Need help to get ping working

cglmicro

Hi guys.

I need someone help with this; I'm not that good in networking, but I try to get an OpenVPN setup to work.

Here is my setup:
I have 2 Debian 9 servers (running ProxMox) with public IP 158.69.246.61 (let's call it MASTER) and public ip 158.69.246.107 (let's call it CLIENT).

Here are some of my files:
[oconf=MASTER /etc/network/interfaces]
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# for Routing
auto vmbr1
iface vmbr1 inet manual
bridge_ports dummy0
bridge_stp off
bridge_fd 0

# vmbr0: Bridging. Make sure to use only MAC adresses that were assigned to you.
auto vmbr0
iface vmbr0 inet static
address 158.69.246.61
netmask 255.255.255.0
network 158.69.246.0
broadcast 158.69.246.255
gateway 158.69.246.254
bridge_ports eth0
bridge_stp off
bridge_fd 0

iface vmbr0 inet6 static
address 2607:5300:0120:063d::
netmask 64
post-up /sbin/ip -f inet6 route add 2607:5300:0120:06ff:ff:ff:ff:ff dev vmbr0
post-up /sbin/ip -f inet6 route add default via 2607:5300:0120:06ff:ff:ff:ff:ff
pre-down /sbin/ip -f inet6 route del default via 2607:5300:0120:06ff:ff:ff:ff:ff
pre-down /sbin/ip -f inet6 route del 2607:5300:0120:06ff:ff:ff:ff:ff dev vmbr0

auto openvpnbr0
iface openvpnbr0 inet static
address 192.168.192.10
netmask 255.255.255.0
network 192.168.192.0
broadcast 192.168.192.255
bridge_ports dummy1
bridge_stp off
bridge_fd 0
post-up route add -net 224.0.0.0 netmask 240.0.0.0 dev openvpnbr0
[/oconf]

[oconf=CLIENT /etc/network/interfaces]
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# for Routing
auto vmbr1
iface vmbr1 inet manual
bridge_ports dummy0
bridge_stp off
bridge_fd 0

# vmbr0: Bridging. Make sure to use only MAC adresses that were assigned to you.
auto vmbr0
iface vmbr0 inet static
address 158.69.246.107
netmask 255.255.255.0
network 158.69.246.0
broadcast 158.69.246.255
gateway 158.69.246.254
bridge_ports eth0
bridge_stp off
bridge_fd 0

iface vmbr0 inet6 static
address 2607:5300:0120:066b::
netmask 64
post-up /sbin/ip -f inet6 route add 2607:5300:0120:06ff:ff:ff:ff:ff dev vmbr0
post-up /sbin/ip -f inet6 route add default via 2607:5300:0120:06ff:ff:ff:ff:ff
pre-down /sbin/ip -f inet6 route del default via 2607:5300:0120:06ff:ff:ff:ff:ff
pre-down /sbin/ip -f inet6 route del 2607:5300:0120:06ff:ff:ff:ff:ff dev vmbr0

auto openvpnbr0
iface openvpnbr0 inet static
address 192.168.192.11
netmask 255.255.255.0
network 192.168.192.0
broadcast 192.168.192.255
bridge_ports dummy1
bridge_stp off
bridge_fd 0
post-up route add -net 224.0.0.0 netmask 240.0.0.0 dev openvpnbr0
[/oconf]

Both OPENVPNBR0 interfaces where added when I followed a 2013 tutorial to connect two ProxMox via OpenVPN, I'm not sure it's even required now.

I want my CLIENT from it's private IP (192.168.192.11) to be able to connect to my MASTER on it's private IP (192.168.192.10), and be able to ping it's private IP and vice versa. Both server still need to be accessible from their public IPs when VPN is connected.

Here are some more files:

root@ns535320.ip-158-69-246.net:/etc/openvpn# cat server.conf | grep -v -e '^;' | grep -v -e '^#' | grep -v -e '^$'
port 1194
proto udp
dev tun
ca /etc/openvpn/certs/keys/ca.crt
cert /etc/openvpn/certs/keys/server.crt
key /etc/openvpn/certs/keys/server.key # This file should be kept secret
dh dh4096.pem
server 192.168.192.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/certs/keys/ta.key 0 # This file is secret
cipher AES-256-CBC
user openvpn
group nogroup
persist-key
persist-tun
status openvpn-status.log
log-append openvpn.log
verb 3
explicit-exit-notify 1
auth SHA512
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-256-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA:TLS-DHE-RSA-WITH-AES-128-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA

root@ns535576:/etc/openvpn# cat openvpn.conf | grep -v -e '^;' | grep -v -e '^#' | grep -v -e '^$'
client
dev tun
proto udp
remote 158.69.246.61 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca ca.crt
cert ns535576.crt
key ns535576.key
remote-cert-tls server
tls-auth ta.key 1
cipher AES-256-CBC
verb 3
auth SHA512
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-256-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA:TLS-DHE-RSA-WITH-AES-128-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA

It connect and all, but I can't ping the MASTER from the CLIENT nor the CLIENT from the MASTER.

OpenVPN CLIENT LIST
Updated,Sat Apr 7 19:45:40 2018
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
ns535576,158.69.246.107:55923,7233,7290,Sat Apr 7 19:45:29 2018
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
192.168.192.6,ns535576,158.69.246.107:55923,Sat Apr 7 19:45:29 2018
GLOBAL STATS
Max bcast/mcast queue length,0
END

Any suggestion for me please? And thanks in advance for your help.

David.

cglmicro

A little bit of change: I removed the OPENVPNBR0 from each nodes, and I'm now able to ping a client from another client.
But what I can't do is to ping the server: can't find it's IP !

Here is what I get :

OpenVPN CLIENT LIST
Updated,Sun Apr  8 11:30:24 2018
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
yoga-david,76.69.169.249:59065,35312,8914,Sun Apr  8 11:22:57 2018
ns535576,158.69.246.107:47840,7433,7512,Sun Apr  8 11:29:19 2018
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
192.168.192.10,yoga-david,76.69.169.249:59065,Sun Apr  8 11:22:57 2018
192.168.192.6,ns535576,158.69.246.107:47840,Sun Apr  8 11:29:19 2018
GLOBAL STATS
Max bcast/mcast queue length,0

What next ?

cglmicro

Hishhh ! My last intervention caused a problem: all my VM where not able to ping FQDN nor IP address, and they where no longer accessible from the outside.

I had to
- "systemctl disable openvpn@server,"
- restart all the vm and the Proxmox server
- and re-add the OPENVPNBR0 in the interfaces file (and changed my server ip for 192.168.192.2 instead of .10)
- add a LOCAL 158.69.246.61 in my server.conf
- re-enable again my openvpn@server

and now one of my client (on Windows) can ping the other client (linux),but not in the other way. And also can't ping the server on ip 192.168.192.2 from any clients.

I'll wait for your advice for the next steps.

TinCanTech

You need to read the howto ..

cglmicro

I read one too many, but will give another shot.
Thank you.

TinCanTech

maybe --server-bridge .. ?

cglmicro

While I was reading your HOW-TO, I realized I already scroll it a few days ago. I reread it just in case.

I remember that I chose ROUTING instead of BRIDGING for different reason. First, I read somewhere that bridging would join all my network interfaces, and that my server will stop listening to public IP.
Second, I also read the HOW TO that stipulate that:

I would recommend using routing unless you need a specific feature which requires bridging, such as:
the VPN needs to be able to handle non-IP protocols such as IPX,
you are running applications over the VPN which rely on network broadcasts (such as LAN games), or
you would like to allow browsing of Windows file shares across the VPN without setting up a Samba or WINS server.

I'm pretty sure that the only thing missing is something like a PUSH ROUTE of some kind.

TinCanTech

Your initial post indicates otherwise ..

cglmicro wrote I remember that I chose ROUTING instead of BRIDGING for different reason. First, I read somewhere that bridging would join all my network interfaces, and that my server will stop listening to public IP.

what you did is .. make a snap decision without adequate homework ..

cglmicro wrote While I was reading your HOW-TO

It is not MY howto .. it is YOUR howto ...

cglmicro

What do you mean by "Your initial post indicates otherwise .." ?

For my snap decision: does this mean I should have chosen server-bridge instead ?

We all need to start somewhere, and I'm on a learning curve. I don't want to be rude, but what I understand by reading your one-liner replies, is that my configuration is WAY too wrong so you can't give me advice about what to correct to achieve my goals OR that my questions are too basic and not suited for this forum ?

Am I right and should I just start from scratch ?

Thanks to you, or anyone else wanting to give a hand.

EDIT: And BTW, I didn't go right here asking questions; I'm reading and trying for days before asking anyone help. I've spent at least 25 hours playing with this.