So I'm trying to figure out why my openvpn server isn't forwarding client network traffic routed over the VPN. Basically my config is like this:
Client Network ----> DD-WRT ----------------------> Server -------------------> Internet
172.16.2.0/24 OpenVPN 2.4 OpenVPN 2.3.14
10.8.0.6 10.8.0.1
wap.synfin.net vpn.synfin.net
When I have the DD-WRT NAT my 172.16.2.0/24 traffic to 10.8.0.6, the server _WILL_ route the traffic to the internet just fine, but I'd rather not double NAT. But without that extra NAT, the server seems to silently drop the traffic on the floor (tcpdump on eth0 doesn't show the traffic). I've confirmed in both cases via tcpdump -i tun0 on the server that traffic is being sent over the VPN/PtP and I've bumped the logging level on the server to 6 and don't see any errors.
Server config:
auth sha256
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/vpn.synfin.net.crt
cipher AES-128-CBC # AES
client-config-dir /etc/openvpn/ccd
comp-lzo yes
dev tun
dh dh2048.pem
group nogroup
ifconfig-pool-persist ipp.txt
keepalive 10 120
key /etc/openvpn/easy-rsa/keys/vpn.synfin.net.key
local 45.79.73.39
log-append /var/log/openvpn.log
max-clients 10
mode server
persist-key
persist-tun
port 1194
proto udp
push "dhcp-option DNS 208.67.220.220"
push "dhcp-option DNS 208.67.222.222"
route-up /etc/openvpn/masq.sh
server 10.8.0.0 255.255.255.0
status openvpn-status.log
tls-auth myvpn.tlsauth 0 # This file is secret
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-128-CBC-SHA256
tls-server
tun-mtu 1400
user nobody
verb 6
Contents of /etc/openvpn/masq.sh:
#!/bin/bash
# This script sets up the firewall to forward traffic from over the VPN
iptables -I FORWARD -i tun0 -o eth0 -m conntrack --ctstate NEW -s 172.16.2.0/24 -j ACCEPT
iptables -I FORWARD -i tun0 -o eth0 -m conntrack --ctstate NEW -s 10.8.0.0/24 -j ACCEPT
iptables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE
Contents of /etc/openvpn/ccd/wap.synfin,net:
iroute 172.16.2.0 255.255.255.0
client/DD-WRT config:
ca /tmp/openvpncl/ca.crt
cert /tmp/openvpncl/client.crt
key /tmp/openvpncl/client.key
management 127.0.0.1 16
management-log-cache 100
verb 3
mute 3
syslog
writepid /var/run/openvpncl.pid
client
resolv-retry infinite
nobind
persist-key
persist-tun
script-security 2
dev tun1
proto udp4
cipher aes-128-cbc
auth sha256
remote vpn.synfin.net 1194
comp-lzo yes
redirect-private def1
route-noexec
tls-client
tun-mtu 1400
mtu-disc yes
fast-io
tls-auth /tmp/openvpncl/ta.key 1
tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA256
Logs which I think show it should be working:
Sat Apr 1 16:36:36 2017 us=111267 24.4.200.53:53714 [wap.synfin.net] Peer Connection Initiated with [AF_INET]24.4.200.53:53714
Sat Apr 1 16:36:36 2017 us=111346 wap.synfin.net/24.4.200.53:53714 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/wap.synfin.net
Sat Apr 1 16:36:36 2017 us=111460 wap.synfin.net/24.4.200.53:53714 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Sat Apr 1 16:36:36 2017 us=111528 wap.synfin.net/24.4.200.53:53714 MULTI: Learn: 10.8.0.6 -> wap.synfin.net/24.4.200.53:53714
Sat Apr 1 16:36:36 2017 us=111559 wap.synfin.net/24.4.200.53:53714 MULTI: primary virtual IP for wap.synfin.net/24.4.200.53:53714: 10.8.0.6
Sat Apr 1 16:36:36 2017 us=111595 wap.synfin.net/24.4.200.53:53714 MULTI: internal route 172.16.2.0/24 -> wap.synfin.net/24.4.200.53:53714
Sat Apr 1 16:36:36 2017 us=111636 wap.synfin.net/24.4.200.53:53714 MULTI: Learn: 172.16.2.0/24 -> wap.synfin.net/24.4.200.53:53714
Sat Apr 1 16:36:37 2017 us=292190 wap.synfin.net/24.4.200.53:53714 UDPv4 READ [123] from [AF_INET]24.4.200.53:53714: P_CONTROL_V1 kid=0 pid=[ #13 ] [ ] pid=7 DATA len=69
Sat Apr 1 16:36:37 2017 us=292416 wap.synfin.net/24.4.200.53:53714 PUSH: Received control message: 'PUSH_REQUEST'
Sat Apr 1 16:36:37 2017 us=292462 wap.synfin.net/24.4.200.53:53714 send_push_reply(): safe_cap=940
Sat Apr 1 16:36:37 2017 us=292522 wap.synfin.net/24.4.200.53:53714 SENT CONTROL [wap.synfin.net]: 'PUSH_REPLY,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Sat Apr 1 16:36:37 2017 us=292573 wap.synfin.net/24.4.200.53:53714 UDPv4 WRITE [62] to [AF_INET]24.4.200.53:53714: P_ACK_V1 kid=0 pid=[ #11 ] [ 7 ]
Sat Apr 1 16:36:37 2017 us=292662 wap.synfin.net/24.4.200.53:53714 UDPv4 WRITE [267] to [AF_INET]24.4.200.53:53714: P_CONTROL_V1 kid=0 pid=[ #12 ] [ ] pid=7 DATA len=213
Sat Apr 1 16:36:37 2017 us=383429 wap.synfin.net/24.4.200.53:53714 UDPv4 READ [62] from [AF_INET]24.4.200.53:53714: P_ACK_V1 kid=0 pid=[ #14 ] [ 7 ]
Sat Apr 1 16:36:37 2017 us=778792 wap.synfin.net/24.4.200.53:53714 UDPv4 READ [145] from [AF_INET]24.4.200.53:53714: P_DATA_V1 kid=0 DATA len=144
Sat Apr 1 16:36:37 2017 us=778952 wap.synfin.net/24.4.200.53:53714 MULTI: Learn: 172.16.2.123 -> wap.synfin.net/24.4.200.53:53714
Sat Apr 1 16:36:37 2017 us=779025 wap.synfin.net/24.4.200.53:53714 TUN WRITE [84]
Sat Apr 1 16:36:38 2017 us=663385 wap.synfin.net/24.4.200.53:53714 UDPv4 READ [177] from [AF_INET]24.4.200.53:53714: P_DATA_V1 kid=0 DATA len=176
Sat Apr 1 16:36:38 2017 us=663791 wap.synfin.net/24.4.200.53:53714 MULTI: Learn: 172.16.2.1 -> wap.synfin.net/24.4.200.53:53714
Sat Apr 1 16:36:38 2017 us=663937 wap.synfin.net/24.4.200.53:53714 TUN WRITE [116]
Sat Apr 1 16:36:38 2017 us=669501 wap.synfin.net/24.4.200.53:53714 UDPv4 READ [241] from [AF_INET]24.4.200.53:53714: P_DATA_V1 kid=0 DATA len=240
Sat Apr 1 16:36:38 2017 us=669657 wap.synfin.net/24.4.200.53:53714 TUN WRITE [185]
Sat Apr 1 16:36:38 2017 us=785432 wap.synfin.net/24.4.200.53:53714 UDPv4 READ [145] from [AF_INET]24.4.200.53:53714: P_DATA_V1 kid=0 DATA len=144
Sat Apr 1 16:36:38 2017 us=785677 wap.synfin.net/24.4.200.53:53714 TUN WRITE [84]
Sat Apr 1 16:36:38 2017 us=913698 wap.synfin.net/24.4.200.53:53714 UDPv4 READ [113] from [AF_INET]24.4.200.53:53714: P_DATA_V1 kid=0 DATA len=112
Sat Apr 1 16:36:38 2017 us=914166 wap.synfin.net/24.4.200.53:53714 TUN WRITE [58]
Sat Apr 1 16:36:38 2017 us=918296 wap.synfin.net/24.4.200.53:53714 UDPv4 READ [241] from [AF_INET]24.4.200.53:53714: P_DATA_V1 kid=0 DATA len=240
Sat Apr 1 16:36:38 2017 us=918469 wap.synfin.net/24.4.200.53:53714 TUN WRITE [184]
Sat Apr 1 16:36:39 2017 us=618395 wap.synfin.net/24.4.200.53:53714 UDPv4 READ [145] from [AF_INET]24.4.200.53:53714: P_DATA_V1 kid=0 DATA len=144
Sat Apr 1 16:36:39 2017 us=618770 wap.synfin.net/24.4.200.53:53714 TUN WRITE [78]
Sat Apr 1 16:36:39 2017 us=782590 wap.synfin.net/24.4.200.53:53714 UDPv4 READ [145] from [AF_INET]24.4.200.53:53714: P_DATA_V1 kid=0 DATA len=144
Sat Apr 1 16:36:39 2017 us=782955 wap.synfin.net/24.4.200.53:53714 TUN WRITE [84]
Sat Apr 1 16:36:40 2017 us=784461 wap.synfin.net/24.4.200.53:53714 UDPv4 READ [145] from [AF_INET]24.4.200.53:53714: P_DATA_V1 kid=0 DATA len=144
Forwarding table on server:
$ iptables -nvL FORWARD
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- tun0 eth0 172.16.2.0/24 0.0.0.0/0 ctstate NEW
162K 147M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
2348 187K ACCEPT all -- tun0 eth0 10.8.0.0/24 0.0.0.0/0 ctstate NEW
Postrouting table:
$ iptables -nvL POSTROUTING -t nat
Chain POSTROUTING (policy ACCEPT 232 packets, 27003 bytes)
pkts bytes target prot opt in out source destination
630 65989 MASQUERADE all -- * eth0 0.0.0.0/0 0.0.0.0/0
10354 1057K MASQUERADE all -- * eth0 0.0.0.0/0 0.0.0.0/0
Any suggestions/ideas would be appreciated. Thanks!
