Machine connecting through OpenVPN cant ping myself?

phoney

I am connected using OpenVPN and have SSH'd onto a machine. However on that machine I can't ping myself using my tun0 ip?

[My Machine] -> [OpenVPN] -> [Machine] Is how I am connecting but if I try ping myself (10.8.0.6) from that machine I get no response. Any ideas?

Server.conf

I need push "route 10.0.0.0 255.255.255.0" as I the machines are all hosted on the 10.* network,

port 1194
proto udp
dev tun
sndbuf 0
rcvbuf 0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-auth ta.key 0
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.0.0.0 255.255.255.0"
push "route-metric 1000"
keepalive 10 120
cipher AES-256-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log-append openvpn.log
verb 5
inactive 300
crl-verify crl.pem
script-security 2
up /etc/openvpn/update-resolv-conf

Client.conf

client
dev tun
proto udp
sndbuf 0
rcvbuf 0
remote 18.202.129.195 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
comp-lzo
pull
key-direction 1
verb 3

Any help?

phoney

https://community.openvpn.net/openvpn/wiki/263-openvpn-can-ping-both-peers-but-i-cant-reach-any-of-the-other-machines-on-the-remote-subnet

I am using AWS so I think it might be to do with that?? Do I need a route from OpenVPN gateway to something?

Pippin

10.0.0.0/8 includes 10.8.0.0/24
Fix your subnets first...no overlap allowed.

phoney

Pippin wrote 10.0.0.0/8 includes 10.8.0.0/24
Fix your subnets first...no overlap allowed.

Hey, where do I need to amend this? On my server.conf? Fairly new to this sorry.

I am trying to ping 10.8.0.6 from 10.0.0.39. I can see if overlaps but where has 10.0.08 come from?

Thank you!

Should push "route 10.0.0.0 255.0.0.0" be push "route 10.0.0.0 255.255.255.0" ? (Update: Can't be as I just tried that and it didn't work. So must be a further problem?)
At the moment we only have machines on 10.0.0.*

phoney

I think I have them not overlapping, as I said in my last post I changed it to: push "route 10.0.0.0 255.255.255.0"

But I still am unable to ping my tun0 from the machine I am connected to via OpenVPN. I am also unable to ping my public ip address but can ping google.com

If its helps when I try to perform a traceroute on remote machine it goes to 79.125.0.114 than hangs? Shouldn't it go to the OpenVPN gateway first?

phoney

My OpenVPN IP tables:

ubuntu@ip-10-0-0-20:~$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

phoney

This is my AWS routing table for the subnet its on. 10.0.0.0/16? This won't include 10.8 tho? I thought because it was coming out of the openvpn it wouldn't need anything other routes?

When pinging my machine from OpenVPN and using tcpdump I get: 20:08:26.549911 IP ip-10-8-0-6.eu-west-1.compute.internal > ip-10-8-0-1.eu-west-1.compute.internal: ICMP echo reply, id 23763, seq 5, length 64 ?

When pining my machine from a machine I am connected to via OpenVPN it hands, traceroute gets stuck at 79.125.0.186 as it doesn't know what to do with it.

phoney

It looks like when I ping my tun0 (10.8.0.6) from the machine via OpenVPN it goes to 79.125.0.18 first off. Should it be redirected to OpenVPN's gateway first? Which I think is 10.8.0.1? Which means, shouldn't I change it somewhere to route all 10.* traffic to my OpenVPNs gateway? Can I do this with its public IP?

phoney

I fixed this. It was an AWS issue. I needed to add a route table entry from anything on 10.8.0.0/16 to forward to OpenVPN instance.

Best feeling ever when this gets fixed!