Hi guys!
Here´s my problem: I'm trying to route traffic from site A through a VM connected via OpenVPN tun to site B, but the traffic is not routed. This is my setup:
- On site A I´m running a VM with Ubuntu Server 18.04.3 LTS. This VM is supposed to be the VPN gateway for site A. The OpenVPN client on the VM is successfully connected to the server on site B and works so far. OpenVPN version 2.4.4-2ubuntu1.3
- The standard gateway on site A has a static route setup to the VM, so computers sending traffic to site B are routed to the VM.
- Site B has a OpenVPN server running on a Synology device (for testing now, will be a dedicated OpenVPN server later when working)
Client VM Ubuntu:
uname -a:
Linux ubuntuserver 4.15.0-70-generic #79-Ubuntu SMP Tue Nov 12 10:36:11 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
$ ifconfig
enp0s3: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.0.7.33 netmask 255.255.255.0 broadcast 10.0.7.255
inet6 fe80::a00:27ff:feda:952 prefixlen 64 scopeid 0x20<link>
ether 08:00:27:da:09:52 txqueuelen 1000 (Ethernet)
RX packets 4259 bytes 319197 (319.1 KB)
RX errors 0 dropped 2792 overruns 0 frame 0
TX packets 873 bytes 117777 (117.7 KB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 84 bytes 6264 (6.2 KB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 84 bytes 6264 (6.2 KB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1500
inet 10.8.0.6 netmask 255.255.255.255 destination 10.8.0.5
inet6 fe80::8453:bec4:54ad:cd51 prefixlen 64 scopeid 0x20<link>
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 100 (UNSPEC)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 10 bytes 480 (480.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
Setup of the VM:
I used a tutorial from the OpenVPN site to add the following iptables to route traffic through the VM:
iptables -t nat -A POSTROUTING -o enp0s3 -j MASQUERADE
iptables -A INPUT -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -o enp0s3 -j ACCEPT
iptables -A FORWARD -i enp0s3 -o tun+ -j ACCEPT
$ sudo iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -i tun+ -j ACCEPT
-A FORWARD -i tun+ -o enp0s3 -j ACCEPT
-A FORWARD -i enp0s3 -o tun+ -j ACCEPT
$ sudo iptables -L -v
Chain INPUT (policy ACCEPT 910 packets, 82727 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- tun+ any anywhere anywhere
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- tun+ enp0s3 anywhere anywhere
0 0 ACCEPT all -- enp0s3 tun+ anywhere anywhere
Chain OUTPUT (policy ACCEPT 566 packets, 66672 bytes)
pkts bytes target prot opt in out source destination
$ ip route
default via 10.0.7.1 dev enp0s3 proto dhcp src 10.0.7.33 metric 100
10.0.0.0/24 via 10.8.0.5 dev tun0
10.0.7.0/24 dev enp0s3 proto kernel scope link src 10.0.7.33
10.0.7.1 dev enp0s3 proto dhcp scope link src 10.0.7.33 metric 100
10.8.0.0/24 via 10.8.0.5 dev tun0
10.8.0.1 via 10.8.0.5 dev tun0
10.8.0.5 dev tun0 proto kernel scope link src 10.8.0.6
$ netstat -rn
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 10.0.7.1 0.0.0.0 UG 0 0 0 enp0s3
10.0.0.0 10.8.0.5 255.255.255.0 UG 0 0 0 tun0
10.0.7.0 0.0.0.0 255.255.255.0 U 0 0 0 enp0s3
10.0.7.1 0.0.0.0 255.255.255.255 UH 0 0 0 enp0s3
10.8.0.0 10.8.0.5 255.255.255.0 UG 0 0 0 tun0
10.8.0.1 10.8.0.5 255.255.255.255 UGH 0 0 0 tun0
10.8.0.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
dev tun
tls-client
remote x.x.x.x 1194
# The "float" tells OpenVPN to accept authenticated packets from any address,
# not only the address which was specified in the --remote option.
# This is useful when you are connecting to a peer which holds a dynamic address
# such as a dial-in user or DHCP client.
# (Please refer to the manual of OpenVPN for more information.)
#float
# If redirect-gateway is enabled, the client will redirect it's
# default network gateway through the VPN.
# It means the VPN connection will firstly connect to the VPN Server
# and then to the internet.
# (Please refer to the manual of OpenVPN for more information.)
#redirect-gateway def1
# dhcp-option DNS: To set primary domain name server address.
# Repeat this option to set secondary DNS server addresses.
#dhcp-option DNS DNS_IP_ADDRESS
pull
# If you want to connect by Server's IPv6 address, you should use
# "proto udp6" in UDP mode or "proto tcp6-client" in TCP mode
proto udp
script-security 2
comp-lzo
reneg-sec 0
cipher AES-128-CBC
auth SHA512
auth-user-pass
<ca>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</ca>
I don´t have the server config, since it is running on a Synology NAS for testing, but I think the problem is the routing through the VM on site A. What am I missing? The VM is connected to the OpenVPN server, I can ping the server and machines on site B from the VM. But somehow the VM is unable to route traffic from site A through the tun0 device.
Ping from a machine on site A:
PING 10.0.0.10 (10.0.0.10): 56 data bytes
92 bytes from fritz.box (10.0.7.1): Redirect Host(New addr: 10.0.7.33)
Vr HL TOS Len ID Flg off TTL Pro cks Src Dst
4 5 00 0054 b177 0 0000 3f 01 aec4 10.0.7.100 10.0.0.10
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
Request timeout for icmp_seq 3
Request timeout for icmp_seq 4
I appreciate your help!
