[Solved] Static Route Unreach

revanhernandy

Hi all,
I have some problem with routing by OpenVPN as follows:
1. OpenVPN Server (Ubuntu 16.04 OpenVPN 2.4.5) and Client (Mikrotik)
2. IP server 10.3.0.1 (Ubuntu) Client 10.3.0.2(Mikrotik)
3. LAN OpenVPN Server 172.22.0.0/24, OpenVPN Server LAN IP 172.22.0.10
4. LAN OpenVPN Client 192.168.0.0/24, 192.168.1.0/24, 192.168.2.0/24, OpenVPN Client LAN IP 192.168.30.4
Problem:
Unreach between LAN Server and LAN Client
1. Server Routing:
ip route add 192.168.0.0/24 via 10.3.0.2 dev tun0
ip route add 192.168.1.0/24 via 10.3.0.2 dev tun0
ip route add 192.168.2.0/24 via 10.3.0.2 dev tun0
2. Client (Mikrotik) routing
ip route add dst-address=172.22.0.0/24 gateway=10.3.0.1 (reachable openvpn-out-interface)

The routing already created, but they can ping on each other.

Server Config:
mode p2p
bind
port 1194
proto tcp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
mssfix
dh /etc/openvpn/dh2048.pem
server 10.3.0.0 255.255.255.0
client-config-dir /etc/openvpn/jsm
ifconfig-pool-persist ipp.txt
duplicate-cn
keepalive 10 60
key-direction 0
cipher AES-128-CBC # AES
auth SHA1
user nobody
persist-key
persist-tun
status /etc/openvpn/openvpn-status.log
log-append /etc/openvpn/openvpn.log
verb 3
sndbuf 393216
rcvbuf 393216
push "sndbuf 393216"
push "rcvbuf 393216"
tun-mtu 1400

Client config:
client
dev tun
proto tcp
remote xxxxx 1194
resolv-retry infinite
bind
user nobody
persist-key
persist-tun
setenv PUSH_PEER_INFO
setenv FORWARD_COMPATIBLE 1
remote-cert-tls server
cipher AES-128-CBC
auth SHA1
key-direction 1
comp-lzo no
verb 4
<ca>
</ca>
<cert>
Certificate:
</cert>
<key>

</key>
<tls-auth>

</tls-auth>

Anybody can help?
Thank you

TinCanTech

Logs at verb 4 please.

Please see:
https://forums.openvpn.net/viewtopic.php?f=30&t=22603#p68963

revanhernandy

Hi,
Here is the log
SERVER LOG (--verb 4):

server log file (--verb 4) Wed Apr 10 14:54:22 2019 xxxx.46250 Outgoing Data Channel: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Apr 10 14:54:22 2019 xxxxx:46250 Incoming Data Channel: Cipher 'AES-128-CBC' initialized with 128 bit key
Wed Apr 10 14:54:22 2019 xxxxx:46250 Incoming Data Channel: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Apr 10 14:54:22 2019 xxxxx:46250 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Wed Apr 10 14:54:22 2019 xxxxx:46250 [client2] Peer Connection Initiated with [AF_INET]xxxxx:46250
Wed Apr 10 14:54:22 2019 client2/xxxxx:46250 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/jsm/client2
Wed Apr 10 14:54:22 2019 client2/xxxxxx:46250 MULTI: Learn: 10.3.0.6 -> client2/xxxxx:46250
Wed Apr 10 14:54:22 2019 client2/xxxxx:46250 MULTI: primary virtual IP for client2/xxxxx:46250: 10.3.0.6
Wed Apr 10 14:54:22 2019 client2/xxxxx:46250 PUSH: Received control message: 'PUSH_REQUEST'
Wed Apr 10 14:54:22 2019 client2/xxxxx:46250 SENT CONTROL [client2]: 'PUSH_REPLY,redirect-gateway,sndbuf 393216,rcvbuf 393216,route 10.3.0.1,topology net30,ping 10,ping-restart 60,route 172.17.254.0 255.255.255.0 10.3.0.5,ifconfig 10.3.0.6 10.3.0.5' (status=1)

TinCanTech

According to your log, openvpn is working normally.

Note:

revanhernandy wrote Server Config:
mode p2p

--server over rides --mode p2p with --mode server

revanhernandy

SOLVED

I create static IP for user with client-config-dir and then add the routing table on the user configuration as with iroute command

Thank you