Hi Everyone, I am trying setup RouteLAN OpenVPN setup and I having trouble debugging why a node from client's LAN unable to ping the OpenVPN server but the OpenVPN client node can ping the server.
This is what my setup looks like:
(subnet=192.168.44.0/24) (subnet=10.138.0.2/20)
node(ovpn-client)(192.168.44.143) ----|
(tun0=10.8.0.16) |---- gateway(192.168.44.1) ---- (internet) ---- GCP --|-- VM(ovpn-server)(vpn.example.com)(10.138.0.2)
| (tun0=10.8.0.1)
node(other)(192.168.44.40) ----|
Nodes and their OS:
ovpn-client:
raspbian VERSION="10 (buster)" OpenVPN 2.4.7
gateway:
raspbian VERSION="10 (buster)"
other:
Windows 10 Home
ovpn-server:
Ubuntu 18.04.3 LTS OpenVPN 2.4.4
openvpn server config:
port 443
proto tcp
dev tun
ca ca.crt
cert vpn.example.com.crt
key vpn.example.com.key
dh dh2048.pem
tls-auth tiv.key 0
cipher AES-256-CBC
auth SHA256
persist-key
persist-tun
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /var/log/openvpn/ipp.txt
client-config-dir ccd
push "route 10.138.0.0 255.255.240.0"
client-to-client
keepalive 10 60
max-clients 10
user nobody
group nogroup
status /var/log/openvpn/openvpn-status.log
verb 3
explicit-exit-notify 0
openvpn client config:
client
dev tun
proto tcp
remote vpn.example.com 443
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
remote-cert-tls server
tls-auth ta.key 1
cipher AES-256-CBC
auth SHA256
key-direction 1
script-security 2
auth-nocache
pull-filter ignore redirect-gateway
verb 5
# [redacted] <ca>, <cert>, <key>, and <tls-auth>
gateway routes:
root@gateway:~# ip r
default via 192.168.2.1 dev wlan0 onlink
10.138.0.0/20 via 192.168.44.143 dev eth0
192.168.2.0/24 dev wlan0 proto kernel scope link src 192.168.2.17
192.168.44.0/24 dev eth0 proto kernel scope link src 192.168.44.1
ovpn-client routes:
root@ovpn-client:~# ip r
default via 192.168.44.1 dev eth0 proto dhcp src 192.168.44.143 metric 202
10.8.0.0/24 dev tun0 proto kernel scope link src 10.8.0.16
10.138.0.0/20 via 10.8.0.1 dev tun0
192.168.44.0/24 dev eth0 proto dhcp scope link src 192.168.44.143 metric 202
ovpn-server routes:
root@ovpn-server:~# ip r
default via 10.138.0.1 dev ens4 proto dhcp src 10.138.0.2 metric 100
10.8.0.0/24 dev tun0 proto kernel scope link src 10.8.0.1
10.138.0.1 dev ens4 proto dhcp scope link src 10.138.0.2 metric 100
to help on debugging, I have added iptables logging on both ovpn-client and ovpn-server:
root@ovpn-client:~# iptables -L -t mangle -vn
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
33 2364 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix "prerouting"
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
10 840 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix "input"
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
23 1524 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix "forward"
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
10 840 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix "output"
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
16 1344 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix "postrouting"
root@ovpn-server:~# iptables -L -t mangle -vn
Chain PREROUTING (policy ACCEPT 52 packets, 4499 bytes)
pkts bytes target prot opt in out source destination
11 924 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix "prerouting"
Chain INPUT (policy ACCEPT 52 packets, 4499 bytes)
pkts bytes target prot opt in out source destination
6 504 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix "input"
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix "forward"
Chain OUTPUT (policy ACCEPT 39 packets, 7735 bytes)
pkts bytes target prot opt in out source destination
8 672 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix "output"
Chain POSTROUTING (policy ACCEPT 39 packets, 7735 bytes)
pkts bytes target prot opt in out source destination
10 840 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix "postrouting"
I can ping ovpn-server from ovpn-client:
root@ovpn-client:~# ping 10.138.0.2
PING 10.138.0.2 (10.138.0.2) 56(84) bytes of data.
64 bytes from 10.138.0.2: icmp_seq=1 ttl=64 time=63.4 ms
64 bytes from 10.138.0.2: icmp_seq=2 ttl=64 time=67.2 ms
64 bytes from 10.138.0.2: icmp_seq=3 ttl=64 time=63.7 ms
64 bytes from 10.138.0.2: icmp_seq=4 ttl=64 time=62.10 ms
64 bytes from 10.138.0.2: icmp_seq=5 ttl=64 time=63.0 ms
^C
--- 10.138.0.2 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 10ms
rtt min/avg/max/mdev = 62.977/64.049/67.154/1.590 ms
root@ovpn-client:~# journalctl -f
Jan 11 09:04:31 ovpn-client kernel: preroutingIN=tun0 OUT= MAC= SRC=10.138.0.2 DST=10.8.0.16 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=25825 PROTO=ICMP TYPE=0 CODE=0 ID=12886 SEQ=3
Jan 11 09:04:31 ovpn-client kernel: inputIN=tun0 OUT= MAC= SRC=10.138.0.2 DST=10.8.0.16 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=25825 PROTO=ICMP TYPE=0 CODE=0 ID=12886 SEQ=3
Jan 11 09:04:32 ovpn-client kernel: outputIN= OUT=tun0 SRC=10.8.0.16 DST=10.138.0.2 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=27089 DF PROTO=ICMP TYPE=8 CODE=0 ID=12886 SEQ=4
Jan 11 09:04:32 ovpn-client kernel: postroutingIN= OUT=tun0 SRC=10.8.0.16 DST=10.138.0.2 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=27089 DF PROTO=ICMP TYPE=8 CODE=0 ID=12886 SEQ=4
Jan 11 09:04:32 ovpn-client kernel: preroutingIN=tun0 OUT= MAC= SRC=10.138.0.2 DST=10.8.0.16 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=26056 PROTO=ICMP TYPE=0 CODE=0 ID=12886 SEQ=4
Jan 11 09:04:32 ovpn-client kernel: inputIN=tun0 OUT= MAC= SRC=10.138.0.2 DST=10.8.0.16 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=26056 PROTO=ICMP TYPE=0 CODE=0 ID=12886 SEQ=4
Jan 11 09:04:33 ovpn-client kernel: outputIN= OUT=tun0 SRC=10.8.0.16 DST=10.138.0.2 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=27145 DF PROTO=ICMP TYPE=8 CODE=0 ID=12886 SEQ=5
Jan 11 09:04:33 ovpn-client kernel: postroutingIN= OUT=tun0 SRC=10.8.0.16 DST=10.138.0.2 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=27145 DF PROTO=ICMP TYPE=8 CODE=0 ID=12886 SEQ=5
Jan 11 09:04:33 ovpn-client kernel: preroutingIN=tun0 OUT= MAC= SRC=10.138.0.2 DST=10.8.0.16 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=26257 PROTO=ICMP TYPE=0 CODE=0 ID=12886 SEQ=5
Jan 11 09:04:33 ovpn-client kernel: inputIN=tun0 OUT= MAC= SRC=10.138.0.2 DST=10.8.0.16 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=26257 PROTO=ICMP TYPE=0 CODE=0 ID=12886 SEQ=5
But I cannot ping ovpn-server from other:
C:\>ping -n 1 10.138.0.2
Pinging 10.138.0.2 with 32 bytes of data:
Request timed out.
Ping statistics for 10.138.0.2:
Packets: Sent = 1, Received = 0, Lost = 1 (100% loss),
C:\>tracert -4 -d 10.138.0.2
Tracing route to 10.138.0.2 over a maximum of 30 hops
1 <1 ms <1 ms <1 ms 192.168.44.1
2 1 ms 1 ms 1 ms 192.168.44.143
3 * * ^C
root@ovpn-client:~# journalctl -f
Jan 11 09:09:18 ovpn-client kernel: preroutingIN=eth0 OUT= MAC=[redacted] SRC=192.168.44.40 DST=10.138.0.2 LEN=92 TOS=0x00 PREC=0x00 TTL=2 ID=55441 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=1729
Jan 11 09:09:18 ovpn-client kernel: forwardIN=eth0 OUT=tun0 MAC=[redacted] SRC=192.168.44.40 DST=10.138.0.2 LEN=92 TOS=0x00 PREC=0x00 TTL=1 ID=55441 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=1729
Jan 11 09:09:21 ovpn-client kernel: preroutingIN=eth0 OUT= MAC=[redacted] SRC=192.168.44.40 DST=10.138.0.2 LEN=92 TOS=0x00 PREC=0x00 TTL=2 ID=55442 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=1730
Jan 11 09:09:21 ovpn-client kernel: forwardIN=eth0 OUT=tun0 MAC=[redacted] SRC=192.168.44.40 DST=10.138.0.2 LEN=92 TOS=0x00 PREC=0x00 TTL=1 ID=55442 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=1730
Jan 11 09:09:25 ovpn-client kernel: preroutingIN=eth0 OUT= MAC=[redacted] SRC=192.168.44.40 DST=10.138.0.2 LEN=92 TOS=0x00 PREC=0x00 TTL=2 ID=55443 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=1731
Jan 11 09:09:25 ovpn-client kernel: forwardIN=eth0 OUT=tun0 MAC=[redacted] SRC=192.168.44.40 DST=10.138.0.2 LEN=92 TOS=0x00 PREC=0x00 TTL=1 ID=55443 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=1731
root@ovpn-server:~# tcpdump -v -n icmp and net 192.168.44.0/24 or net 10.138.0.0/24
tcpdump: listening on tun0, link-type RAW (Raw IP), capture size 262144 bytes
[empty]
root@ovpn-server:~# journalctl -f
[empty]
Based on the iptables log, it was able to forward the packets to the tun0 but the server never receives the packet. I ran the ping test with verb=9 in ovpn-client and I didn't see any TCP Write at all.
What am I missing? Any help is appreciated.
