Hi,
i want connect 2 raspis over a openvpn-tunnel. From the Server-Site to Client Site I can ping all Devices. From Client Site to Server Site I cannot reach any Device on the other Site 🙁 .
Client-Site: 192.168.0.0/24
Server-Site: 192.168.1.0/24
Transer-Network: 192.168.255.1/31
dev tun
proto tcp-server
mode server
tls-server
port 4443
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
client-config-dir /etc/openvpn/client
user nobody
group nogroup
ifconfig 192.168.255.1 192.168.255.2
persist-key
persist-tun
route 192.168.0.0 255.255.255.0
client-to-client
comp-lzo
keepalive 10 120
verb 3
status /var/log/openvpn-status.log
log-append /var/log/openvpn
less /etc/openvpn/client/repi
iroute 192.168.0.0 255.255.255.0
Server-Firewall:
#! /bin/sh
### BEGIN INIT INFO
# Provides: rpivpn
# Required-Start: $remote_fs $syslog
# Required-Stop: $remote_fs $syslog
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: VPN initialisation script
### END INIT INFO
echo 'echo "1" > /proc/sys/net/ipv4/ip_forward' | sudo -s
sudo iptables -A INPUT -i tun+ -j ACCEPT
sudo iptables -A FORWARD -i tun+ -j ACCEPT
sudo iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
sudo iptables -t nat -F POSTROUTING
sudo iptables -t nat -A POSTROUTING -s 192.168.255.0/24 -o eth0 -j MASQUERADE
sudo iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o eth0 -j MASQUERADE
Server-Routing
root@Mapi:/etc/openvpn# route
Kernel-IP-Routentabelle
Ziel Router Genmask Flags Metric Ref Use Iface
default compalhub.home 0.0.0.0 UG 0 0 0 eth0
192.168.0.0 192.168.255.2 255.255.255.0 UG 0 0 0 tun0
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
192.168.255.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
root@Mapi:/etc/openvpn# ping 192.168.0.1
PING 192.168.0.1 (192.168.0.1) 56(84) bytes of data.
64 bytes from 192.168.0.1: icmp_seq=1 ttl=63 time=164 ms
64 bytes from 192.168.0.1: icmp_seq=2 ttl=63 time=40.5 ms
TCPDUMP Client (Ping from PC):
root@Repi:/home/pi# tcpdump -n -i tun0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 262144 bytes
14:17:23.339385 IP 192.168.1.101 > 192.168.0.1: ICMP echo request, id 1, seq 757, length 72
14:17:23.339768 IP 192.168.255.2 > 192.168.1.101: ICMP time exceeded in-transit, length 100
dev tun
port 4443
proto tcp-client
remote xxx.spdns.de 4443
ifconfig 192.168.255.2 192.168.255.1
ca /etc/openvpn/client/mapi/ca.crt
cert /etc/openvpn/client/mapi/repi.crt
key /etc/openvpn/client/mapi/repi.key
client
remote-cert-tls server
comp-lzo
persist-key
persist-tun
route-nopull
route 192.168.1.0 255.255.255.0
verb 3
log-append /var/log/openvpn
Client-Firewall
#! /bin/sh
### BEGIN INIT INFO
# Provides: rpivpn
# Required-Start: $remote_fs $syslog
# Required-Stop: $remote_fs $syslog
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: VPN initialisation script
### END INIT INFO
echo 'echo "1" > /proc/sys/net/ipv4/ip_forward' | sudo -s
sudo iptables -A INPUT -i tun+ -j ACCEPT
sudo iptables -A FORWARD -i tun+ -j ACCEPT
sudo iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
sudo iptables -t nat -F POSTROUTING
sudo iptables -t nat -A POSTROUTING -s 192.168.255.0/24 -o eth0 -j MASQUERADE
sudo iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE
Client-Routing:
root@Repi:/etc/openvpn# route
Kernel-IP-Routentabelle
Ziel Router Genmask Flags Metric Ref Use Iface
default compalhub.home 0.0.0.0 UG 0 0 0 eth0
192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
192.168.1.0 192.168.255.1 255.255.255.0 UG 0 0 0 tun0
192.168.255.1 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
PING from Client to Server:
root@Repi:/etc/openvpn# ping 192.168.1.10
PING 192.168.1.10 (192.168.1.10) 56(84) bytes of data.
^C
--- 192.168.1.10 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2064ms
TCPDUMP Client:
root@Repi:/etc/openvpn# tcpdump -n -i tun0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 262144 bytes
14:15:24.178123 IP 192.168.255.2 > 192.168.1.10: ICMP echo request, id 1563, seq 9, length 64
14:15:25.218107 IP 192.168.255.2 > 192.168.1.10: ICMP echo request, id 1563, seq 10, length 64
TCPDUMP Server:
root@Mapi:/etc/openvpn# tcpdump -n -i tun0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 262144 bytes
^C
0 packets captured
0 packets received by filter
0 packets dropped by kernel
I can't find the problem in my configuration. Have anybody a tipp for me?
Thanks!!!
Marco
