Push Route - no reply from Server

Sturze

Hi
i spent couple of hours now trying to get my VPN working.

i created a pretty basic config but something with the Route push seems to somehow .. not work...

port 443
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
topology subnet
server 192.168.11.0 255.255.255.0
ifconfig-pool-persist /var/log/openvpn/ipp.txt
push "route 10.17.4.32 255.255.255.224"
push "route 10.17.8.0 255.255.254.0"
keepalive 10 120
tls-auth ta.key 0
persist-key
persist-tun
verb 3
explicit-exit-notify 1

this is in the Server Log after connecting with my testclient

 SENT CONTROL [client1]: 'PUSH_REPLY,route 10.17.4.32 255.255.255.224,route 10.17.8.0 255.255.254.0,route-gateway 192.168.11.1,topology subnet,ping 10,ping-restart 120,ifconfig 192.168.11.4 255.255.255.0,peer-id 0,cipher AES-2566-GCM' (status=1)

tcpdump on the server while trying to ping something int the "push-route-range" for example 10.17.8.8

root@vpnserver:/home/user# tcpdump -i tun0 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 262144 bytes
20:20:18.569608 IP 192.168.11.4 > testhost: ICMP echo request, id 14190, seq 0, length 64
20:20:19.574209 IP 192.168.11.4 > testhost: ICMP echo request, id 14190, seq 1, length 64
20:20:20.574335 IP 192.168.11.4 > testhost: ICMP echo request, id 14190, seq 2, length 64

What seems to work:
the VPN itself..
i can ping the Server through the tunnel, also the LAN interface of the Server.

but nothing else "away"
someone ideas?

Pippin

What is the LAN address of the server?
And what is this

push "route 10.17.4.32 255.255.255.224"
push "route 10.17.8.0 255.255.254.0"

Sturze

the LAN address of the server is 10.17.4.50

what i am trying to do is to make these networks reachable for the client

client 192.168.11.4 -vpn- 192.168.11.1 Server 10.17.4.50 -Lan- ....10.17.8.0/23

Pippin

Please see here:
https://community.openvpn.net/openvpn/wiki/HOWTO#IncludingmultiplemachinesontheserversidewhenusingaroutedVPNdevtun

Sturze

Pippin wrote Please see here:
https://community.openvpn.net/openvpn/wiki/HOWTO#IncludingmultiplemachinesontheserversidewhenusingaroutedVPNdevtun

i guess you are trying to tell me, that i forgot the route back to the vpn-server. Sadly, i guess, thats not the point. i routet 192.168.11.0 to 10.17.4.50 at the router behind the VPN-server (something wrong with that? cant think anymore... freaking tired, but i want this working)

i also cannot connect to any server in the LAN of the VPN Server. therefore no route should be nessesary... am i wrong?
example:

ping from 192.168.11.4 to 10.17.4.39 in that case i can see packages on the interface of the server (icmp requests) but no replys.

what i am missing?!?

Sturze

this is the whole log, after starting the service and connecting the client.

/home/user# tail -f /var/log/openvpn/openvpn.log
Tue Mar 17 21:50:58 2020 Socket Buffers: R=[212992->212992] S=[212992->212992]
Tue Mar 17 21:50:58 2020 UDPv4 link local (bound): [AF_INET][undef]:443
Tue Mar 17 21:50:58 2020 UDPv4 link remote: [AF_UNSPEC]
Tue Mar 17 21:50:58 2020 MULTI: multi_init called, r=256 v=256
Tue Mar 17 21:50:58 2020 IFCONFIG POOL: base=192.168.11.2 size=252, ipv6=0
Tue Mar 17 21:50:58 2020 ifconfig_pool_read(), in='client1,192.168.11.4', TODO: IPv6
Tue Mar 17 21:50:58 2020 succeeded -> ifconfig_pool_set()
Tue Mar 17 21:50:58 2020 IFCONFIG POOL LIST
Tue Mar 17 21:50:58 2020 client1,192.168.11.4
Tue Mar 17 21:50:58 2020 Initialization Sequence Completed
Tue Mar 17 21:51:11 2020 x.x.x.x:51522 TLS: Initial packet from [AF_INET]x.x.x.x:51522, sid=de33b829 79679709
Tue Mar 17 21:51:11 2020 x.x.x.x:51522 VERIFY OK: depth=1, 
Tue Mar 17 21:51:11 2020 x.x.x.x:51522 VERIFY OK: depth=0,
Tue Mar 17 21:51:11 2020 x.x.x.x:51522 peer info: IV_VER=2.4.7
Tue Mar 17 21:51:11 2020 x.x.x.x:51522 peer info: IV_PLAT=mac
Tue Mar 17 21:51:11 2020 x.x.x.x:51522 peer info: IV_PROTO=2
Tue Mar 17 21:51:11 2020 x.x.x.x:51522 peer info: IV_NCP=2
Tue Mar 17 21:51:11 2020 x.x.x.x:51522 peer info: IV_LZ4=1
Tue Mar 17 21:51:11 2020 x.x.x.x:51522 peer info: IV_LZ4v2=1
Tue Mar 17 21:51:11 2020 x.x.x.x:51522 peer info: IV_LZO=1
Tue Mar 17 21:51:11 2020 x.x.x.x:51522 peer info: IV_COMP_STUB=1
Tue Mar 17 21:51:11 2020 x.x.x.x:51522 peer info: IV_COMP_STUBv2=1
Tue Mar 17 21:51:11 2020 x.x.x.x:51522 peer info: IV_TCPNL=1
Tue Mar 17 21:51:11 2020 x.x.x.x:51522 peer info: IV_GUI_VER="net.tunnelblick.tunnelblick_5400_3.8.1__build_5400)"
Tue Mar 17 21:51:11 2020 x.x.x.x:51522 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Tue Mar 17 21:51:11 2020 x.x.x.x:51522 [client1] Peer Connection Initiated with [AF_INET]x.x.x.x:51522
Tue Mar 17 21:51:11 2020 client1/x.x.x.x:51522 MULTI_sva: pool returned IPv4=192.168.11.4, IPv6=(Not enabled)
Tue Mar 17 21:51:11 2020 client1/x.x.x.x:51522 MULTI: Learn: 192.168.11.4 -> client1/x.x.x.x:51522
Tue Mar 17 21:51:11 2020 client1/x.x.x.x:51522 MULTI: primary virtual IP for client1/x.x.x.x:51522: 192.168.11.4
Tue Mar 17 21:51:12 2020 client1/x.x.x.x:51522 PUSH: Received control message: 'PUSH_REQUEST'
Tue Mar 17 21:51:12 2020 client1/x.x.x.x:51522 SENT CONTROL [client1]: 'PUSH_REPLY,route 10.17.4.32 255.255.255.224,route 10.17.8.0 255.255.254.0,route-gateway 192.168.11.1,topology subnet,ping 10,ping-restart 120,ifconfig 192.168.11.4 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
Tue Mar 17 21:51:12 2020 client1/x.x.x.x:51522 Data Channel: using negotiated cipher 'AES-256-GCM'
Tue Mar 17 21:51:12 2020 client1/x.x.x.x:51522 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Mar 17 21:51:12 2020 client1/x.x.x.x:51522 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key

isn't there something wrong with the "push"? because of the status=1?
i just cant find out whats the reason for it?! or can i ignore this and search somewhere else, because the server is receiving packages if i try to use the route?

these are the routes on the openvpn-server

:/home/user# ip route
default via 10.17.4.62 dev ens160 proto static
10.17.4.32/27 dev ens160 proto kernel scope link src 10.17.4.50
192.168.11.0/24 dev tun0 proto kernel scope link src 192.168.11.1

Pippin

i guess you are trying to tell me, that i forgot the route back to the vpn-server. Sadly, thats not the point.

The point or case?

From the client, can you ping the LAN gateway (10.17.4.62)?

Sturze

a hand full of sleep and a cup coffee later - finally it works...
i sniffet on the eth160 trying to ping to the 10.17.8.x through the tunnel, and saw packages. Finally i realized that my routes through the tunnel seemed to work.
i found out that my firewall, between the two networks behind the VPN Server dropped the packages comming from the 192.168.11.0/24. i thougt there would be some sort of NAT, thats why i created a rule allowing traffic from the Server LAN ip to the destination addresses. Seemed to be not the case out of the box.
thanks for your patience and help!
hope this helps someone else too...

Pippin

Thanks for letting us know.