OpenVPN Routing Issues

MisterSurface

Hello,

I have a VPN box behind a Service Gateway that acts as a firewall and router that is NAT'd. I am troubleshooting a new setup where I am using MS Azure box which is also NAT'd. I have tried a million different combinations of what I see online for setup in getting the client to route all traffic to my VPN box and forward it out it's eth0 internal address. Please see below for my configuration and setup on the server and client. I don't know what I am setting up wrong.
# This is a comment
local 172.16.234.14
port 1234
proto udp
dev tun
ca ca.crt
cert cert.crt
key key.key
dh dh4096.pem
server 172.16.234.16 255.255.255.248
ifconfig-pool-persist ipp.txt
client-config-dir ccd
route 10.0.34.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
keepalive 10 120
tls-auth tls-auth.key 0
tls-version-min 1.2
max-clients 10
user openvpn_server
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log
log /etc/openvpn/openvpn.log
verb 6 ifconfig -a on server
eth0 Link encap:Ethernet HWaddr 00:e0:81:74:16:91
inet addr:172.16.234.14 Bcast:172.16.234.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:5007 errors:0 dropped:0 overruns:0 frame:0
TX packets:5385 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:3878939 (3.6 MiB) TX bytes:461088 (450.2 KiB)

eth1 Link encap:Ethernet HWaddr 00:e0:81:74:16:90
inet addr:172.16.234.15 Bcast:172.16.234.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:51 errors:0 dropped:0 overruns:0 frame:0
TX packets:5 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:5950 (5.8 KiB) TX bytes:810 (810.0 B)

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:112 errors:0 dropped:0 overruns:0 frame:0
TX packets:112 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:8576 (8.3 KiB) TX bytes:8576 (8.3 KiB)

tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:172.16.234.17 P-t-P:172.16.234.18 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:12 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:1084 (1.0 KiB) TX bytes:0 (0.0 B)

routes on server
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 172.16.234.1 0.0.0.0 UG 0 0 0 eth0
10.0.34.0 172.16.234.18 255.255.255.0 UG 0 0 0 tun0
172.16.234.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1
172.16.234.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
172.16.234.16 172.16.234.18 255.255.255.248 UG 0 0 0 tun0
172.16.234.18 0.0.0.0 255.255.255.255 UH 0 0 0 tun0

iptables nat on server
Chain PREROUTING (policy ACCEPT)
target prot opt source destination

Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 172.16.234.16 anywhere

ip tables on server
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

ccd file on server
iroute 10.0.34.0 255.255.255.0
# This is a comment
client
dev tun
proto udp
remote (Public IP 1.2.3.4) (non-standard port 1234)
redirect-gateway autolocal
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert cert.crt
key key.key
remote-cert-tls server
tls-auth tls-auth.key 1
tls-version-min 1.2
verb 6 client ifconfig -a
eth0 Link encap:Ethernet HWaddr 00:0d:3a:90:a0:67
inet addr:10.0.34.154 Bcast:10.0.34.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:610163 errors:0 dropped:3 overruns:0 frame:0
TX packets:758436 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:175018239 (175.0 MB) TX bytes:130354429 (130.3 MB)

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:164 errors:0 dropped:0 overruns:0 frame:0
TX packets:164 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1
RX bytes:12036 (12.0 KB) TX bytes:12036 (12.0 KB)

tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:172.16.234.22 P-t-P:172.16.234.21 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:5 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 B) TX bytes:600 (600.0 B)

client route table
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 172.16.234.21 128.0.0.0 UG 0 0 0 tun0
0.0.0.0 10.0.34.1 0.0.0.0 UG 0 0 0 eth0
10.0.34.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
1.2.3.4 10.0.34.1 255.255.255.255 UGH 0 0 0 eth0
128.0.0.0 172.16.234.21 128.0.0.0 UG 0 0 0 tun0
172.16.234.17 172.16.234.21 255.255.255.255 UGH 0 0 0 tun0
172.16.234.21 0.0.0.0 255.255.255.255 UH 0 0 0 tun0

Thank you!!!

TinCanTech

MisterSurface wrotedon't know what I am setting up wrong.

Server Config
local 172.16.234.14
server 172.16.234.16 255.255.255.248

Have you read HOWTO: For OpenVPN Community Edition

MisterSurface

Yep, I don't see anything about the local line. The server is grabbing .16 and .17 the client is told to communicate through .17 and eth0 is .14, my NAT rule on the service gateway is to .14. I'm sorry but I have read it many times and I don't know what I am doing wrong. If I leave local blank and then use server 172.16.234.16 then the NAT rule doesn't go the my server from the service gateway because openvpn says it can't use an IP address that is in use. The other issue I have is that my service gateway automatically assigns a gateway IP of .1 for a subnet assigned to a VLAN so I can't use 172.16.234.0 255.255.255.0 for the server line. How do I NAT from my service gateway to my VPN box and also have a client use the correct IP address for it's destination (or configure openvpn to listen to where the service gateway is NATing to?)

ifconfig -a on server
eth0 Link encap:Ethernet HWaddr 00:e0:81:74:16:91
inet addr:172.16.234.14 Bcast:172.16.234.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:5007 errors:0 dropped:0 overruns:0 frame:0
TX packets:5385 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:3878939 (3.6 MiB) TX bytes:461088 (450.2 KiB)

TinCanTech

TinCanTech wrote
MisterSurface wrotedon't know what I am setting up wrong.

Server Config
local 172.16.234.14
server 172.16.234.16 255.255.255.248
Have you read HOWTO: For OpenVPN Community Edition

MisterSurface wroteYep, I don't see anything about the local line. The server is grabbing .16 and .17

The Howto documents what you need to do .. I don't understand what you are trying to do.

Do you want a bridged setup ?

MisterSurface

I think the problem I am having is that when I assigned a subnet to the VLAN my VPN box is on it assigns a .1 default gateway on the interface. So that means 172.16.234.1 255.255.255.0 which is the subnet my VPN box is on needs a NAT rule that will hit a box that is on that subnet. The rule as I have it now sends my vpn traffic to .14 which is also eth0. Do I setup a NAT rule to an IP that VPN brings up that is also in that subnet? If that is the case I don't know how my NAT rule will work since the router won't be aware of a machine with that address on the VPN box. It won't route then right? I've struggled with this in the past and finally thought I had this working.

TinCanTech

TinCanTech wrote
MisterSurface wrotedon't know what I am setting up wrong.

Server Config
local 172.16.234.14
server 172.16.234.16 255.255.255.248
Have you read HOWTO: For OpenVPN Community Edition

Can you explain your reasoning to do this ?

Otherwise, do this:

local 172.16.234.14
server 10.8.0.0 255.255.255.0

as described in the HOWTO above.

MisterSurface

I fixed it so now the VPN server is listening on a different subnet than eth0 is on and it is correctly being NAT'd, firewall is showing allows in and out.

Am I supposed to NAT to the tun0 IP address that the server takes or the P-t-P address?

eth0 is now 172.16.234.2 with default gateway of 172.16.234.1

I changed my openvpn config to
;local commented out
server 172.16.235.0 255.255.255.0

so tun0 comes up with 172.16.235.1 and P-t-P 172.16.235.2

The traffic gets to the server and the server responds but the client never receives it. I see allows on the firewall and the NAT to the destination. Maybe my NAT rules is wrong? It is taking any IP address from any port destined for my public IP address at VPN listening port X and sending it to 172.16.235.1 on port X.... is that wrong?

MisterSurface

Ok, I got it working, I have the NAT rule going to eth0. In the logs I saw errors that the local subnet traffic from the client 10.0.34.154 was dropped because of a bad source address. I added a ccd file and pushed the iroute and added the line to the server.conf as below. this fixed the error message about a bad source address but I'm still having issues.

client-config-dir ccd
route 10.0.34.0 255.255.255.0

I have POSTROUTING and forwarding on for packets.... I have seen other people requiring other NAT rules in the iptables.... am I missing something? none of my traffic is getting anywhere - nothing is showing up in tcpdumps for tun0 so it has to be a iptables rule right?

What ip address do I use as the -s for the rule, maybe I have it wrong?

iptables -t nat -I POSTROUTING -o eth0 -s ?????? -j MASQUERADE

TinCanTech

MisterSurface wroteclient-config-dir ccd

route 10.0.34.0 255.255.255.0

Did you mean to use --iroute ?

Pippin

And to add:

server 172.16.235.0/24

So that`s the source that needs translation.

iptables -t nat -A POSTROUTING -o eth0 -s 172.16.235.0/24 -j MASQUERADE

Maybe pics can help:
https://s30.postimg.org/4b7xjhmox/flow01s.png
https://s24.postimg.org/n2h8qqe6d/iptables-flow01.png

MisterSurface

for the ccd file, sorry it does say iroute - must've been a copy paste issue.

is my other entry below correct for iptables?

ip tables on server
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

here is my new route printout from the client, I used your command from above for POSTROUTING and am still having issues for some reason, also it is not taking my DNS push, is there a way to see in a log what is going on "push "dhcp-option DNS 208.67.222.222""

route printout

Destination Gateway Genmask Flags Iface
default 172.16.235.5 128.0.0.0 UG tun0
default 10.0.34.1 0.0.0.0 UG eth0
10.0.34.0 * 255.255.255.0 U eth0
c-(comcastip-dotted).hsd1.mn.comcast.net 10.0.34.1 255.255.255.255 UGH eth0
128.0.0.0 172.16.235.5 128.0.0.0 UG tun0
168.63.129.16 10.0.34.1 255.255.255.255 UGH eth0
169.254.169.254 10.0.34.1 255.255.255.255 UGH eth0
172.16.235.1 172.16.235.5 255.255.255.255 UGH tun0
172.16.235.5 * 255.255.255.255 UH tun0

I read that the 128. split like that is to preserve the other gateway but i'm at a loss for what is wrong now.

I am doing tests like other people ping 8.8.8.8 using wget to a website from the client and dig commands and nothing is getting through

MisterSurface

now i'm seeing dropped packets on the tun0 interface... guess that is progress - I will investigate but do you have any advice for the DNS problem?

MisterSurface

fixed dropped packets with txqueuelen 2000 in config for client and server

it worked one time..... then it won't work again and I didn't make any changes... RX on tun0 shows low numbers every time but other traffic just isn't going there it has to be the routing table

TinCanTech

Some suggestions:

There are some useful posts on the first page here: https://forums.openvpn.net/viewforum.php?f=7
eg: Bebop's guides and others marked as solved referencing Windows.
Read the Howto again .. sometimes you forget or mistake something. I refer back to it often.
Read this: HOWTO: Request Help ! and provide all the requested details.
You can open a new thread if you prefer. (Recommended)
After providing the information requested above, send an email to the openvpn-users mailing list and link to it here.

The better the information you provide the better we can help.

MisterSurface

thanks I will move it to another thread.. I suspect it is UDP problem since I am getting NTP - I will do my research and post information in a new thread if I have issues