Routing between 2 Clients Connected to an OpenVPN Server

texastim65

Hi,

I'm trying to figure out how to route data between 2 clients connected to my OpenVPN server. This is a typical road warrior scenario with the difference being that the 2 client networks are trying to talk to each other through a virtual private server running OpenVPN on Ubuntu (BackBox). I've gone over this article as part of my setup
http://openvpn.net/index.php/open-source/documentation/howto.html#scope

Here's my configuration:
My OpenVPN server sits on a static public IP address.
Client 1 (Win 10 machine) is inside my corporate LAN.
Client 2 (Win 10 laptop) is reached by a 4G cellular modem that gets an dynamic IP address.

My Server.conf file is as follows
port 1194
proto udp
dev tun
sndbuf 0
rcvbuf 0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-auth ta.key 0
topology subnet
server 10.8.0.0 255.255.255.0
route 172.27.12.0 255.255.255.0 10.8.0.3
route 10.10.86.0 255.255.255.0 10.8.0.2
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 75.75.75.75"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 127.0.0.1"
keepalive 10 120
cipher AES-256-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem
client-to-client
client-config-dir /etc/openvpn/clients

Client1 (Corporate machine) config file
ifconfig-push 10.8.0.3 255.255.255.0
push "route 10.10.86.0 255.255.255.0 10.8.0.1"
iroute 172.27.12.0 255.255.255.0

Client2 (Remote laptop) config file
ifconfig-push 10.8.0.2 255.255.255.0
route "push 172.27.12.0 255.255.255.0 10.8.0.1"
iroute 10.10.86.0 255.255.255.0

Both clients can successfully connect to the server at the same time so the VPN part of the setup works just fine.
Client1 with IP 10.8.0.3 can ping the server 10.8.0.1 and the other Client 10.8.0.2
Client2 with IP 10.8.0.2 can ping the server 10.8.0.1 and the other Client 10.8.0.1

So far so good.

But if I try to ping anything on either network behind the VPN's I get nothing. I can't even ping the IP address of the machine that is hosting the VPN (for example Client2 internal LAN IP is 172.27.12.1 and from Client1 if I try pinging 172.27.12.1 I get no response).

Below is the routing table for Client1. I see the route was pushed for Client2 just fine.
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.10.86.1 10.10.86.140 276
0.0.0.0 128.0.0.0 10.8.0.1 10.8.0.2 3
10.8.0.0 255.255.255.0 On-link 10.8.0.2 259
10.8.0.2 255.255.255.255 On-link 10.8.0.2 259
10.8.0.255 255.255.255.255 On-link 10.8.0.2 259
10.10.86.0 255.255.255.0 On-link 10.10.86.140 276
10.10.86.140 255.255.255.255 On-link 10.10.86.140 276
10.10.86.255 255.255.255.255 On-link 10.10.86.140 276
50.79.78.184 255.255.255.255 10.10.86.1 10.10.86.140 20
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
128.0.0.0 128.0.0.0 10.8.0.1 10.8.0.2 3
172.27.12.0 255.255.255.0 10.8.0.1 10.8.0.2 4
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.10.86.140 276
224.0.0.0 240.0.0.0 On-link 10.8.0.2 259
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 10.10.86.140 276
255.255.255.255 255.255.255.255 On-link 10.8.0.2 259
===========================================================================

Below is the routing table for Client2. I see the route was pushed for Client1 just fine.
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 172.27.12.170 172.27.12.1 281
0.0.0.0 128.0.0.0 10.8.0.1 10.8.0.3 259
10.8.0.0 255.255.255.0 On-link 10.8.0.3 259
10.8.0.3 255.255.255.255 On-link 10.8.0.3 259
10.8.0.255 255.255.255.255 On-link 10.8.0.3 259
10.10.86.0 255.255.255.0 10.8.0.1 10.8.0.3 259
50.79.78.184 255.255.255.255 172.27.12.170 172.27.12.1 281
127.0.0.0 255.0.0.0 On-link 127.0.0.1 331
127.0.0.1 255.255.255.255 On-link 127.0.0.1 331
127.255.255.255 255.255.255.255 On-link 127.0.0.1 331
128.0.0.0 128.0.0.0 10.8.0.1 10.8.0.3 259
172.27.11.0 255.255.255.0 On-link 172.27.11.1 281
172.27.11.1 255.255.255.255 On-link 172.27.11.1 281
172.27.11.255 255.255.255.255 On-link 172.27.11.1 281
172.27.12.0 255.255.255.0 On-link 172.27.12.1 281
172.27.12.1 255.255.255.255 On-link 172.27.12.1 281
172.27.12.255 255.255.255.255 On-link 172.27.12.1 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 331
224.0.0.0 240.0.0.0 On-link 10.8.0.3 259
224.0.0.0 240.0.0.0 On-link 172.27.12.1 281
224.0.0.0 240.0.0.0 On-link 172.27.11.1 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 331
255.255.255.255 255.255.255.255 On-link 10.8.0.3 259
255.255.255.255 255.255.255.255 On-link 172.27.12.1 281
255.255.255.255 255.255.255.255 On-link 172.27.11.1 281
===========================================================================

I am not sure if the problem is
1) A routing problem on my server
2) routing problems on my clients
3) Not setting Gateway LAN routes for the VPN on either side. I hoped I didn't need that for a basic test of the the 2 machines using the VPN to ping each other since they have internal routes set even though I know I need it for other machines on either LAN.

Note that I have IP Forwarding turned on in the VPNServer (not sure it matters or not for what I'm trying to do).
Tia,

Tim

TinCanTech

texastim65 wrote Client1 (Corporate machine) config file
ifconfig-push 10.8.0.3 255.255.255.0
push "route 10.10.86.0 255.255.255.0 10.8.0.1"
iroute 172.27.12.0 255.255.255.0

Client2 (Remote laptop) config file
ifconfig-push 10.8.0.2 255.255.255.0
route "push 172.27.12.0 255.255.255.0 10.8.0.1"
iroute 10.10.86.0 255.255.255.0

that goes in the main server config ..

texastim65

OK, I moved the 'route push' lines to the server.conf as seen below :

Server.conf File:
port 1194
proto udp
dev tun
sndbuf 0
rcvbuf 0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-auth ta.key 0
topology subnet
server 10.8.0.0 255.255.255.0
route 172.27.12.0 255.255.255.0 10.8.0.3
route 10.10.86.0 255.255.255.0 10.8.0.2
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 75.75.75.75"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 127.0.0.1"
push "route 172.27.12.0 255.255.255.0 10.8.0.1"
push "route 10.10.86.0 255.255.255.0 10.8.0.1"
keepalive 10 120
cipher AES-256-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem
client-to-client
client-config-dir /etc/openvpn/clients

Client1 File:
ifconfig-push 10.8.0.3 255.255.255.0
iroute 172.27.12.0 255.255.255.0

Client2 File:
ifconfig-push 10.8.0.2 255.255.255.0
iroute 10.10.86.0 255.255.255.0

On my Linux Server the routing table appears as follows:
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 50-79-78-190-st 0.0.0.0 UG 0 0 0 ens33
10.8.0.0 * 255.255.255.0 U 0 0 0 tun0
10.10.86.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
50.79.78.0 * 255.255.255.0 U 0 0 0 ens33
link-local * 255.255.0.0 U 1000 0 0 tun0
172.27.12.0 10.8.0.3 255.255.255.0 UG 0 0 0 tun0

which looks OK as far as I can tell.

I connect my 2 VPN clients and again everyone can ping each other on the 10.8.* address scheme. But no one can ping the actual host machine LAN IPs (172.27.12.1 and 10.10.86.140). This includes the Linux server (it can't ping host machine LAN IP's either).

I ran Wireshark on the 172.27.12.1 Windows machine and captured traffic on the VPN interface (10.8.0.3).
From the Linux server I do a 'ping 10.8.0.3' and Wireshark shows the incoming ICMP request from 10.8.0.1 and the reply sent back which makes sense since the ping on the 10.8 address work.
From the Linux server I do a 'ping 172.27.12.1' and Wireshows no incoming ICMP requests from 10.8.0.1

So I have to assume something's not setup right in server.conf file with regards to routing. But nothing seems obvious.

TIA,

Tim

texastim65

Just a quick note to say I've got it working now.

I had to enable IP forwarding on my 2 Windows client machines in order for them to ping each other and then fix the routing in server.conf to:
push "route 172.27.12.0 255.255.255.0 10.8.0.3"
push "route 10.10.86.0 255.255.255.0 10.8.0.2"

Lastly I commented out
#push "redirect-gateway def1 bypass-dhcp"

to allow reaching other machines on the subnets (finish the 'road warrior')

The Linux server still can't ping the 2 client machines LAN IP addresses but that's OK because I don't need that feature.

Tim

TinCanTech

texastim65 wrote Just a quick note to say I've got it working now

Good stuff 8-)