I can connect to my openvpn server directly (w/o using a router), but when the server is placed behind LAN, I get
TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
TLS Error: TLS handshake failed
error on the client side.
The Openvpn network (LAN) uses em1, whereas I am using em2 to remotely connect (for debug), using a global IP (nnn.nnn.nnn.nnn).
The router used is one of those off-the-shelf wireless routers which also has wired interfaces. The LAN is 172.16.1.0/24. The LAN side of the router is 172.16.1.1. The openvpn server is 172.16.1.2. OS is CentOS 7, with openvpn version 2.4.8-1.el7.
No log on the server side log file. (/var/log/openvpn/openvpn.log)
However, when I do packet sniffing ( tcpdump -ni em1 udp and port 1194), I *do* see something like this:
listening on em1, link-type EN10MB (Ethernet), capture size 262144 bytes
03:29:35.617406 IP xxx.xxx.xxx.xxx.58059 > 172.16.1.2.openvpn: UDP, length 54
(many lines like this)
So I believe, my port forwarding (mapping) setup in the router is working.
Google search through forums tells me something like my firewall (I am using iptables) may be blocking/dropping the packets. I did not understand if INPUT is being dropped or OUTPUT or both. Since there is no entry of any kind on the server side log, I would guess the packets didn't make it to the server, right after the interface receiving them, they were dropped.
Beside the port mapping, I have also set up a static routing on the router side with the following items and values:
Destination IP: 10.8.0.0/24
Gateway: 172.16.1.2
IP forward has been enabled. (/etc/sysctl.conf)
(net.ipv4.ip_forward = 1)
(1) I may not have set up the iptables correctly.
Contents of /etc/sysconfig/iptables: ( rules related to vpn only shown)
*nat
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 10.8.0.0/24 -o em1 -j MASQUERADE
COMMIT
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -p udp --dport 1194 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p udp --sport 1194 -m state --state ESTABLISHED -j ACCEPT
-A INPUT -p udp --sport 1194 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -p udp --dport 1194 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -i tun0 -j ACCEPT
-A OUTPUT -o tun0 -j ACCEPT
-A FORWARD -i tun0 -j ACCEPT
-A FORWARD -i tun0 -o em1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i em1 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i tun0 -s 172.16.1.0/24 -d 172.16.1.0/24 -j DROP
(2) One other possibility is "ip route" is insufficient.
On the openvpn server, I *did* add a route like this:
route add -net 10.8.0.0 netmask 255.255.255.0 gw 172.16.1.2
ip route gives the following:
default via nnn.nnn.nnn.nnn (gateway of global IP) dev em2
10.8.0.0/24 dev tun0 proto kernel scope link src 10.8.0.1
nnn.nnn.nnn.nnn/25 (global network) dev em2 proto kernel scope link src nnn.nnn.nnn.nnn(global IP of the openvpn server)
169.254.0.0/16 dev em1 scope link metric 1002
169.254.0.0/16 dev em2 scope link metric 1003
172.16.1.0/24 dev em1 proto kernel scope link src 172.16.1.2
192.168.122.0/24 dev virbr0 proto kernel scope link src 192.168.122.1
Any hint would be appreciated.
Thank you.
