I'm trying to set up my first manual OpenVPN server (in the past I've always just used PFSense and it's nice easy management GUI), but I've hit a bit of a roadblock.
- I've got an OpenVPN server configured with (imaginary) public IP address 1.1.1.2 - this should use the 10.8.0.0 subnet for VPN clients.
- I've got clientA which is a 4G router with an OpenVPN client built in - this should have the fixed IP within the VPN of 10.8.0.4. The local LAN of
- 192.168.100.0/24[/i] should be accessible to both clientB and the openVPN server.
- I've got clientB which is a 4G router with an OpenVPN client built in - this should have the fixed IP within the VPN of 10.8.0.5. The local LAN of
- 192.168.200.0/24[/i] should be accessible to both clientA and the openVPN server.
I've got it configured so that both
clientA and
clientB can connect to the OpenVPN server, are assigned the configured IP addresses and access the internet through it without a problem.
However, none of the following work:
- I cannot ping clientA (10.8.0.4) from the openVPN server, even when specifying the tun0 adapter directly (eg: "ping -I tun0 10.8.0.4"). Pings time out.
- I cannot ping clientB (10.8.0.5) from the openVPN server, even when specifying the tun0 adapter directly (eg: "ping -I tun0 10.8.0.5"). Pings time out.
- I cannot ping clientA from clientB or the other way around. Pings time out.
I've also tried listening on tun0 using "tcpdump -i tun0" whilst trying to ping from the server to
clientA, and got the following results:
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 262144 bytes
16:59:29.185707 IP vpn > 10.8.0.4: ICMP echo request, id 29980, seq 1, length 64
16:59:30.216125 IP vpn > 10.8.0.4: ICMP echo request, id 29980, seq 2, length 64
16:59:31.240105 IP vpn > 10.8.0.4: ICMP echo request, id 29980, seq 3, length 64
16:59:32.264117 IP vpn > 10.8.0.4: ICMP echo request, id 29980, seq 4, length 64
16:59:33.288131 IP vpn > 10.8.0.4: ICMP echo request, id 29980, seq 5, length 64
16:59:34.312126 IP vpn > 10.8.0.4: ICMP echo request, id 29980, seq 6, length 64
16:59:35.336137 IP vpn > 10.8.0.4: ICMP echo request, id 29980, seq 7, length 64
I've included below my configuration files, as well as some other information that may be helpful.
/etc/openvpn/server.conf
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ccd
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 1.0.0.1"
client-to-client
keepalive 10 120
tls-auth ta.key 0
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
verb 3
explicit-exit-notify 1
key-direction 0
auth SHA256
route 192.168.100.0 255.255.255.0
route 192.168.200.0 255.255.255.0
push "route 192.168.100.0 255.255.255.0"
push "route 192.168.200.0 255.255.255.0"
/etc/openvpn/ccd/clientA
ifconfig-push 10.8.0.4 255.255.255.0
iroute 192.168.100.0 255.255.255.0
/etc/openvpn/ccd/clientB
ifconfig-push 10.8.0.5 255.255.255.0
iroute 192.168.200.0 255.255.255.0
net.ipv4.ip_forward = 1
route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 1.1.1.1 0.0.0.0 UG 0 0 0 eth0
10.8.0.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0
10.16.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0
178.62.64.0 0.0.0.0 255.255.192.0 U 0 0 0 eth0
192.168.100.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
192.168.200.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
iptables rules
#!/usr/bin/env bash
set -e
# Flushing all rules
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -t nat -F
iptables -t mangle -F
iptables -F
iptables -X
# Setting default filter policy
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
# Allow unlimited traffic on loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# Allow ICMP ping
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
# Allow established and related incoming connections
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
# Allow established outgoing connections
iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
# Allow SSH
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
# Allow OpenVPN UDP incoming
iptables -A INPUT -i eth0 -m state --state NEW -p udp --dport 1194 -j ACCEPT
# Allow TUN interface connections to OpenVPN server
iptables -A INPUT -i tun+ -j ACCEPT
# Allow TUN interface connections to be forwarded through other interfaces
iptables -A FORWARD -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
# NAT VPN traffic to the internet
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -o eth0 -j MASQUERADE
Any ideas would be much appreciated. I've been trying to wrap my head around this for several hours so far this afternoon!
