When connected to the VPN, the client can ping the server on its tun0 IP, but it can't ping / reach it's eth0 IP. I need all VPN clients to be able to reach eth0 to access a service hosted on this IP. It has to be the eth0 IP due to the way the service works. Can anyone advise how you allow tun0 to see eth0? There is nothing else on the LAN side to test pinging, as this a VoIP server hosted in Azure.
Client LAN IP - 192.168.101.13
Client VPN IP - 10.8.0.2
Server eth0 IP - 10.0.2.4
Server tun0 - 10.8.0.1
//Server
"tcpdump -nni eth0 icmp" returns nothing when I ping 10.0.2.4 from the client
When I ping 10.0.2.4 from the client i see the following on tun0, and the client gets no reply
SPLICE-INT-001:/home/splicecom # tcpdump -nni tun0 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 262144 bytes
09:13:54.519688 IP 10.8.0.2 > 10.0.2.4: ICMP echo request, id 52981, seq 0, length 64
09:13:55.523550 IP 10.8.0.2 > 10.0.2.4: ICMP echo request, id 52981, seq 1, length 64
09:13:56.526804 IP 10.8.0.2 > 10.0.2.4: ICMP echo request, id 52981, seq 2, length 64
09:13:57.526428 IP 10.8.0.2 > 10.0.2.4: ICMP echo request, id 52981, seq 3, length 64
09:13:58.531522 IP 10.8.0.2 > 10.0.2.4: ICMP echo request, id 52981, seq 4, length 64
09:13:59.533913 IP 10.8.0.2 > 10.0.2.4: ICMP echo request, id 52981, seq 5, length 64
09:14:00.538559 IP 10.8.0.2 > 10.0.2.4: ICMP echo request, id 52981, seq 6, length 64
When I ping bbc.co.uk from the client, the client gets a reply and we see the following TCP dump
SPLICE-INT-001:/home/splicecom # tcpdump -nni eth0 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
09:20:09.636335 IP 10.0.2.4 > 151.101.128.81: ICMP echo request, id 29688, seq 0, length 64
09:20:09.639204 IP 151.101.128.81 > 10.0.2.4: ICMP echo reply, id 29688, seq 0, length 64
09:20:10.639324 IP 10.0.2.4 > 151.101.128.81: ICMP echo request, id 29688, seq 1, length 64
09:20:10.642019 IP 151.101.128.81 > 10.0.2.4: ICMP echo reply, id 29688, seq 1, length 64
09:20:11.644291 IP 10.0.2.4 > 151.101.128.81: ICMP echo request, id 29688, seq 2, length 64
09:20:11.646956 IP 151.101.128.81 > 10.0.2.4: ICMP echo reply, id 29688, seq 2, length 64
09:20:12.648716 IP 10.0.2.4 > 151.101.128.81: ICMP echo request, id 29688, seq 3, length 64
09:20:12.651545 IP 151.101.128.81 > 10.0.2.4: ICMP echo reply, id 29688, seq 3, length 64
When I ping the tun0 address from the client I get the below and the client gets a reply:
SPLICE-INT-001:/home/splicecom # tcpdump -nni tun0 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 262144 bytes
09:16:43.271234 IP 10.8.0.2 > 10.8.0.1: ICMP echo request, id 63478, seq 0, length 64
09:16:43.271265 IP 10.8.0.1 > 10.8.0.2: ICMP echo reply, id 63478, seq 0, length 64
09:16:44.272099 IP 10.8.0.2 > 10.8.0.1: ICMP echo request, id 63478, seq 1, length 64
09:16:44.272119 IP 10.8.0.1 > 10.8.0.2: ICMP echo reply, id 63478, seq 1, length 64
09:16:45.274312 IP 10.8.0.2 > 10.8.0.1: ICMP echo request, id 63478, seq 2, length 64
09:16:45.274331 IP 10.8.0.1 > 10.8.0.2: ICMP echo reply, id 63478, seq 2, length 64
09:16:46.275044 IP 10.8.0.2 > 10.8.0.1: ICMP echo request, id 63478, seq 3, length 64
09:16:46.275063 IP 10.8.0.1 > 10.8.0.2: ICMP echo reply, id 63478, seq 3, length 64
IP Forwarding is enabled
SPLICE-INT-001:/home/splicecom # cat /proc/sys/net/ipv4/ip_forward
1
ip route
default via 10.0.2.1 dev eth0 proto dhcp
10.0.2.0/24 dev eth0 proto kernel scope link src 10.0.2.4
10.8.0.0/24 dev tun0 proto kernel scope link src 10.8.0.1
168.63.129.16 via 10.0.2.1 dev eth0 proto dhcp
169.254.169.254 via 10.0.2.1 dev eth0 proto dhcp
#change with your port
port 1194
#You can use udp or tcp
proto udp
# "dev tun" will create a routed IP tunnel.
dev tun
topology subnet
client-to-client
#Certificate Configuration
#ca certificate
ca /etc/easy-rsa/pki/ca.crt
#Server Certificate
cert /etc/easy-rsa/pki/issued/server.crt
#Server Key and keep this is secret
#askpass /etc/easy-rsa/pki/private/server.pass
key /etc/easy-rsa/pki/private/server.key
#See the size a dh key in /etc/openvpn/keys/
dh /etc/easy-rsa/pki/dh.pem
#Internal IP will get when already connect
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /var/log/openvpn/ipp.txt
#this line will redirect all traffic through our OpenVPN
push "redirect-gateway def1 bypass-dhcp"
push "route 10.0.2.0 255.255.255.0"
#Provide DNS servers to the client, you can use goolge DNS
push "dhcp-option DNS 1.1.1.1"
#Enable multiple client to connect with same key
duplicate-cn
cipher AES-256-CBC
keepalive 1 5
compress lzo
persist-key
persist-tun
daemon
#openvpn status log
status /var/log/openvpn/openvpn-status.log
status-version 2
#enable log
log-append /var/log/openvpn/openvpn.log
#Log Level
verb 4
explicit-exit-notify 1
//Client
netstat -rn
Routing tables
Internet:
Destination Gateway Flags Refs Use Netif Expire
0/1 10.8.0.1 UGSc 109 1 utun3
default 192.168.101.254 UGSc 5 869 en0
10.0.2/24 10.8.0.1 UGSc 0 20 utun3
10.8/24 10.8.0.2 UGSc 22 30 utun3
10.8.0.2 10.8.0.2 UH 2 0 utun3
10.37.129/24 link#19 UC 1 0 vnic1 !
10.37.129.2 0:1c:42:0:0:9 UHLWIi 1 28 lo0
10.211.55/24 link#18 UC 1 0 vnic0 !
10.211.55.2 0:1c:42:0:0:8 UHLWIi 1 18 lo0
51.n.n.49/32 192.168.101.254 UGSc 1 0 en0
127 127.0.0.1 UCS 0 0 lo0
127.0.0.1 127.0.0.1 UH 5 101740 lo0
127.94.0.1 127.94.0.1 UH 0 118 lo0
128.0/1 10.8.0.1 UGSc 7 0 utun3
169.254 link#7 UCS 1 0 en0 !
192.168.101 link#7 UC 4 0 en0 !
192.168.101.10 f0:99:b6:2d:12:c UHLWIi 2 63 en0 792
192.168.101.13/32 link#7 UCS 1 0 en0 !
192.168.101.13 8c:85:90:d2:bd:b3 UHLWIi 1 86 lo0
192.168.101.21 d0:c5:f3:9f:8c:54 UHLWI 0 4 en0 673
192.168.101.22 70:e7:2c:80:77:fe UHLWIi 1 49 en0 672
192.168.101.150 24:5e:be:3:fa:9e UHLWI 0 0 en0 431
192.168.101.254/32 link#7 UCS 1 0 en0 !
192.168.101.254 0:1d:aa:77:96:98 UHLWIir 4 12750 en0 1146
224.0.0/4 link#7 UmCS 3 0 en0 !
224.0.0.251 1:0:5e:0:0:fb UHmLWI 0 95 en0
224.0.0.252 1:0:5e:0:0:fc UHmLWI 0 57 en0
239.255.255.250 1:0:5e:7f:ff:fa UHmLWI 0 3 en0
255.255.255.255/32 link#7 UCS 0 0 en0 !
client
setenv SERVER_Poll_TIMEOUT 4
nobind
proto udp #Transport protocol (udp or tcp) of the VPN server
remote 51.n.n.49 1194 #Outside IP address and port of the VPN server
dev tun #Virtual network interface(tun or tap)
dev-type tun
persist-tun
persist-key
auth-nocache
remote-cert-tls server
cipher AES-256-CBC
ca /config/openvpn/keys/ca.crt #CA certificate
cert /config/openvpn/keys/client.crt #Client certificate
key /config/openvpn/keys/client.key #Private key of the client
verb 3 #Log level
compress lzo
