32:40 2016 us=194467   management_write_peer_info_file = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=194537   management_client_user = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=194609   management_client_group = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=194678   management_flags = 0
Fri Dec  2 16:32:40 2016 us=194750   shared_secret_file = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=194819   key_direction = 1
Fri Dec  2 16:32:40 2016 us=194889   ciphername_defined = ENABLED
Fri Dec  2 16:32:40 2016 us=194960   ciphername = 'AES-256-CBC'
Fri Dec  2 16:32:40 2016 us=195028   authname_defined = ENABLED
Fri Dec  2 16:32:40 2016 us=195098   authname = 'SHA256'
Fri Dec  2 16:32:40 2016 us=195166   prng_hash = 'SHA1'
Fri Dec  2 16:32:40 2016 us=195236   prng_nonce_secret_len = 16
Fri Dec  2 16:32:40 2016 us=195305   keysize = 0
Fri Dec  2 16:32:40 2016 us=195375   engine = DISABLED
Fri Dec  2 16:32:40 2016 us=195443   replay = ENABLED
Fri Dec  2 16:32:40 2016 us=195514   mute_replay_warnings = DISABLED
Fri Dec  2 16:32:40 2016 us=195585   replay_window = 64
Fri Dec  2 16:32:40 2016 us=195654   replay_time = 15
Fri Dec  2 16:32:40 2016 us=195724   packet_id_file = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=195792   use_iv = ENABLED
Fri Dec  2 16:32:40 2016 us=195862   test_crypto = DISABLED
Fri Dec  2 16:32:40 2016 us=195954   tls_server = ENABLED
Fri Dec  2 16:32:40 2016 us=196027   tls_client = DISABLED
Fri Dec  2 16:32:40 2016 us=196096   key_method = 2
Fri Dec  2 16:32:40 2016 us=196166   ca_file = '/etc/openvpn/keys/pivpn01_CA.crt'
Fri Dec  2 16:32:40 2016 us=196237   ca_path = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=196304   dh_file = '/etc/openvpn/keys/dh2048.pem'
Fri Dec  2 16:32:40 2016 us=196375   cert_file = '/etc/openvpn/keys/pivpn01_SRV.crt'
Fri Dec  2 16:32:40 2016 us=196444   extra_certs_file = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=196516   priv_key_file = '/etc/openvpn/keys/pivpn01_SRV.pem'
Fri Dec  2 16:32:40 2016 us=196588   pkcs12_file = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=196657   cipher_list = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=196726   tls_verify = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=196794   tls_export_cert = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=196864   verify_x509_type = 0
Fri Dec  2 16:32:40 2016 us=196932   verify_x509_name = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=197002   crl_file = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=197069   ns_cert_type = 0
Fri Dec  2 16:32:40 2016 us=197140   remote_cert_ku[i] = 128
Fri Dec  2 16:32:40 2016 us=197209   remote_cert_ku[i] = 8
Fri Dec  2 16:32:40 2016 us=197278   remote_cert_ku[i] = 136
Fri Dec  2 16:32:40 2016 us=197346   remote_cert_ku[i] = 0
Fri Dec  2 16:32:40 2016 us=197413   remote_cert_ku[i] = 0
Fri Dec  2 16:32:40 2016 us=197482   remote_cert_ku[i] = 0
Fri Dec  2 16:32:40 2016 us=197549   remote_cert_ku[i] = 0
Fri Dec  2 16:32:40 2016 us=197619   remote_cert_ku[i] = 0
Fri Dec  2 16:32:40 2016 us=197687   remote_cert_ku[i] = 0
Fri Dec  2 16:32:40 2016 us=197756   remote_cert_ku[i] = 0
Fri Dec  2 16:32:40 2016 us=197826   remote_cert_ku[i] = 0
Fri Dec  2 16:32:40 2016 us=197894   remote_cert_ku[i] = 0
Fri Dec  2 16:32:40 2016 us=197963   remote_cert_ku[i] = 0
Fri Dec  2 16:32:40 2016 us=198030   remote_cert_ku[i] = 0
Fri Dec  2 16:32:40 2016 us=198099   remote_cert_ku[i] = 0
Fri Dec  2 16:32:40 2016 us=198169   remote_cert_ku[i] = 0
Fri Dec  2 16:32:40 2016 us=198244   remote_cert_eku = 'TLS Web Client Authentication'
Fri Dec  2 16:32:40 2016 us=198320   ssl_flags = 192
Fri Dec  2 16:32:40 2016 us=198395   tls_timeout = 2
Fri Dec  2 16:32:40 2016 us=198470   renegotiate_bytes = 0
Fri Dec  2 16:32:40 2016 us=198548   renegotiate_packets = 0
Fri Dec  2 16:32:40 2016 us=198629   renegotiate_seconds = 3600
Fri Dec  2 16:32:40 2016 us=198707   handshake_window = 60
Fri Dec  2 16:32:40 2016 us=198778   transition_window = 3600
Fri Dec  2 16:32:40 2016 us=198850   single_session = DISABLED
Fri Dec  2 16:32:40 2016 us=198921   push_peer_info = DISABLED
Fri Dec  2 16:32:40 2016 us=198993   tls_exit = DISABLED
Fri Dec  2 16:32:40 2016 us=199066   tls_auth_file = '/etc/openvpn/keys/ta.key'
Fri Dec  2 16:32:40 2016 us=199144   pkcs11_protected_authentication = DISABLED
Fri Dec  2 16:32:40 2016 us=199216   pkcs11_protected_authentication = DISABLED
Fri Dec  2 16:32:40 2016 us=199285   pkcs11_protected_authentication = DISABLED
Fri Dec  2 16:32:40 2016 us=199356   pkcs11_protected_authentication = DISABLED
Fri Dec  2 16:32:40 2016 us=199426   pkcs11_protected_authentication = DISABLED
Fri Dec  2 16:32:40 2016 us=199498   pkcs11_protected_authentication = DISABLED
Fri Dec  2 16:32:40 2016 us=199568   pkcs11_protected_authentication = DISABLED
Fri Dec  2 16:32:40 2016 us=199641   pkcs11_protected_authentication = DISABLED
Fri Dec  2 16:32:40 2016 us=199712   pkcs11_protected_authentication = DISABLED
Fri Dec  2 16:32:40 2016 us=199782   pkcs11_protected_authentication = DISABLED
Fri Dec  2 16:32:40 2016 us=199852   pkcs11_protected_authentication = DISABLED
Fri Dec  2 16:32:40 2016 us=199921   pkcs11_protected_authentication = DISABLED
Fri Dec  2 16:32:40 2016 us=199993   pkcs11_protected_authentication = DISABLED
Fri Dec  2 16:32:40 2016 us=200063   pkcs11_protected_authentication = DISABLED
Fri Dec  2 16:32:40 2016 us=200134   pkcs11_protected_authentication = DISABLED
Fri Dec  2 16:32:40 2016 us=200205   pkcs11_protected_authentication = DISABLED
Fri Dec  2 16:32:40 2016 us=200301   pkcs11_private_mode = 00000000
Fri Dec  2 16:32:40 2016 us=200379   pkcs11_private_mode = 00000000
Fri Dec  2 16:32:40 2016 us=200451   pkcs11_private_mode = 00000000
Fri Dec  2 16:32:40 2016 us=200523   pkcs11_private_mode = 00000000
Fri Dec  2 16:32:40 2016 us=200597   pkcs11_private_mode = 00000000
Fri Dec  2 16:32:40 2016 us=200669   pkcs11_private_mode = 00000000
Fri Dec  2 16:32:40 2016 us=200741   pkcs11_private_mode = 00000000
Fri Dec  2 16:32:40 2016 us=200812   pkcs11_private_mode = 00000000
Fri Dec  2 16:32:40 2016 us=200884   pkcs11_private_mode = 00000000
Fri Dec  2 16:32:40 2016 us=200954   pkcs11_private_mode = 00000000
Fri Dec  2 16:32:40 2016 us=201024   pkcs11_private_mode = 00000000
Fri Dec  2 16:32:40 2016 us=201095   pkcs11_private_mode = 00000000
Fri Dec  2 16:32:40 2016 us=201164   pkcs11_private_mode = 00000000
Fri Dec  2 16:32:40 2016 us=201235   pkcs11_private_mode = 00000000
Fri Dec  2 16:32:40 2016 us=201305   pkcs11_private_mode = 00000000
Fri Dec  2 16:32:40 2016 us=201375   pkcs11_private_mode = 00000000
Fri Dec  2 16:32:40 2016 us=201443   pkcs11_cert_private = DISABLED
Fri Dec  2 16:32:40 2016 us=201513   pkcs11_cert_private = DISABLED
Fri Dec  2 16:32:40 2016 us=201583   pkcs11_cert_private = DISABLED
Fri Dec  2 16:32:40 2016 us=201652   pkcs11_cert_private = DISABLED
Fri Dec  2 16:32:40 2016 us=201723   pkcs11_cert_private = DISABLED
Fri Dec  2 16:32:40 2016 us=201791   pkcs11_cert_private = DISABLED
Fri Dec  2 16:32:40 2016 us=201862   pkcs11_cert_private = DISABLED
Fri Dec  2 16:32:40 2016 us=201932   pkcs11_cert_private = DISABLED
Fri Dec  2 16:32:40 2016 us=202002   pkcs11_cert_private = DISABLED
Fri Dec  2 16:32:40 2016 us=202069   pkcs11_cert_private = DISABLED
Fri Dec  2 16:32:40 2016 us=202138   pkcs11_cert_private = DISABLED
Fri Dec  2 16:32:40 2016 us=202208   pkcs11_cert_private = DISABLED
Fri Dec  2 16:32:40 2016 us=202276   pkcs11_cert_private = DISABLED
Fri Dec  2 16:32:40 2016 us=202345   pkcs11_cert_private = DISABLED
Fri Dec  2 16:32:40 2016 us=202414   pkcs11_cert_private = DISABLED
Fri Dec  2 16:32:40 2016 us=202485   pkcs11_cert_private = DISABLED
Fri Dec  2 16:32:40 2016 us=202554   pkcs11_pin_cache_period = -1
Fri Dec  2 16:32:40 2016 us=202624   pkcs11_id = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=202776   pkcs11_id_management = DISABLED
Fri Dec  2 16:32:40 2016 us=202895   server_network = 10.8.0.0
Fri Dec  2 16:32:40 2016 us=202982   server_netmask = 255.255.255.0
Fri Dec  2 16:32:40 2016 us=203060   server_network_ipv6 = ::
Fri Dec  2 16:32:40 2016 us=203134   server_netbits_ipv6 = 0
Fri Dec  2 16:32:40 2016 us=203213   server_bridge_ip = 0.0.0.0
Fri Dec  2 16:32:40 2016 us=203292   server_bridge_netmask = 0.0.0.0
Fri Dec  2 16:32:40 2016 us=203373   server_bridge_pool_start = 0.0.0.0
Fri Dec  2 16:32:40 2016 us=203467   server_bridge_pool_end = 0.0.0.0
Fri Dec  2 16:32:40 2016 us=203541   push_entry = 'route 10.8.0.0 255.255.255.0'
Fri Dec  2 16:32:40 2016 us=203613   push_entry = 'route 192.168.10.0 255.255.255.0'
Fri Dec  2 16:32:40 2016 us=203682   push_entry = 'redirect-gateway def1'
Fri Dec  2 16:32:40 2016 us=203752   push_entry = 'dhcp-option DNS 192.168.10.10'
Fri Dec  2 16:32:40 2016 us=203821   push_entry = 'sndbuf 393216'
Fri Dec  2 16:32:40 2016 us=203892   push_entry = 'rcvbuf 393216'
Fri Dec  2 16:32:40 2016 us=203963   push_entry = 'route-gateway 10.8.0.1'
Fri Dec  2 16:32:40 2016 us=204032   push_entry = 'topology subnet'
Fri Dec  2 16:32:40 2016 us=204102   push_entry = 'ping 10'
Fri Dec  2 16:32:40 2016 us=204169   push_entry = 'ping-restart 120'
Fri Dec  2 16:32:40 2016 us=204239   ifconfig_pool_defined = ENABLED
Fri Dec  2 16:32:40 2016 us=204318   ifconfig_pool_start = 10.8.0.2
Fri Dec  2 16:32:40 2016 us=204398   ifconfig_pool_end = 10.8.0.253
Fri Dec  2 16:32:40 2016 us=204478   ifconfig_pool_netmask = 255.255.255.0
Fri Dec  2 16:32:40 2016 us=204548   ifconfig_pool_persist_filename = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=204619   ifconfig_pool_persist_refresh_freq = 600
Fri Dec  2 16:32:40 2016 us=204709   ifconfig_ipv6_pool_defined = DISABLED
Fri Dec  2 16:32:40 2016 us=204788   ifconfig_ipv6_pool_base = ::
Fri Dec  2 16:32:40 2016 us=204860   ifconfig_ipv6_pool_netbits = 0
Fri Dec  2 16:32:40 2016 us=204929   n_bcast_buf = 256
Fri Dec  2 16:32:40 2016 us=204998   tcp_queue_limit = 64
Fri Dec  2 16:32:40 2016 us=205065   real_hash_size = 256
Fri Dec  2 16:32:40 2016 us=205135   virtual_hash_size = 256
Fri Dec  2 16:32:40 2016 us=205206   client_connect_script = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=205276   learn_address_script = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=205346   client_disconnect_script = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=205416   client_config_dir = '/etc/openvpn/ccd'
Fri Dec  2 16:32:40 2016 us=205486   ccd_exclusive = DISABLED
Fri Dec  2 16:32:40 2016 us=205554   tmp_dir = '/tmp'
Fri Dec  2 16:32:40 2016 us=205624   push_ifconfig_defined = DISABLED
Fri Dec  2 16:32:40 2016 us=205704   push_ifconfig_local = 0.0.0.0
Fri Dec  2 16:32:40 2016 us=205781   push_ifconfig_remote_netmask = 0.0.0.0
Fri Dec  2 16:32:40 2016 us=205852   push_ifconfig_ipv6_defined = DISABLED
Fri Dec  2 16:32:40 2016 us=205928   push_ifconfig_ipv6_local = ::/0
Fri Dec  2 16:32:40 2016 us=206006   push_ifconfig_ipv6_remote = ::
Fri Dec  2 16:32:40 2016 us=206075   enable_c2c = DISABLED
Fri Dec  2 16:32:40 2016 us=206142   duplicate_cn = DISABLED
Fri Dec  2 16:32:40 2016 us=206209   cf_max = 0
Fri Dec  2 16:32:40 2016 us=206276   cf_per = 0
Fri Dec  2 16:32:40 2016 us=206344   max_clients = 1024
Fri Dec  2 16:32:40 2016 us=206411   max_routes_per_client = 256
Fri Dec  2 16:32:40 2016 us=206481   auth_user_pass_verify_script = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=206550   auth_user_pass_verify_script_via_file = DISABLED
Fri Dec  2 16:32:40 2016 us=206621   port_share_host = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=206688   port_share_port = 0
Fri Dec  2 16:32:40 2016 us=206755   client = DISABLED
Fri Dec  2 16:32:40 2016 us=206822   pull = DISABLED
Fri Dec  2 16:32:40 2016 us=206891   auth_user_pass_file = '[UNDEF]'
Fri Dec  2 16:32:40 2016 us=206970 OpenVPN 2.3.11 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on May 23 2016
Fri Dec  2 16:32:40 2016 us=207098 library versions: OpenSSL 1.0.2j  26 Sep 2016, LZO 2.08
Fri Dec  2 16:32:40 2016 us=213388 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Fri Dec  2 16:32:40 2016 us=216238 Diffie-Hellman initialized with 2048 bit key
Fri Dec  2 16:32:40 2016 us=220409 Control Channel Authentication: using '/etc/openvpn/keys/ta.key' as a OpenVPN static key file
Fri Dec  2 16:32:40 2016 us=220560 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Dec  2 16:32:40 2016 us=220633 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Dec  2 16:32:40 2016 us=220702 TLS-Auth MTU parms [ L:1570 D:1172 EF:78 EB:0 ET:0 EL:3 ]
Fri Dec  2 16:32:40 2016 us=220792 Socket Buffers: R=[163840->327680] S=[163840->327680]
Fri Dec  2 16:32:40 2016 us=221387 ROUTE_GATEWAY 192.168.10.10/255.255.255.0 IFACE=eth0 HWADDR=b8:27:eb:16:20:11
Fri Dec  2 16:32:40 2016 us=222484 TUN/TAP device tun0 opened
Fri Dec  2 16:32:40 2016 us=222614 TUN/TAP TX queue length set to 100
Fri Dec  2 16:32:40 2016 us=222805 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Dec  2 16:32:40 2016 us=222950 /sbin/ip link set dev tun0 up mtu 1500
Fri Dec  2 16:32:40 2016 us=228833 /sbin/ip addr add dev tun0 10.8.0.1/24 broadcast 10.8.0.255
Fri Dec  2 16:32:40 2016 us=234785 /etc/openvpn/script/up.sh tun0 1500 1570 10.8.0.1 255.255.255.0 init
Fri Dec  2 16:32:40 2016 us=246618 /sbin/ip route add 192.168.10.0/24 via 192.168.10.10

[b]RTNETLINK answers: Network is unreachable[/b]
Fri Dec  2 16:32:40 2016 us=251175 ERROR: Linux route add command failed: external program exited with error status: 2

Fri Dec  2 16:32:40 2016 us=251365 /sbin/ip route add 192.168.20.0/24 via 10.8.0.1
Fri Dec  2 16:32:40 2016 us=255838 Data Channel MTU parms [ L:1570 D:1450 EF:70 EB:143 ET:0 EL:3 AF:3/1 ]
Fri Dec  2 16:32:40 2016 us=255988 UDPv4 link local (bound): [AF_INET]192.168.10.19:1194
Fri Dec  2 16:32:40 2016 us=256038 UDPv4 link remote: [undef]
Fri Dec  2 16:32:40 2016 us=256098 MULTI: multi_init called, r=256 v=256
Fri Dec  2 16:32:40 2016 us=256239 IFCONFIG POOL: base=10.8.0.2 size=252, ipv6=0
Fri Dec  2 16:32:40 2016 us=256405 Initialization Sequence Completed

Fri Dec  2 16:33:20 2016 us=194279 MULTI: multi_create_instance called
Fri Dec  2 16:33:20 2016 us=194613 xx.xx.xx.xx:41683 Re-using SSL/TLS context
Fri Dec  2 16:33:20 2016 us=194835 xx.xx.xx.xx:41683 LZO compression initialized
Fri Dec  2 16:33:20 2016 us=195426 xx.xx.xx.xx:41683 Control Channel MTU parms [ L:1570 D:1172 EF:78 EB:0 ET:0 EL:3 ]
Fri Dec  2 16:33:20 2016 us=195545 xx.xx.xx.xx:41683 Data Channel MTU parms [ L:1570 D:1450 EF:70 EB:143 ET:0 EL:3 AF:3/1 ]
Fri Dec  2 16:33:20 2016 us=195751 xx.xx.xx.xx:41683 Local Options String: 'V4,dev-type tun,link-mtu 1570,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher AES-256-CBC,auth SHA256,keysize 256,tls-auth,key-method 2,tls-server'
Fri Dec  2 16:33:20 2016 us=195822 xx.xx.xx.xx:41683 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1570,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-256-CBC,auth SHA256,keysize 256,tls-auth,key-method 2,tls-client'
Fri Dec  2 16:33:20 2016 us=195997 xx.xx.xx.xx:41683 Local Options hash (VER=V4): 'xxxxxxxx'
Fri Dec  2 16:33:20 2016 us=196124 xx.xx.xx.xx:41683 Expected Remote Options hash (VER=V4): 'xxxxxxxx'
Fri Dec  2 16:33:20 2016 us=196333 xx.xx.xx.xx:41683 TLS: Initial packet from [AF_INET]xx.xx.xx.xx:41683, sid=xxxxxxxx xxxxxxxx
Fri Dec  2 16:33:22 2016 us=364169 xx.xx.xx.xx:41683 VERIFY OK: depth=1, C=xx, ST=xx, L=xx, CN=pivpn01_CA, emailAddress=xxx@xxx.xxx
Fri Dec  2 16:33:22 2016 us=366050 xx.xx.xx.xx:41683 Validating certificate key usage
Fri Dec  2 16:33:22 2016 us=366107 xx.xx.xx.xx:41683 ++ Certificate has key usage  0088, expects 0080
Fri Dec  2 16:33:22 2016 us=366148 xx.xx.xx.xx:41683 ++ Certificate has key usage  0088, expects 0008
Fri Dec  2 16:33:22 2016 us=366186 xx.xx.xx.xx:41683 ++ Certificate has key usage  0088, expects 0088
Fri Dec  2 16:33:22 2016 us=366224 xx.xx.xx.xx:41683 VERIFY KU OK
Fri Dec  2 16:33:22 2016 us=366276 xx.xx.xx.xx:41683 Validating certificate extended key usage
Fri Dec  2 16:33:22 2016 us=366323 xx.xx.xx.xx:41683 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
Fri Dec  2 16:33:22 2016 us=366363 xx.xx.xx.xx:41683 VERIFY EKU OK
Fri Dec  2 16:33:22 2016 us=366401 xx.xx.xx.xx:41683 VERIFY OK: depth=0, C=xx, ST=xxxx, L=xxxxxx, CN=dm8000, emailAddress=xxx@xxx.xxx
Fri Dec  2 16:33:22 2016 us=608078 xx.xx.xx.xx:41683 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Dec  2 16:33:22 2016 us=608189 xx.xx.xx.xx:41683 Data Channel Encrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Dec  2 16:33:22 2016 us=608250 xx.xx.xx.xx:41683 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Dec  2 16:33:22 2016 us=608307 xx.xx.xx.xx:41683 Data Channel Decrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Dec  2 16:33:22 2016 us=654159 xx.xx.xx.xx:41683 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Fri Dec  2 16:33:22 2016 us=654269 xx.xx.xx.xx:41683 [dm8000] Peer Connection Initiated with [AF_INET]xx.xx.xx.xx:41683
Fri Dec  2 16:33:22 2016 us=654428 dm8000/xx.xx.xx.xx:41683 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/dm8000
Fri Dec  2 16:33:22 2016 us=654867 dm8000/xx.xx.xx.xx:41683 MULTI: Learn: 10.8.0.2 -> dm8000/xx.xx.xx.xx:41683
Fri Dec  2 16:33:22 2016 us=654931 dm8000/xx.xx.xx.xx:41683 MULTI: primary virtual IP for dm8000/xx.xx.xx.xx:41683: 10.8.0.2
Fri Dec  2 16:33:22 2016 us=654989 dm8000/xx.xx.xx.xx:41683 MULTI: internal route 192.168.20.0/24 -> dm8000/xx.xx.xx.xx:41683
Fri Dec  2 16:33:22 2016 us=655070 dm8000/xx.xx.xx.xx:41683 MULTI: Learn: 192.168.20.0/24 -> dm8000/xx.xx.xx.xx:41683
Fri Dec  2 16:33:25 2016 us=25137 dm8000/xx.xx.xx.xx:41683 PUSH: Received control message: 'PUSH_REQUEST'
Fri Dec  2 16:33:25 2016 us=25263 dm8000/xx.xx.xx.xx:41683 send_push_reply(): safe_cap=940
Fri Dec  2 16:33:25 2016 us=25762 dm8000/xx.xx.xx.xx:41683 SENT CONTROL [dm8000]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,route 192.168.10.0 255.255.255.0,redirect-gateway def1,dhcp-option DNS 192.168.10.10,sndbuf 393216,rcvbuf 393216,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0' (status=1)
Fri Dec  2 16:33:47 2016 us=105240 MULTI: Learn: 192.168.20.11 -> dm8000/xx.xx.xx.xx:41683[/oconf]

Not yet seen the RTNETLINK error, looks like it has no connectivity to it`s own LAN or something.

TinCanTech

Pippin wroteServer and client both have "ip_forward 1" and masquerade rule

and without the client side masquerade ?

Pippin

Hi,

From trying and testing some more errors showed up.
He is setting up everything fresh and tonight I'm granted ssh access.

Hope I can get this to work as intended.
I`ll post back here with the result.

Thanks for help so far.

Pippin

TinCanTech wroteand without the client side masquerade ?

Thanks, tried that but made no difference.
No routes on router(s), so we masquerade.

TinCanTech

Pippin wroteServer config:
route 192.168.10.0 255.255.255.0 192.168.10.10

This is wrong, as in your network:

Pippin wroteServer LAN: 192.168.10.0/24
Gateway: 192.168.10.10
Server IP: 192.168.10.19 (10.8.0.1)

and your log:

Pippin wroteFri Dec 2 16:32:40 2016 us=246618 /sbin/ip route add 192.168.10.0/24 via 192.168.10.10

RTNETLINK answers: Network is unreachable
Fri Dec 2 16:32:40 2016 us=251175 ERROR: Linux route add command failed: external program exited with error status: 2

https://openvpn.net/index.php/open-source/documentation/howto.html#scope

Pippin

Really?
Hmm.. I think we tried with removing that gateway because in my setup I don`t have it there too, it`s automatic.
But then he lost all connection....I'm thinking if that was 2.3.4 with the topology issue, ticket 55.
Could also be that overview was lost trying to make it work though but there was also a problem with modules not getting loaded.

Anyway will try it again with below current config which is working until we ping from the server side LAN host that doesn`t get back the ping reply getting stuck on the server.
B.t.w., I was writing this then saw you posted.

Current setup:
Server LAN: 192.168.10.0/24
Gateway: 192.168.10.10
Server IP: 192.168.10.19 (10.8.0.1)
LAN host IP: 192.168.10.11

VPN: 10.8.0.0/24

Client LAN: 192.168.20.0/24 (10.8.0.2)
Gateway: 192.168.20.10
Client IP: 192.168.20.11

Server and client are both behind NAT
Server and client both have ip_forward 1 and masquerade rule -t nat -A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE
Firewalls have policy ACCEPT with no rules.

From server/client ping works everywhere, inluding to the client/server side LAN, great, we had that before too.

Then, on server side LAN host 192.168.10.11, route add -net 192.168.20.0 netmask 255.255.255.0 gw 192.168.10.19
According to tcpdump, ping from 192.168.10.11 to 192.168.20.0/24, the reply unfortunetly still gets stuck on server.
So i didn`t get any further...

Current config: dev tun
local 192.168.10.19
proto udp
port 1194
persist-key
persist-tun
keepalive 10 120
server 10.8.0.0 255.255.255.0
topology subnet
route 192.168.10.0 255.255.255.0 192.168.10.10
route 192.168.20.0 255.255.255.0 10.8.0.2
push "route 10.8.0.0 255.255.255.0"
push "route 192.168.10.0 255.255.255.0"
push "redirect-gateway def1"
push "dhcp-option DNS 192.168.10.10"
script-security 2
up /etc/openvpn/script/up.sh #set ip_forward and masquerade
down /etc/openvpn/script/down.sh #unset ip_forward and masquerade
client-config-dir /etc/openvpn/ccd ifconfig-push 10.8.0.2 255.255.255.0
iroute 192.168.20.0 255.255.255.0 10.8.0.2 Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.10.10 0.0.0.0 UG 202 0 0 eth0
10.8.0.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0
192.168.10.0 192.168.10.10 255.255.255.0 UG 0 0 0 eth0
192.168.10.0 0.0.0.0 255.255.255.0 U 202 0 0 eth0
192.168.20.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0 Client 192.168.20.11 is pulling. Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 10.8.0.1 128.0.0.0 UG 0 0 0 tun0
0.0.0.0 192.168.20.10 0.0.0.0 UG 0 0 0 eth0
10.8.0.0 10.8.0.1 255.255.255.0 UG 0 0 0 tun0
10.8.0.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0
128.0.0.0 10.8.0.1 128.0.0.0 UG 0 0 0 tun0
xxx.xxx.xx.xxx 192.168.20.10 255.255.255.255 UGH 0 0 0 eth0
192.168.10.0 10.8.0.1 255.255.255.0 UG 0 0 0 tun0
192.168.20.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 Server side LAN host 192.168.10.11 Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.10.10 0.0.0.0 UG 0 0 0 eth0
192.168.10.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
192.168.20.0 192.168.10.19 255.255.255.0 UG 0 0 0 eth0 So, next thing is to remove those gateway`s from the route directive and test again.

Thanks.

TinCanTech

Pippin wroteserver.conf
dev tun
local 192.168.10.19
<..>
server 10.8.0.0 255.255.255.0
topology subnet
Note 1: route 192.168.10.0 255.255.255.0 192.168.10.10
Note 2: route 192.168.20.0 255.255.255.0 10.8.0.2
Note 3: push "route 10.8.0.0 255.255.255.0"
push "route 192.168.10.0 255.255.255.0"
Note 4: push "redirect-gateway def1"

These are wrong:

Note 1: Remove the gateway parameter.
Note 2: Remove the gateway parameter.
Note 3: This entire line is redundant due to --server
Note 4: Remove this while testing, so as not to over complicate your client routing table.

Pippin wroteccd file
ifconfig-push 10.8.0.2 255.255.255.0
iroute 192.168.20.0 255.255.255.0 10.8.0.2

Remove the gateway parameter.

https://openvpn.net/index.php/open-source/documentation/howto.html#scope

Pippin

Yes, redundant, i know it will be taking care of automatically, at least normally.
Removing it just doesn`t seem to work there, as written he loses all access to the box, incl. ssh.

But again, will try next time I have time enough/access and do it "clean"

Thanks.

TinCanTech

Then check your client log at --verb 4 .. following the PUSH: Received control message:

Pippin

Good news,

Long story short, he started "clean" with the "clean" config.
That made everything work except for one thing.
The server side LAN host 192.168.10.11, could not ping beyond the client.
I then added:
-A POSTROUTING -o eth0 -s 192.168.10.0/24 -j MASQUERADE
on the client and things started to flow 🙂

Thanks for the help offered.
Pippin.