Hey fellows,
i'm playing around since a few days with a openvpn setup (traget is to aggregate multiple tap devices to impove speed).
My infrastructure looks like this:
Local Network: 192.168.1.0/24
Remote VPN Server: 5.44.xx.xxx, CentOS 7, one NIC and one public IP
Router 1: 192.168.1.1
Router 2: 192.168.1.10
VPN Router: 192.168.1.33, CentOS 7
VPN Subnet: 172.26.10.0/24
On the remote Server runs openvpn (first with openvpnas, that works in relation with my qnap nas, but now disabled). I plan to run multiple openvpn servers there to bond the tap devices (testing the connectivity atm with tun devices.
I can start on 5.44.xx.xxx the openvpnserver:
Wed Mar 21 15:56:48 2018 OpenVPN 2.4.4 x86_64-redhat-linux-gnu [Fedora EPEL patched] [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Sep 26 2017
Wed Mar 21 15:56:48 2018 library versions: OpenSSL 1.0.2k-fips 26 Jan 2017, LZO 2.06
Wed Mar 21 15:56:48 2018 TUN/TAP device tun5 opened
Wed Mar 21 15:56:48 2018 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Wed Mar 21 15:56:48 2018 /sbin/ip link set dev tun5 up mtu 1500
Wed Mar 21 15:56:48 2018 /sbin/ip addr add dev tun5 172.26.10.1/24 broadcast 172.26.10.255
Wed Mar 21 15:56:48 2018 Could not determine IPv4/IPv6 protocol. Using AF_INET
Wed Mar 21 15:56:48 2018 UDPv4 link local (bound): [AF_INET]5.44.xx.xxx:1195
Wed Mar 21 15:56:48 2018 UDPv4 link remote: [AF_UNSPEC]
Wed Mar 21 15:56:48 2018 GID set to nobody
Wed Mar 21 15:56:48 2018 UID set to nobody
Wed Mar 21 15:56:48 2018 Initialization Sequence Completed
and i can start the VPN Router:
Wed Mar 21 15:57:46 2018 80.187.xx.xxx:5420 VERIFY OK: depth=1, CN=typo3-webdev.de
Wed Mar 21 15:57:46 2018 80.187.xx.xxx:5420 VERIFY OK: depth=0, CN=client
Wed Mar 21 15:57:46 2018 80.187.xx.xxx:5420 peer info: IV_VER=2.4.4
Wed Mar 21 15:57:46 2018 80.187.xx.xxx:5420 peer info: IV_PLAT=linux
Wed Mar 21 15:57:46 2018 80.187.xx.xxx:5420 peer info: IV_PROTO=2
Wed Mar 21 15:57:46 2018 80.187.xx.xxx:5420 peer info: IV_NCP=2
Wed Mar 21 15:57:46 2018 80.187.xx.xxx:5420 peer info: IV_LZ4=1
Wed Mar 21 15:57:46 2018 80.187.xx.xxx:5420 peer info: IV_LZ4v2=1
Wed Mar 21 15:57:46 2018 80.187.xx.xxx:5420 peer info: IV_LZO=1
Wed Mar 21 15:57:46 2018 80.187.xx.xxx:5420 peer info: IV_COMP_STUB=1
Wed Mar 21 15:57:46 2018 80.187.xx.xxx:5420 peer info: IV_COMP_STUBv2=1
Wed Mar 21 15:57:46 2018 80.187.xx.xxx:5420 peer info: IV_TCPNL=1
Wed Mar 21 15:57:46 2018 80.187.xx.xxx:5420 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Wed Mar 21 15:57:46 2018 80.187.xx.xxx:5420 [client] Peer Connection Initiated with [AF_INET]80.187.xx.xxx:5420
Wed Mar 21 15:57:46 2018 client/80.187.xx.xxx:5420 MULTI_sva: pool returned IPv4=172.26.10.2, IPv6=(Not enabled)
Wed Mar 21 15:57:47 2018 client/80.187.xx.xxx:5420 Data Channel: using negotiated cipher 'AES-256-GCM'
Wed Mar 21 15:57:47 2018 client/80.187.xx.xxx:5420 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Wed Mar 21 15:57:47 2018 client/80.187.xx.xxx:5420 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
On the remote VPN Server i get these routes:
Kernel IP Routentabelle
Ziel Router Genmask Flags Metric Ref Use Iface
default gateway 0.0.0.0 UG 0 0 0 ens3
5.44.xx.0 0.0.0.0 255.255.255.0 U 0 0 0 ens3
link-local 0.0.0.0 255.255.0.0 U 1002 0 0 ens3
172.26.10.0 0.0.0.0 255.255.255.0 U 0 0 0 tun5
and on the vpn router i get this routes:
ernel IP Routentabelle
Ziel Router Genmask Flags Metric Ref Use Iface
0.0.0.0 172.26.10.1 128.0.0.0 UG 0 0 0 tun5
0.0.0.0 192.168.1.10 0.0.0.0 UG 0 0 0 enp0s7
5.44.xx.xxx 192.168.1.10 255.255.255.255 UGH 0 0 0 enp0s7
128.0.0.0 172.26.10.1 128.0.0.0 UG 0 0 0 tun5
169.254.0.0 0.0.0.0 255.255.0.0 U 1002 0 0 enp0s7
172.26.0.0 0.0.0.0 255.255.255.252 U 300 0 0 bond0
172.26.10.0 0.0.0.0 255.255.255.0 U 0 0 0 tun5
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 enp0s7
On the VPN Router i can ping the VPN Remote server:
[root@localhost ~]# ping 172.26.10.1
PING 172.26.10.1 (172.26.10.1) 56(84) bytes of data.
64 bytes from 172.26.10.1: icmp_seq=1 ttl=64 time=52.6 ms
64 bytes from 172.26.10.1: icmp_seq=2 ttl=64 time=52.0 ms
But i cant ping outside the network through VPN:
[root@localhost ~]# ping google.com
^C
[root@localhost ~]# ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
^C
--- 8.8.8.8 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 1999ms
In my local network, the vpn router (172.26.10.2) is pingable, the remote VPN Server not.
And here is my config:
server.conf
#cat /etc/openvpn/servertap5.conf
local 5.44.xx.xxx
port 1195
proto udp
;dev tap5
dev tun5
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh.pem
topology subnet
server 172.26.10.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
client-to-client
duplicate-cn
keepalive 10 120
cipher AES-256-CBC
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log-append /var/log/openvpn.log
verb 2
comp-lzo
verify-client-cert require
client conf:
# cat /etc/openvpn/tap5.conf
client
dev tun5
proto udp
#Server IP and Port
remote 5.44.xx.xxx 1195
cipher AES-256-CBC
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/client.crt
key /etc/openvpn/keys/client.key
remote-cert-tls server
comp-lzo
redirect-gateway def1 bypass-dhcp
iptables on remote server and vpn router
# cat /etc/rc.local
#!/bin/bash
# THIS FILE IS ADDED FOR COMPATIBILITY PURPOSES
#
# It is highly advisable to create own systemd services or udev rules
# to run scripts during boot instead of using this file.
#
# In contrast to previous versions due to parallel execution during boot
# this script will NOT be run after all other services.
#
# Please note that you must run 'chmod +x /etc/rc.d/rc.local' to ensure
# that this script will be executed during boot.
touch /var/lock/subsys/local
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 172.26.10.0/24 -j ACCEPT
iptables -A FORWARD -j REJECT
iptables -t nat -A POSTROUTING -s 172.26.10.0/24 -o ens3 -j MASQUERADE
[root@typo3-webdev typo3-webdev]#
# iptables --table nat --list
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 172.26.10.0/24 anywhere
MASQUERADE all -- 172.26.10.0/24 anywhere
firewalld is on boot system deactivated for testing purpose.
IP forwaring is active on remote vpn server and local vpn router:
# cat /etc/sysctl.conf
# sysctl settings are defined through files in
# /usr/lib/sysctl.d/, /run/sysctl.d/, and /etc/sysctl.d/.
#
# Vendors settings live in /usr/lib/sysctl.d/.
# To override a whole file, create a new file with the same in
# /etc/sysctl.d/ and put new settings there. To override
# only specific settings, add a file with a lexically later
# name in /etc/sysctl.d/ and put new settings there.
#
# For more information, see sysctl.conf(5) and sysctl.d(5).
net.ipv4.ip_forward=1
Conclusion: I think i have no idea what i'm doing. Or what my servers do. Can anyone see a failure here? Ah, btw, "route" and "iptables --table nat --list" needs very long on the vpn router, think it cames from a timeout to the remote vpn server over the tunnel....
Thanks for looking!
Blacki
