OpenVPN client configuration help

Redfin

After attempting to resolve the below routing issue using the various How-To's over the past week and a half, I'm hoping I can get professional help.

Administrator: As I'm a noobie, feel free to post in the appropriate forum if this is not correct.

Below I'm attempting to establish a RaspberryPi as a remote client. I have established the OpenVPN tunnel and am able to ping hosts on my server-side network. However I'm not able to ping the ethernet side (eth0) of the RaspberryPi. I have attempted numerous "route" and "iptables" instructions (based on various readings) which I won't bother to list here.

Here is a picture of the situation. I hope this paints the entire picture. Thanks for whatever help you can lend!

Redfin

If the embedded picture is not working, I've included an ASCII version here. The issue I'm having is reflected in the lower right corner showing the "pings" that are failing.

      Internet                                                        Internet
            +                                                               +
            |                                                               |
            |                                                               |
   +------------------+                                             +-----------------+
   |                  |                                             | ASUS Router     |
   |     iPhone       |                                             | (OpenVPN SERVER)|
   |  172.20.10.1     |                                             | 10.2.200.1      |
   +------------------+      +----------------------------------+   +-----------------+
            |                |    OpenVPN (tun0)          10.8.0.1          | Push "route 172.20.10.0
            |                |                                              |      255.255.255.0 10.8.0.2"
            |                |                                              |
   +------------------+      |                                      +-----------------+
   |                  |      |                                      | Desktop         |
   |  TP-Link pass thru      |                                      |                 |
   |                  |      |                                      | 10.2.200.2      |
   +------------------+      |                                      +-----------------+
            |                v
            |      +---------+
            |      |
            |      |                  pi@raspberrypi:/ $    sysctl net.ipv4.ip_forward
            |      |                  Net.ipv4.ip_forward = 1
       eth0 |      |tun0
172.20.10.3 |      |10.8.0.2          pi@raspberrypi:/ $    ip route
            |      ^                  Default via 172.20.10.1 dev eth0 src 172.20.10.3 metric 202
   +------------------+               10.8.0.0/24 dev tun0 proto kernel scope link src 10.8.0.2
   |                  |               172.20.10.0/28 dev eth0 proto kernel scope link src 172.20.10.3 metric 202
   |Raspberry Pi      |  <----------+ 172.20.10.0/24 via 10.8.0.2 dev tun0
   |                  |
   +------------------+
                 client.conf
                    ifconfig  10.8.0.2  10.8.0.1

   Ping 172.20.10.1 - Success                                     Ping 10.8.0.1 - Success
   Ping 172.20.10.3 - Success                                     Ping 10.8.0.2 - Success
   Ping 10.2.200.x - Success                                !!!!! Ping 172.20.10.1 - FAIL  <---------+
                                                            !!!!! Ping 172.20.10.3 - FAIL <----------+

Pippin

Not enough info.....

Push "route 172.20.10.0 255.255.255.0 10.8.0.2"

Is not correct.

First:
https://forums.openvpn.net/viewtopic.php?t=22603

Then:
https://openvpn.net/index.php/open-source/documentation/howto.html#scope

Redfin

Thanks Pippin, trying to follow the instructions. Hope this works. Appreciate any guidance.

* SERVER *

Server (ASUS RT-N66U Router) configuration file at /tmp/etc/openvpn/server1/

# Automatically generated configuration
daemon
topology subnet
server 10.8.0.0 255.255.255.0
proto udp
rcvbuf 0
sndbuf 0
port 1194
dev tun21
cipher AES-256-CBC
comp-lzo adaptive
keepalive 15 60
verb 3
push "route 10.2.200.0 255.255.255.0"
client-config-dir ccd
duplicate-cn
push "dhcp-option DNS 10.2.200.1"
ca ca.crt
dh dh.pem
cert server.crt
key server.key
status-version 2
status status 10

# Custom Configuration
route 172.20.10.0 255.255.255.0"

client configuration file at /tmp/etc/openvpn/server1/ccd

iroute 172.20.10.0 255.255.255.0

BUT client file in ccd is automatically deleted by the ASUS GUI interface.

Router (OpenVPN server) log file:

Feb 24 20:10:13 openvpn[4864]: event_wait : Interrupted system call (code=4)
Feb 24 20:10:13 openvpn[4864]: TITLE,OpenVPN 2.3.8 mipsel-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Dec 24 2015
Feb 24 20:10:13 openvpn[4864]: TIME,Sat Feb 24 20:10:13 2018,1519524613
Feb 24 20:10:13 openvpn[4864]: HEADER,CLIENT_LIST,Common Name,Real Address,Virtual Address,Bytes Received,Bytes Sent,Connected Since,Connected Since (time_t),Username
Feb 24 20:10:13 openvpn[4864]: CLIENT_LIST,client,166.170.221.96:64870,10.8.0.2,6490,6038,Sat Feb 24 20:01:23 2018,1519524083,UNDEF
Feb 24 20:10:13 openvpn[4864]: HEADER,ROUTING_TABLE,Virtual Address,Common Name,Real Address,Last Ref,Last Ref (time_t)
Feb 24 20:10:13 openvpn[4864]: ROUTING_TABLE,10.8.0.2,client,166.170.221.96:64870,Sat Feb 24 20:01:28 2018,1519524088
Feb 24 20:10:13 openvpn[4864]: GLOBAL_STATS,Max bcast/mcast queue length,0
Feb 24 20:10:13 openvpn[4864]: END
Feb 24 20:10:26 rc_service: httpd 262:notify_rc stop_vpnserver1
Feb 24 20:10:26 openvpn[4864]: event_wait : Interrupted system call (code=4)
Feb 24 20:10:26 openvpn[4864]: Closing TUN/TAP interface
Feb 24 20:10:26 openvpn[4864]: /usr/sbin/ip addr del dev tun21 10.8.0.1/24
Feb 24 20:10:26 openvpn[4864]: SIGTERM[hard,] received, process exiting

... not sure where 166.170.221.96 is coming from.

* CLIENT *

Client configuration file

client
dev tun
proto udp
remote _________.com 1194
ifconfig 10.8.0.2 10.8.0.1
auth-user-pass /etc/openvpn/login
float
cipher AES-256-CBC
comp-lzo adaptive
keepalive 15 60
ns-cert-type server
verb 4
<ca>
XXXXXXXXXXXXXXXXXXXXXXXXXXX
</ca>
<cert>
YYYYYYYYYYYYYYYYYYYYYYYYYY
</cert>
<key>
ZZZZZZZZZZZZZZZZZZZZZZZZZZZ
</key>
resolv-retry infinite
nobind

Client (Pi) log file:

Feb 24 20:45:04 raspberrypi ovpn-pi[282]: SENT CONTROL [RT-N66U]: 'PUSH_REQUEST' (status=1)
Feb 24 20:45:04 raspberrypi ovpn-pi[282]: PUSH: Received control message: 'PUSH_REPLY,route 10.2.200.0 255.255.255.0,dhcp-option DNS 10.2.200.1,route-gateway 10.8.0.1,topology subnet,ping 15,ping-restart 60,ifconfig 10.8.0.2 255.255.255.0'
Feb 24 20:45:04 raspberrypi ovpn-pi[282]: OPTIONS IMPORT: timers and/or timeouts modified
Feb 24 20:45:04 raspberrypi ovpn-pi[282]: OPTIONS IMPORT: --ifconfig/up options modified
Feb 24 20:45:04 raspberrypi ovpn-pi[282]: OPTIONS IMPORT: route options modified
Feb 24 20:45:04 raspberrypi ovpn-pi[282]: OPTIONS IMPORT: route-related options modified
Feb 24 20:45:04 raspberrypi ovpn-pi[282]: OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Feb 24 20:45:04 raspberrypi kernel: [   99.923086] tun: Universal TUN/TAP device driver, 1.6
Feb 24 20:45:04 raspberrypi kernel: [   99.923111] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
Feb 24 20:45:04 raspberrypi ovpn-pi[282]: Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:406 ET:0 EL:3 ]
Feb 24 20:45:04 raspberrypi ovpn-pi[282]: Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Feb 24 20:45:04 raspberrypi ovpn-pi[282]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Feb 24 20:45:04 raspberrypi ovpn-pi[282]: Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Feb 24 20:45:04 raspberrypi ovpn-pi[282]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Feb 24 20:45:04 raspberrypi ovpn-pi[282]: ROUTE_GATEWAY 172.20.10.1/255.255.255.240 IFACE=eth0 HWADDR=b8:27:eb:dd:a5:8a
Feb 24 20:45:04 raspberrypi ovpn-pi[282]: TUN/TAP device tun0 opened
Feb 24 20:45:04 raspberrypi ovpn-pi[282]: TUN/TAP TX queue length set to 100
Feb 24 20:45:04 raspberrypi ovpn-pi[282]: do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Feb 24 20:45:04 raspberrypi ovpn-pi[282]: /sbin/ip link set dev tun0 up mtu 1500
Feb 24 20:45:04 raspberrypi ovpn-pi[282]: /sbin/ip addr add dev tun0 10.8.0.2/24 broadcast 10.8.0.255
Feb 24 20:45:04 raspberrypi ovpn-pi[282]: /sbin/ip route add 10.2.200.0/24 via 10.8.0.1
Feb 24 20:45:04 raspberrypi ovpn-pi[282]: Initialization Sequence Completed

Redfin

Well, I managed to get the server ccd file to persist - it's not being deleted during the GUI's automatic generation process any more.

The original issue (not being able to ping 172.20.10.3 from server side) still exsists.

TinCanTech

Redfin wrote pi@raspberrypi:/ $ ip route
Default via 172.20.10.1 dev eth0 src 172.20.10.3 metric 202
10.8.0.0/24 dev tun0 proto kernel scope link src 10.8.0.2
172.20.10.0/28 dev eth0 proto kernel scope link src 172.20.10.3 metric 202
172.20.10.0/24 via 10.8.0.2 dev tun0

This is wrong.

Redfin wrote I managed to get the server ccd file to persist

The error above means the CCD file is not being used,

The CCD filename must exactly match the common_name of the client.

Redfin

Problem solved - as follows:

The issue had to do with the server side client ccd file (in my case called client). On the ASUS router the default place to put this file is:

/etc/openvpn/server1/ccd

However, this location is a RAM location in the router and does not survive settings changes (at least for me).

So, the solution was to enable jffs in the router's Administration menu which opens an area of internal flash. There I created a folder structure and saved the appropriate client file.

I added this directive to the server config file:

client-config-dir /jffs/configs/openvpn/ccd

Per OpenVPN requirements the client file looked like this;

iroute 172.20.10.0 255.255.255.0

I also changed the server side configuration to include:

route 172.20.10.0 255.255.255.0

All per:

https://openvpn.net/index.php/open-source/documentation/howto.html#scope

I can now ping the clients local network from the server side.

Thanks for allowing me to post my question and the nudge in the right direction.

Redfin