Got stuck on routed config

dmnc

Hi,

I'm trying to configure routed VPN and I got stuck on first step even on simple stripped configuration.

port 1194
proto udp
dev tun
server 172.16.0.0 255.255.255.0
ca /etc/openvpn/openvpn_certs/ovpn-ca.pem
cert /etc/openvpn/openvpn_certs/ovpn-cert.pem
key /etc/openvpn/openvpn_certs/ovpn-key.pem
dh /etc/openvpn/openvpn_certs/dh2048.pem

client
dev tun
remote x.x.x.x (public IP)
proto udp
port 1194
ca ca.pem
cert client.crt
key client.pem

server:

inet 172.16.0.1 peer 172.16.0.2/32 scope global tun0

client:

inet 172.16.0.6 peer 172.16.0.5/32 scope global tun0

server can ping client (172.16.0.6) and client can ping server tun (172.16.0.1) and lan (192.168.13.7)

... in next step, I'd like to route to another subnet so I have to use peer 172.16.0.5 (I can't use 172.16.0.1 as a gw it won't let me use it because "SIOCADDRT: Network is unreachable") as a client's gw, right? As far as I see in routing table while testing [oconf]push "route 192.168.13.0 255.255.255.0"[/oconf] option.

But. but I can't reach peer IP or other subnet (I can see client's requests on server's tcpdump).

I don't know why the route pushing is not working for me but while using NM OVPN profile, I'm getting default gw 172.16.0.5 and at this moment I have to remove default gw because it cuts off all connection.

From the LAN gw (different from OVPN server) or any other machine I can reach client on 172.16.0.6 but not vice versa.

What am I missing please?

TinCanTech

dmnc wrote What am I missing please?

How about the Howto ?

dmnc

TinCanTech wrote
dmnc wrote What am I missing please?
How about the Howto ?

"Thank you for helping us help you help us all"
... no, I didn't miss the Howto.

Anyone else can guide me a little bit more please?

dmnc

interesting thing is that while pinging from LAN gw (192.168.13.1) to 172.16.0.1, I'm getting replies but I cant see it on OVPN's tun0 tcpdump.

dmnc

I've mentioned `push` directives in the description but for sure, this is actual config:

port 1194
proto udp
dev tun
server 172.16.0.0 255.255.255.0
push "route 192.168.13.0 255.255.255.0"
push "redirect-gateway def1"
ca /etc/openvpn/openvpn_certs/ovpn-ca.pem
cert /etc/openvpn/openvpn_certs/ovpn-cert.pem
key /etc/openvpn/openvpn_certs/ovpn-key.pem
dh /etc/openvpn/openvpn_certs/dh2048.pem

dmnc

I've helped myself... with one big facepalm 🙂

If anybody is trying to run OVPN under KVM or LXC on Proxmox VE, check your PVE Firewall for the VM/CT.
In my case I've disabled Options > IP filter, because ipfilter option adds DROP on output chain (for me for unknown reasons) ...

docs:

ipfilter: <boolean>
Enable default IP filters. This is equivalent to adding an empty ipfilter-net<id> ipset for every interface. Such ipsets implicitly contain sane default restrictions such as restricting IPv6 link local addresses to the one derived from the interface’s MAC address. For containers the configured IP addresses will be implicitly added.

Pippin

Thanks for letting us know.