Can ping only one way in Routed mode (Client to Server)

ryangriggs

Hi, I have two DD-WRT routers running OpenVPN, creating a routed VPN tunnel between them.

When the tunnel is established, I can ping from the client to the server, and also from the client to other PCs inside the server's LAN that I have specifically set up using routing, in the server's config file:

push "route [server ip address] 255.255.255.255"
push "route [PC on server's LAN] 255.255.255.255"

However, I can't ping from the server to the client, although I specifically added a route in the server's config file for the client:
route [LAN IP of client] 255.255.255.255

I made sure to add iptables rules for FORWARD chain on both client and server:
iptables -A FORWARD -i tun+ -j ACCEPT
iptables -A FORWARD -o tun+ -j ACCEPT

Routing table confirms that the routes are added on both sides.

The firewall log does not show dropped packets when I attempt this, but the OpenVPN log shows Ww/Rr characters for both the client and server, indicating the packets are crossing the tunnel.

Any help appreciated!

TiTex

Most likely a firewall rule is blocking icmp traffic

TinCanTech

ryangriggs wrotepush "route [server ip address] 255.255.255.255"
push "route [PC on server's LAN] 255.255.255.255"

Does this have anything to do with this ?

ryangriggs

TinCanTech wrote
ryangriggs wrotepush "route [server ip address] 255.255.255.255"
push "route [PC on server's LAN] 255.255.255.255"
Does this have anything to do with this ?

Yep, I set up a routed VPN to prevent broadcast/multicast traffic across the VPN tunnel.
One side has many systems with addresses 192.168.100.x, and has the DD-WRT OpenVPN server router at address 192.168.100.13. Also has a system, 192.168.100.241, that we want to talk to, from the client side.

The other side has two addresses we need to talk to: a PLC at 192.168.100.33 and the DD-WRT router at 192.168.100.37.

I set up the VPN route as shown:
push "route 192.168.100.13 255.255.255.255"
push "route 192.168.100.241 255.255.255.255"
route 192.168.100.37 255.255.255.255

So, with these routes, if I log into the OpenVPN client DD-WRT router and ping the computer at 192.168.100.241, I get responses.
But if I try to ping to the client router from the server router (ping 192.168.100.37), I get no response.

Traceroute from client to server works fine, traceroute from server to client times out.

It appears to be a routing issue, and it appears the traffic is not crossing the tunnel, because there are no "W" and "R" characters being generated in the openvpn live log output as I attempt these pings.

Route table from client:
default 192.168.10.1 0.0.0.0 UG 0 0 0 vlan2
127.0.0.0 * 255.0.0.0 U 0 0 0 lo
169.254.0.0 * 255.255.0.0 U 0 0 0 br0
192.168.10.0 * 255.255.255.0 U 0 0 0 vlan2
192.168.66.1 192.168.66.5 255.255.255.255 UGH 0 0 0 tun0
192.168.66.5 * 255.255.255.255 UH 0 0 0 tun0
192.168.100.0 * 255.255.255.0 U 0 0 0 br0
192.168.100.13 192.168.66.5 255.255.255.255 UGH 0 0 0 tun0
192.168.100.241 192.168.66.5 255.255.255.255 UGH 0 0 0 tun0

Route table from server:
default 192.168.1.1 0.0.0.0 UG 0 0 0 vlan2
127.0.0.0 * 255.0.0.0 U 0 0 0 lo
169.254.0.0 * 255.255.0.0 U 0 0 0 br0
192.168.1.0 * 255.255.255.0 U 0 0 0 vlan2
192.168.66.0 192.168.66.2 255.255.255.0 UG 0 0 0 tun0
192.168.66.2 * 255.255.255.255 UH 0 0 0 tun0
192.168.100.0 * 255.255.255.0 U 0 0 0 br0
192.168.100.37 192.168.66.2 255.255.255.255 UGH 0 0 0 tun0

As you can see, both sides have the correct routes (vpn internal tunnel IP scheme is 192.168.66.x)

It would seem this is entirely possible using single-ip address routes (i.e. /32 or subnet mask 255.255.255.255), so why would it work from the client but not the server side?

Thanks

ryangriggs

I tried changing the subnet on one side of the connection to 192.168.101.x and I still can't ping from the server side. So it seems to have nothing to do with the subnets, but instead maybe a firewall issue...
Any suggestions?

Thanks!