etantonio
Hi,
I've a openvpn server on Ubuntu 18.04 and an openvpn client on a router "Maestro E220"
The vpn works without problems only using vpn addresses, so the ubuntu server 10.8.0.1 can ping the router "Maestro E220" 10.8.0.4 and vice versa.
but the ubuntu server can't ping the "Maestro E220" lan address 192.168.0.1
solergy@Solergy-CS:~$ ping 192.168.0.1
PING 192.168.0.1 (192.168.0.1) 56(84) bytes of data.
^C
--- 192.168.0.1 ping statistics ---
6 packets transmitted, 0 received, 100% packet loss, time 5100ms
this is the server conf:
port 1194
proto udp
dev tun
sndbuf 0
rcvbuf 0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-auth ta.key 0
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem
push "route 192.168.0.0 255.255.255.0"
push "route 192.168.2.0 255.255.255.0"
client-config-dir ccd
route 192.168.0.0 255.255.255.0
route 192.168.2.0 255.255.255.0
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
log openvpn.log
management localhost 7505
explicit-exit-notify 1
and this is the client conf:
client
dev tun
proto udp
sndbuf 0
rcvbuf 0
remote 212.XXX.XX.65 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
setenv opt block-outside-dns
key-direction 1
verb 3
pull
<ca></ca>
<cert></cert>
<key></key>
<tls-auth></tls-auth>
this is openvpn-status.log :
Every 1.0s: cat /etc/openvpn/openvpn-status.log Solergy-CS: Wed Oct 24 17:21:19 2018
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
client__Formello__212_XXX_XX_65,5.XX.XX.5:41570,3561228,3229707,Wed Oct 24 15:53:09 2018
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
10.8.0.4,client__Formello__212_XXX_XX_65,5.XX.XX.5:41570,Wed Oct 24 17:21:09 2018
192.168.0.34C,client__Formello__212_XXX_XX_65,5.XX.XX.5:41570,Wed Oct 24 17:21:09 2018
192.168.0.0/24,client__Formello__212_XXX_XX_65,5.XX.XX.5:41570,Wed Oct 24 15:53:19 2018
192.168.0.183C,client__Formello__212_XXX_XX_65,5.XX.XX.5:41570,Wed Oct 24 17:21:09 2018
GLOBAL STATS
Max bcast/mcast queue length,2
END
and the content of file /etc/openvpn/ccd/client__Formello__212_XXX_XX_65 is:
iroute 192.168.0.0 255.255.255.0
Server Ubuntu static routes:
solergy@Solergy-CS:~$ route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 212.XXX.XX.1 0.0.0.0 UG 0 0 0 eth0
10.8.0.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0
192.168.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
192.168.2.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
212.XXX.XX.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
Maestro Router static routes:
root@Maestro:~# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 10.8.0.1 128.0.0.0 UG 0 0 0 tun0
0.0.0.0 5.92.34.6 0.0.0.0 UG 7 0 0 eth1
5.0.0.0 0.0.0.0 255.0.0.0 U 7 0 0 eth1
10.8.0.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0
128.0.0.0 10.8.0.1 128.0.0.0 UG 0 0 0 tun0
192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 br-lan
192.168.2.0 10.8.0.1 255.255.255.0 UG 0 0 0 tun0
212.XXX.XX.65 5.XX.XX.6 255.255.255.255 UGH 0 0 0 eth1
Can you help me to understand why the server cannot ping 198.168.0.1 ?
Thanks,
Antonio
etantonio
Please excuse me, this is the same command but on the "router Maestro"
ip_forward is enabled:
# cat /etc/sysctl.conf
kernel.panic=3
net.ipv4.conf.default.arp_ignore=1
net.ipv4.conf.all.arp_ignore=1
net.ipv4.ip_forward=1
net.ipv4.icmp_echo_ignore_broadcasts=1
net.ipv4.icmp_ignore_bogus_error_responses=1
net.ipv4.igmp_max_memberships=100
net.ipv4.tcp_ecn=0
net.ipv4.tcp_fin_timeout=30
net.ipv4.tcp_keepalive_time=120
net.ipv4.tcp_syncookies=1
net.ipv4.tcp_timestamps=1
net.ipv4.tcp_sack=1
net.ipv4.tcp_dsack=1
net.ipv6.conf.default.forwarding=1
net.ipv6.conf.all.forwarding=1
net.netfilter.nf_conntrack_acct=1
net.netfilter.nf_conntrack_checksum=0
net.netfilter.nf_conntrack_max=16384
net.netfilter.nf_conntrack_tcp_timeout_established=7440
net.netfilter.nf_conntrack_udp_timeout=60
net.netfilter.nf_conntrack_udp_timeout_stream=180
net.netfilter.nf_conntrack_skip_filter=1
# disable bridge firewalling by default
net.bridge.bridge-nf-call-arptables=0
net.bridge.bridge-nf-call-ip6tables=0
net.bridge.bridge-nf-call-iptables=0
