No ping to the client

DrMichael

Hi all,

sorry, if this is a dumb question... I also have searched and googled, but I am stuck...

I used to have a working OpenVPN connection. But now it does not work anymore.

Bottom line: I can pin from the client both the local 10.8.0.10 and the remote 10.8.0.1. But I cannot ping from the server the remote 10.8.0.10.
When pinging from the server (10.8.0.1) to the client (10.8.0.10), tcpdump shows outgoing packets only.

My current config: port 1194
proto udp
dev tun
ca /etc/openvpn/easy-rsa2/keys/ca.crt
cert /etc/openvpn/easy-rsa2/keys/server.crt
key /etc/openvpn/easy-rsa2/keys/server.key # This file should be kept secret
dh /etc/openvpn/easy-rsa2/keys/dh2048.pem
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
duplicate-cn
keepalive 10 120
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log-append openvpn.log
verb 5 client
dev tun
proto udp
remote ??.??.??.?? 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert poco.crt
key poco.key
ns-cert-type server
verb 3 DrMichael

TinCanTech

DrMichael wroteI can pin from the client both the local 10.8.0.10 and the remote 10.8.0.1. But I cannot ping from the server the remote 10.8.0.10

99.99% the client firewall .. what operating system are your server and client ?

DrMichael

Yes, I suspect something wrong with the iptables. What could I post to check?

Server is Ubuntu 16.04, client Windows 10 and Android 7.

TinCanTech

The simplest test is to disable the firewall on the client.

DrMichael

Right. Ping works, when disabling the W10 firewall. I am not sure, how to open now the firewall for OpenVPN...

I finally succeeded to get the VPN network as a private network (although it now shows up twice...) by adding

route-metric 512
route 0.0.0.0 0.0.0.0

to the client config.

But still blocked by the W10 firewall for private networks.

DrMichael

DrMichael

Ok, disabling the firewall brings me to the next issue:

Packets are happily going out from the client through the tunnel into the world, but nothing is coming back...

IP forwarding is on, nat masquerading is set... What would be missing then still?

DrMichael

DrMichael

Ah, masquerading was on the wrong interface.

And it turns out, that firewall can be left on as long as you don't want incoming sessions to the client enabled.

Thanks for helping me thinking! :-)

DrMichael

PS: How can I change the subject of the thread?

TinCanTech

Good work sorting out your configuration 8-)

Unfortunately, due to incessant spamming, once posted, users cannot edit posts.