Hello guys,
I want to do my VPN-connections via OpenVPN. And now I think I got stuck in something I can't find any solution no more. I investigated already so much time to get it working, but it really won't..
What I want/need:
- a VPN connection based on tap for my site-to-site connections.
- a VPN connection based on tap for my laptops full traffic to my VPN-server, including internet connections.
- a VPN connection based on tun for my smartphone full traffic to my VPN-server, including internet connections (is already working and just mentioned to prevent any conflicts).
- Server (host) is running Debian Stretch version 4.9.0-8-amd64.
- Client laptops are running Windows 10 newest version.
- Clients for site-to-site are Rasperry Pi 3s running Raspbian 4.14.72-v7+.
My problem is, that the initial tap-connection worked already, but anyhow it won't work anymore for all clients except one Raspberry Pi, which still works. All other clients, which worked before have now the problem (log on client):
Recursive routing detected, drop tun packet to [AF_INET]<remote IP:Port>
Sporadically the connection is working, but most of the time it doesn't.
On the server I get a warning, which I can ignore I think (?), because I get it with all tap-clients, also the working one:
test.net/<client external ip:port> MULTI: no dynamic or static remote --ifconfig address is available for test.net/<client external ip:port>
My host is running at 192.168.0.0/24.
My clients are running at 192.168.<different to each network>.0/24.
port 1194
mode server
passtos
fast-io
proto udp
dev tap0
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/test.crt
key /etc/openvpn/easy-rsa/keys/test.key # This file should be kept secret
dh /etc/openvpn/easy-rsa/keys/dh4096.pem
topology subnet
client-to-client
keepalive 10 120
tls-auth /etc/openvpn/ta.key 0 # This file is secret
tls-server
remote-cert-tls client
cipher AES-256-CBC
compress lz4-v2
push "compress lz4-v2"
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
explicit-exit-notify 1
port 11952
proto udp
dev tun0
mode server
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/test.crt
key /etc/openvpn/easy-rsa/keys/test.key # This file should be kept secret
dh /etc/openvpn/easy-rsa/keys/dh4096.pem
topology subnet
server 10.8.0.0 255.255.255.0
;server-ipv6 fe82::/112
ifconfig-pool-persist ipp.txt
push "route 192.168.0.0 255.255.255.0"
;push "route-ivp6 fe80::/3"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 192.168.0.1"
push "dhcp-option WINS 192.168.0.1"
client-to-client
keepalive 10 120
tls-auth /etc/openvpn/ta.key 0 # This file is secret
tls-server
remote-cert-tls client
cipher AES-256-CBC
compress lz4-v2
push "compress lz4-v2"
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
passtos
fast-io
explicit-exit-notify 1
client
dev tap0
proto udp4
remote test.net 1194
resolv-retry infinite
nobind
persist-key
persist-tun
passtos
fast-io
ca /etc/openvpn/ca.crt
cert /etc/openvpn/test.crt
key /etc/openvpn/test.key
tls-auth /etc/openvpn/ta.key 1
remote-cert-tls server
verb 3
Server /etc/network/interfaces
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
source /etc/network/interfaces.d/*
# The loopback network interface
auto lo
iface lo inet loopback
iface br0 inet dhcp
pre-up ip link add br0 type bridge
pre-up ip link set tap0 up
pre-up ip link set tap0 master br0
pre-up ip link set enp3s0 down
pre-up ip addr flush enp3s0
pre-up ip link set enp3s0 up
pre-up ip link set enp3s0 master br0
pre-up ip link set br0 up
post-down ip link delete br0
hwaddress ether 62:5D:11:DB:7A:35
bridge_ports enp3s0 tap0
iface br0 inet6 auto
Server iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Server iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 10.8.0.0/24 anywhere
I've tested now so many hours without getting any step further to get this recursive routing problem fixed.
Strange thing is: my clients look all the same if they are connected in ip addr show: they got on tap0 a connection to my network 192.168.0.0/24 with all the gateways, etc.
What am I missing or doing wrong?
It's really frustrating to had it working with the same settings before. The only thing I can think of, after I had my network changed for a short time to 192.168.0.0/17 for testing why the site-to-site isn't working, it stopped working at all for tap. I changed everything back and at least quattro-checked all things I changed, but it's still not working. It wouldn't make even any sense, because that one client can still connect, it should have to fail the same way, shouldn't it?
Is maybe OpenVPN saving something for this particular one client or are the others maybe just blocked?
If you need any more informations just tell me, I will do my best to gather it for you.
Thank you very much in advance.
