Hey all,
i need help with my OpenVPN configuration. I have a Site to Site setup between my subnets 192.168.16.0/24 (Net A) and 192.168.18.0/24 (Net B).
My problem is that i (and i dont know how) created a One Way VPN. I can Ping everything from Net B to Net A. All working fine. The answer packets from Net A to Net B come through the tunnel as well.
Now when i try to Ping from any device in Net A to Net B i don't get a connection. I installed iftop on the VPN Server and VPN Client.
While i ping from B to A i can see the Ping packets on both iftop's. When i Ping from the ovpn Server into Net B i see the Packets only on the Server going out to the TUN0 interface but nothing arriving at the Client in Net B. I dont know why. Routing is enabled on both Linux Kernels.
Hope someone can help me to figure out my problem.
ifconfig on the server
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 00:0c:29:17:7c:dd brd ff:ff:ff:ff:ff:ff
inet 192.168.16.24/24 brd 192.168.16.255 scope global eth0
valid_lft forever preferred_lft forever
3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
link/none
inet 10.8.0.1 peer 10.8.0.2/32 scope global tun0
valid_lft forever preferred_lft forever
ifconfig on the client
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
2: ens192: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 00:0c:29:43:67:d8 brd ff:ff:ff:ff:ff:ff
inet 192.168.18.10/24 brd 192.168.18.255 scope global ens192
valid_lft forever preferred_lft forever
3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
link/none
inet 10.8.0.6 peer 10.8.0.5/32 scope global tun0
valid_lft forever preferred_lft forever
ip route on the Server
10.8.0.0/24 via 10.8.0.2 dev tun0
10.8.0.2 dev tun0 proto kernel scope link src 10.8.0.1
192.168.16.0/24 dev eth0 proto kernel scope link src 192.168.16.24
192.168.18.0/24 via 10.8.0.2 dev tun0
ip route on the Client
10.8.0.1 via 10.8.0.5 dev tun0
10.8.0.5 dev tun0 proto kernel scope link src 10.8.0.6
192.168.16.0/24 via 10.8.0.5 dev tun0
192.168.18.0/24 dev ens192 proto kernel scope link src 192.168.18.10
openvpn.conf from the server
#server
port 1194
proto udp
dev tun
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/openvpn-server.crt
key /etc/openvpn/easy-rsa/keys/openvpn-server.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
server 10.8.0.0 255.255.255.0
push "route 192.168.16.0 255.255.255.0"
route 192.168.18.0 255.255.255.0
cipher AES-256-CBC
comp-lzo
keepalive 10 120
persist-key
persist-tun
client-config-dir /etc/openvpn/ccd/
log-append /var/log/openvpn.log
verb 3
openvpn.conf from the client
client
dev tun
port 1194
proto udp
remote myurl.de 1194 # VPN server IP : PORT
nobind
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/client.crt
key /etc/openvpn/easy-rsa/keys/client.key
cipher AES-256-CBC
comp-lzo
persist-key
persist-tun
verb 3
iptables rules on the server
# Generated by iptables-save v1.4.21 on Mon May 11 18:51:40 2015
*nat
:PREROUTING ACCEPT [5518:962304]
:INPUT ACCEPT [2909:461547]
:OUTPUT ACCEPT [233:14354]
:POSTROUTING ACCEPT [233:14354]
-A POSTROUTING -s 192.168.16.0/24 -o tun0 -j MASQUERADE
-A POSTROUTING -s 192.168.18.0/24 -o eth0 -j MASQUERADE
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
COMMIT
# Completed on Mon May 11 18:51:40 2015
# Generated by iptables-save v1.4.21 on Mon May 11 18:51:40 2015
*filter
:INPUT ACCEPT [204021:105550198]
:FORWARD ACCEPT [2540:152400]
:OUTPUT ACCEPT [219283:172276372]
-A FORWARD -i tun0 -o eth0 -j ACCEPT
-A FORWARD -i eth0 -o tun0 -j ACCEPT
COMMIT
# Completed on Mon May 11 18:51:40 2015
iptables rules on the client
# Gemerated by iptables-save v1.4.21 on Mon May 11 18:51:40 2015
*nat
:PREROUTING ACCEPT [5518:962304]
:INPUT ACCEPT [2909:461547]
:OUTPUT ACCEPT [233:14354]
:POSTROUTING ACCEPT [233:14354]
-A POSTROUTING -s 192.168.18.0/24 -o tun0 -j MASQUERADE
-A POSTROUTING -s 192.168.16.0/24 -o ens192 -j MASQUERADE
-A POSTROUTING -s 10.8.0.0/24 -o ens192 -j MASQUERADE
COMMIT
# Completed on Mon May 11 18:51:40 2015
# Generated by iptables-save v1.4.21 on Mon May 11 18:51:40 2015
*filter
:INPUT ACCEPT [204021:105550198]
:FORWARD ACCEPT [2540:152400]
:OUTPUT ACCEPT [219283:172276372]
-A FORWARD -i tun0 -o ens192 -j ACCEPT
-A FORWARD -i ens192 -o tun0 -j ACCEPT
COMMIT
# Completed on Mon May 11 18:51:40 2015
Thank you in advance
Tobias
