Access client's LAN from server

sevillo

Hi,

I've been trying to access my clients' LAN from my server, but I haven't been able to, I have followed a bunch other post here, somewhere else, but no luck so far. So I'm posting my configs here, hopefully you guy can help me out.

Server:

root@gateway:~# cat /etc/openvpn/openvpn.conf |grep -v "^#" |grep -v "^\$" cd /etc/openvpn
proto udp
port 1194
comp-lzo
verb 3
log-append /var/log/openvpn.log
daemon
dev tun
persist-tun
persist-key
server 10.0.0.0 255.255.255.0
ifconfig-pool-persist ips.txt
client-to-client
keepalive 10 120
push "route 192.168.69.0 255.255.255.0 vpn_gateway"
push "route 192.168.71.0 255.255.255.0 vpn_gateway"
cipher AES-256-CBC
ca certs/ca.crt
dh dh.pem
cert certs/server.crt
key keys/server.key
tls-auth keys/shared.key 0
Client:

root@gateway:~# cat /etc/openvpn/openvpn.conf |grep -v "^#" |grep -v "^\$" cd /etc/openvpn
remote daIP 1194
proto udp
comp-lzo
verb 3
log-append /var/log/openvpn.log
dev tun
persist-tun
persist-key
client
cipher AES-256-CBC
ca certs/ca.crt
cert certs/slack2.crt
key keys/slack2.key
tls-auth keys/shared.key 1

I'm able to access the server's LAN by pings and all that, but not the other way around, so here are some other useful info:

Server's routing table:

root@gateway:~# route -n |sed -e 's/maPublicIP/xxx\.xxx\.xxx/g'
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         xxx.xxx.xxx.57   0.0.0.0         UG    1      0        0 eth0
10.0.0.0        10.0.0.2        255.255.255.0   UG    0      0        0 tun0
10.0.0.2        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
10.4.4.0        0.0.0.0         255.255.255.0   U     0      0        0 eth4
xxx.xxx.xxx.56   0.0.0.0         255.255.255.248 U     0      0        0 eth0
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo
192.168.69.0    0.0.0.0         255.255.255.0   U     0      0        0 eth1
192.168.70.0    0.0.0.0         255.255.255.0   U     0      0        0 eth2
192.168.71.0    0.0.0.0         255.255.255.0   U     0      0        0 eth3
192.168.169.0   10.0.0.2        255.255.255.0   UG    0      0        0 tun0

Client's routing table:

root@gateway:~# route -n |sed -e 's/otherSidePublic/xxx\.xxx\.xxx/g'
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         xxx.xxx.xxx.17    0.0.0.0         UG    1      0        0 eth0
10.0.0.0        10.0.0.13       255.255.255.0   UG    0      0        0 tun0
10.0.0.13       0.0.0.0         255.255.255.255 UH    0      0        0 tun0
10.5.5.0        0.0.0.0         255.255.255.0   U     0      0        0 eth2
xxx.xxx.xxx.16    0.0.0.0         255.255.255.248 U     0      0        0 eth0
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo
192.168.69.0    10.0.0.13       255.255.255.0   UG    0      0        0 tun0
192.168.71.0    10.0.0.13       255.255.255.0   UG    0      0        0 tun0
192.168.169.0   0.0.0.0         255.255.255.0   U     0      0        0 eth1

From the client to the server:

root@gateway:~# ping 192.168.69.1 -c1 -q
PING 192.168.69.1 (192.168.69.1) 56(84) bytes of data.

--- 192.168.69.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.891/0.891/0.891/0.000 ms

From the server to the client:

root@gateway:~# ping 192.168.169.1 -c1 -q
PING 192.168.169.1 (192.168.169.1) 56(84) bytes of data.

--- 192.168.169.1 ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms

From the server, I'm able to reach the client's through the tunnel but with the VPN subnet (10.0.0.0/24):

root@gateway:~# ping 10.0.0.14 -c1 -q
PING 10.0.0.14 (10.0.0.14) 56(84) bytes of data.

--- 10.0.0.14 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.387/1.387/1.387/0.000 ms

I just not able to reach the LAN of the clients. I don't think it is a firewall issue since I flushed the INPUT table and changed the policy to ACCEPT. Also, I sniffed using

tcpdump -i any -v icmp

in the client and nothing pops out when pinging to the client's LAN IPs. It is either a routing issue or a masquerading issue I believe.

Furthermore, in the server, whatever goes out from the public interface is being MASQUERADEd, same for the client. But just in case I'm posting more things here

INPUT table of the client:

root@gateway:~# iptables -nv --list INPUT 
Chain INPUT (policy DROP 186 packets, 12648 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   72 13062 ACCEPT     all  --  *      *       192.168.0.0/16       0.0.0.0/0           
    7   588 ACCEPT     all  --  tun0   *       0.0.0.0/0            0.0.0.0/0           
    4   370 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
   20  1414 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:53
    1   183 ACCEPT     all  --  *      *       xxx.xxx.xxx.56/29     0.0.0.0/0           
    1   230 ACCEPT     all  --  eth1   *       0.0.0.0/0            0.0.0.0/0               
   11  2067 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED

INPUT table of the server:

root@gateway:~# iptables -nv --list INPUT 
Chain INPUT (policy DROP 33 packets, 1857 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 1774  185K ACCEPT     all  --  *      *       xxx.xxx.xxx.16/29      0.0.0.0/0           
    0     0 ACCEPT     all  --  *      *       192.168.0.0/16       0.0.0.0/0           
   12  1992 ACCEPT     all  --  tun0   *       0.0.0.0/0            0.0.0.0/0               
   20  1906 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
 1373  205K ACCEPT     all  --  eth1   *       0.0.0.0/0            0.0.0.0/0           
    2    72 ACCEPT     all  --  eth2   *       0.0.0.0/0            0.0.0.0/0           
  123 12081 ACCEPT     all  --  eth3   *       0.0.0.0/0            0.0.0.0/0           
   42  9652 ACCEPT     all  --  eth4   *       0.0.0.0/0            0.0.0.0/0              
 1498  396K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED

POSTROUTING table of the server:

root@gateway:~# iptables -nv --list POSTROUTING -t nat   |sed -e 's/maPublicIP/xxx\.xxx\.xxx/g'
Chain POSTROUTING (policy ACCEPT 46 packets, 2628 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   14  1064 SNAT       all  --  *      *       192.168.69.5         0.0.0.0/0            to:xxx.xxx.xxx.58
    0     0 SNAT       all  --  *      *       192.168.70.0/24      0.0.0.0/0            to:xxx.xxx.xxx.60
    4   264 SNAT       all  --  *      *       192.168.71.60        0.0.0.0/0            to:xxx.xxx.xxx.60
    0     0 SNAT       all  --  *      *       192.168.71.55        0.0.0.0/0            to:xxx.xxx.xxx.60
    0     0 SNAT       all  --  *      *       192.168.69.50        0.0.0.0/0            to:xxx.xxx.xxx.60
    0     0 SNAT       all  --  *      *       192.168.69.250       0.0.0.0/0            to:xxx.xxx.xxx.62
    0     0 SNAT       all  --  *      *       192.168.69.10        0.0.0.0/0            to:xxx.xxx.xxx.59
    0     0 SNAT       all  --  *      *       192.168.69.211       0.0.0.0/0            to:xxx.xxx.xxx.61
    0     0 SNAT       all  --  *      *       192.168.69.201       0.0.0.0/0            to:xxx.xxx.xxx.61
 1243  106K MASQUERADE  all  --  *      eth0    0.0.0.0/0            0.0.0.0/0

eth0 is the public interface in both servers,

Just in case it worth pasting here:

Server:

root@gateway:~# ip addr show tun0
13: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
    link/none 
    inet 10.0.0.1 peer 10.0.0.2/32 scope global tun0
       valid_lft forever preferred_lft forever

Client:

root@gateway:~# ip addr show tun0
9: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
    link/none 
    inet 10.0.0.14 peer 10.0.0.13/32 scope global tun0
       valid_lft forever preferred_lft forever

Thanks for a few minutes to review my post.

Best Regards

TinCanTech

sevillo wroteI've been trying to access my clients' LAN from my server, but I haven't been able to, I have followed a bunch other post here, somewhere else, but no luck so far. So I'm posting my configs here, hopefully you guy can help me out

Having posted all the right details, we can see that you have not read the openvpn HOWTO:
HOWTO: Expanding the scope of the VPN to include additional machines

Note: You require --client-config-dir and --iroute

sevillo

@TinCanTech

I'm not sure how could I have missed that. I had already tried adding the route in the server's configuration:

route 192.168.169.0 255.255.255.0 vpn_gateway

But that wasn't enough and thought it was irrelevant and took it out before posting my issue here.

I now understand the purpose of iroute, while the first route in config files controls the routing from the kernel to the OpenVPN server, the iroute controls the routing from the OpenVPN server to the remote clients.

I was missing the iroute and therefore my connection attempts from the server to the clients was going to a black whole.

Anyway, thanks for pointing me in the right direction.

Best Regards,