Hello, I have a P2P multisite openvpn network and I am very happy with this technology. Currently, We have a linux openvpn server in our central node and an Asus RTN66u router with openvpn client in externals nodes. You can see a network diagram of the openvpn configuration. [img]http://www.burriana.es/openvpnantes.png[/img] The last week, we have updated our internet bandwith (300 MB down 300 MB up) and the Cpu of asus rtn66u is very high and we only have 1,4MB of bandwith. The solution is to split the openvpn client of the external site into a linux virtual machine. You can see an uptated network diagram of the openvpn configuration [img]http://www.burriana.es/openvpndespues.png[/img] The problem is that the ping works well but the other services not. And when I inspect the packets I see the private openvpn ip (192.168.9.6) and not (192.168.23.200), I have tried with assus router mode (with openvpn) and works well. And if I put network gateway 192.168.23.2 (openvpn linux client) on the computer (192.168.23.200) it works well too. But I want to have asus default gateway on the computers of my network. I have configured ip_forwarding = 1 on sysctl. I supossed that the problem is about iptables, but I don't know. Thank you very much for your attention.

[quote="clonic"]Thank you for your response, The routing rule (192.168.9.0/24 gw 192.168.23.2) is included in the rule of assus that I configured previously (192.168.0.0 255.255.0.0 gw 192.168.23.2)[/quote] 192.168.0.0 255.255.0.0 = 192.168.0.0/16 = 192.168.0.0- 192.168.255.255 - i'm sure that this is [b]not [/b]what you want. on your 192.168.23.1 router , add static routes 192.168.9.0[b]/24[/b] gw 192.168.23.2 192.168.0.0[b]/24[/b] gw 192.168.23.2 on 192.168.23.2, make sure ip_forward is enabled [code]sysctl -a | grep ip_forward[/code] if it doesn't work , post your vpn server configs , logs, route tables , firewall (iptables) rules, ifconfig

Router Asus RTN66U Note: If I put the openvpn client configuration inside the router, It works fine. Routing table of Asus RTN66U [code] 192.168.0.0/23 192.168.23.2 192.168.9.0/24 192.168.23.2[/code] I think that the problem is iptables but I can't tell you if is it true Thank you very much for your attention

I have added this iptables rules and now I can connect from my computer (192.168.0.189) to 192.168.23.100 via RDP (3389) [code] sudo iptables -A FORWARD -o tun11 -i eno1 -s 192.168.23.0/24 -m conntrack --ctstate NEW -j ACCEPT sudo iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT sudo iptables -A POSTROUTING -t nat -j MASQUERADE sudo iptables-save | sudo tee /etc/iptables.sav [/code] When I inspect the packet details I see the following. [code]Src IP: 192.168.0.189 Src Port: 63719 Dst IP: 192.168.23.100 Dst Port:3389 Protocol: TCP[/code] But If I connect from remote pc (192.168.23.100) to my computer (192.168.0.189) via RDP (3389). I can't connect it. (If I try the same using openvpn in Asus RTN66U it's work fine). When I inspect the packet details I see the following. [code]Src IP: 192.168.9.18 (Internal Openvpn ip...) Src Port: 59691 Dst IP: 192.168.0.189 Dst Port:3389 Protocol: TCP[/code] Where is the problem? It's possible that do I need another iptable rule to "change" source ip (192.168.9.18) to 192.168.23.100? Thank you very much for your attention

[quote="TiTex"]can you [b]ssh[/b] from 192.168.23.100 to 192.168.0.28 ? what about [b]ssh[/b] from 192.168.0.189 to 192.168.23.2 ? if the answer is yes , check the [b]firewall on your Windows Machines[/b][/quote] you have not posted the 192.168.0.28 vpn config , routing table, ip forwaring information

Problem connecting P2P with a openvpn linux client

clonic

Hello, I have a P2P multisite openvpn network and I am very happy with this technology.

Currently, We have a linux openvpn server in our central node and an Asus RTN66u router with openvpn client in externals nodes.

You can see a network diagram of the openvpn configuration.

The last week, we have updated our internet bandwith (300 MB down 300 MB up) and the Cpu of asus rtn66u is very high and we only have 1,4MB of bandwith. The solution is to split the openvpn client of the external site into a linux virtual machine.

You can see an uptated network diagram of the openvpn configuration

The problem is that the ping works well but the other services not. And when I inspect the packets I see the private openvpn ip (192.168.9.6) and not (192.168.23.200), I have tried with assus router mode (with openvpn) and works well. And if I put network gateway 192.168.23.2 (openvpn linux client) on the computer (192.168.23.200) it works well too. But I want to have asus default gateway on the computers of my network.

I have configured ip_forwarding = 1 on sysctl.

I supossed that the problem is about iptables, but I don't know.

Thank you very much for your attention.

TiTex

on your 192.168.23.1 router , add a static route
network: 192.168.9.0
netmask: 255.255.255.0 (or /24)
via gateway: 192.168.23.2

clonic

Thank you for your response,
The routing rule (192.168.9.0/24 gw 192.168.23.2) is included in the rule of assus that I configured previously (192.168.0.0 255.255.0.0 gw 192.168.23.2)

It not works,

clonic

Thank you for your response,
The routing rule (192.168.9.0/24 gw 192.168.23.2) is included in the rule of assus that I configured previously (192.168.0.0 255.255.0.0 gw 192.168.23.2)

It not works

Traceroute works if I try in 192.168.23.100 to 192.168.0.189

1 192.168.23.1
2 192.168.23.2
3 192.168.9.1
4 192.168.0.189

But If I try in 192.168.0.189 to 192.168.23.100 not works

Traza a la dirección bu157.ayto-burriana.org [192.168.23.100]
sobre un máximo de 30 saltos:

1 1 ms 1 ms 1 ms 192.168.0.17
2 1 ms 1 ms 1 ms 192.168.0.28
3 31 ms 34 ms 35 ms 192.168.9.18
4 * * * Tiempo de espera agotado para esta solicitud.
5 * * * Tiempo de espera agotado para esta solicitud.

TiTex

clonic wroteThank you for your response,
The routing rule (192.168.9.0/24 gw 192.168.23.2) is included in the rule of assus that I configured previously (192.168.0.0 255.255.0.0 gw 192.168.23.2)

192.168.0.0 255.255.0.0 = 192.168.0.0/16 = 192.168.0.0- 192.168.255.255 - i'm sure that this is not what you want.

on your 192.168.23.1 router , add static routes
192.168.9.0/24 gw 192.168.23.2
192.168.0.0/24 gw 192.168.23.2

on 192.168.23.2, make sure ip_forward is enabled

sysctl -a | grep ip_forward

if it doesn't work , post your vpn server configs , logs, route tables , firewall (iptables) rules, ifconfig

clonic

Client

Client config

daemon
client
dev tun11
proto tcp
remote XXXXXXXX 1197
resolv-retry 30
nobind
persist-key
persist-tun
cipher AES-128-CBC
verb 3
<ca>...</ca>
<cert>... </cert>
<key> ... </key>
status-version 2
status status

sysctl

lubuntu@lubuntu:~$ sudo sysctl -a | grep ip_forward

net.ipv4.ip_forward = 1
net.ipv4.ip_forward_use_pmtu = 0
sysctl: reading key "net.ipv6.conf.all.stable_secret"
sysctl: reading key "net.ipv6.conf.default.stable_secret"
sysctl: reading key "net.ipv6.conf.eno1.stable_secret"
sysctl: reading key "net.ipv6.conf.lo.stable_secret"
sysctl: reading key "net.ipv6.conf.wlp2s0.stable_secret"

route -


Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         gateway         0.0.0.0         UG    100    0        0 eno1
192.168.0.0     192.168.9.17    255.255.254.0   UG    0      0        0 tun11
192.168.9.0     192.168.9.17    255.255.255.0   UG    0      0        0 tun11
192.168.9.17    0.0.0.0         255.255.255.255 UH    0      0        0 tun11
192.168.23.0    0.0.0.0         255.255.255.0   U     100    0        0 eno1
lubuntu@lubuntu:~$

iptables

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
lubuntu@lubuntu:~$

log file

Thu Apr 27 05:48:52 2017 OpenVPN 2.4.0 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 10 2017
Thu Apr 27 05:48:52 2017 library versions: OpenSSL 1.0.2g  1 Mar 2016, LZO 2.08
Thu Apr 27 05:48:52 2017 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Thu Apr 27 05:48:52 2017 TCP/UDP: Preserving recently used remote address: [AF_INET]2.XXx.XXX.181:1197
Thu Apr 27 05:48:52 2017 Socket Buffers: R=[87380->87380] S=[16384->16384]
Thu Apr 27 05:48:52 2017 Attempting to establish TCP connection with [AF_INET]2.XXX.XXX.181:1197 [nonblock]
Thu Apr 27 05:48:53 2017 TCP connection established with [AF_INET]2.XXX.201.181:1197
Thu Apr 27 05:48:53 2017 TCP_CLIENT link local: (not bound)
Thu Apr 27 05:48:53 2017 TCP_CLIENT link remote: [AF_INET]2.XXX.201.181:1197
Thu Apr 27 05:48:53 2017 TLS: Initial packet from [AF_INET]2.XXX.201.181:1197, sid=20eb3317 89cbbeb2
Thu Apr 27 05:48:54 2017 VERIFY OK: depth=1, C=ES, ST=CS, L=Burriana, O=Ayto-burriana, emailAddress=alertas@burriana.es
Thu Apr 27 05:48:54 2017 VERIFY OK: depth=0, C=ES, ST=CS, L=Burriana, O=Ayto-burriana, OU=SITIC, CN=ayto-key, emailAddress=alertas@burriana.es
Thu Apr 27 05:48:54 2017 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Thu Apr 27 05:48:54 2017 [ayto-key] Peer Connection Initiated with [AF_INET]2.XXX.201.181:1197
Thu Apr 27 05:48:55 2017 SENT CONTROL [ayto-key]: 'PUSH_REQUEST' (status=1)
Thu Apr 27 05:48:55 2017 PUSH: Received control message: 'PUSH_REPLY,route 192.168.9.0 255.255.255.0,topology net30,ping 10,ping-restart 120,route 192.168.0.0 255.255.254.0 vpn_gateway,ifconfig 192.168.9.18 192.168.9.17'
Thu Apr 27 05:48:55 2017 OPTIONS IMPORT: timers and/or timeouts modified
Thu Apr 27 05:48:55 2017 OPTIONS IMPORT: --ifconfig/up options modified
Thu Apr 27 05:48:55 2017 OPTIONS IMPORT: route options modified
Thu Apr 27 05:48:55 2017 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Thu Apr 27 05:48:55 2017 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Apr 27 05:48:55 2017 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Thu Apr 27 05:48:55 2017 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Apr 27 05:48:55 2017 ROUTE_GATEWAY 192.168.23.1/255.255.255.0 IFACE=eno1 HWADDR=34:e6:d7:05:cc:54
Thu Apr 27 05:48:55 2017 TUN/TAP device tun11 opened
Thu Apr 27 05:48:55 2017 TUN/TAP TX queue length set to 100
Thu Apr 27 05:48:55 2017 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Thu Apr 27 05:48:55 2017 /sbin/ip link set dev tun11 up mtu 1500
Thu Apr 27 05:48:55 2017 /sbin/ip addr add dev tun11 local 192.168.9.18 peer 192.168.9.17
Thu Apr 27 05:48:55 2017 /sbin/ip route add 192.168.9.0/24 via 192.168.9.17
Thu Apr 27 05:48:55 2017 /sbin/ip route add 192.168.0.0/23 via 192.168.9.17
Thu Apr 27 05:48:55 2017 Initialization Sequence Completed

clonic

Router Asus RTN66U

Note: If I put the openvpn client configuration inside the router, It works fine.

Routing table of Asus RTN66U

192.168.0.0/23 192.168.23.2
192.168.9.0/24 192.168.23.2

I think that the problem is iptables but I can't tell you if is it true

Thank you very much for your attention

clonic

I have added this iptables rules and now I can connect from my computer (192.168.0.189) to 192.168.23.100 via RDP (3389)

sudo iptables -A FORWARD -o tun11 -i eno1 -s 192.168.23.0/24 -m conntrack --ctstate NEW -j ACCEPT
sudo iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A POSTROUTING -t nat -j MASQUERADE
sudo iptables-save | sudo tee /etc/iptables.sav

When I inspect the packet details I see the following.

Src IP: 192.168.0.189  
Src Port: 63719
Dst IP: 192.168.23.100
Dst Port:3389
Protocol: TCP

But If I connect from remote pc (192.168.23.100) to my computer (192.168.0.189) via RDP (3389). I can't connect it. (If I try the same using openvpn in Asus RTN66U it's work fine).

When I inspect the packet details I see the following.

Src IP: 192.168.9.18 (Internal Openvpn ip...)  
Src Port: 59691
Dst IP: 192.168.0.189
Dst Port:3389
Protocol: TCP

Where is the problem?
It's possible that do I need another iptable rule to "change" source ip (192.168.9.18) to 192.168.23.100?

Thank you very much for your attention

TiTex

can you ssh from 192.168.23.100 to 192.168.0.28 ?
what about ssh from 192.168.0.189 to 192.168.23.2 ?
if the answer is yes , check the firewall on your Windows Machines

Routing table of Asus RTN66U
192.168.0.0/23 192.168.23.2

that's closer but still a bit off , like you miss on purpose :lol: ( or is your netmask really 255.255.254.0 ?)

you can delete those iptables rules , it doesn't help you.

sudo iptables -A FORWARD -o tun11 -i eno1 -s 192.168.23.0/24 -m conntrack --ctstate NEW -j ACCEPT
sudo iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A POSTROUTING -t nat -j MASQUERADE

clonic

Thank you for the attention Titex.

The problem is that,
- if I use only Asus RTN66u (192.168.23.1) with openvpn client, it works fine (I can connect via rdp for example)
- if I change default gateway in my remote computer (192.168.23.1 to 192.168.23.2 openvpn linux client), it works fine (I can connect via rdp for example)

I think that there are anything that I need to change into openvpn client or asus rtn66u

I would like to have my default gateway my router 192.168.23.1 instead my openvpn linux client (192.168.23.2) because if my linux shutdown I can't have internet.

TiTex

TiTex wrotecan you ssh from 192.168.23.100 to 192.168.0.28 ?
what about ssh from 192.168.0.189 to 192.168.23.2 ?
if the answer is yes , check the firewall on your Windows Machines

you have not posted the 192.168.0.28 vpn config , routing table, ip forwaring information