I have trouble setting up a simple VPN network for allowing a VPS to join my LAN.
OpenVPN server conf
server 10.0.0.0 255.255.255.0
verb 3
key /etc/openvpn/pki/private/klood.badfile.net.key
ca /etc/openvpn/pki/ca.crt
cert /etc/openvpn/pki/issued/klood.badfile.net.crt
dh /etc/openvpn/pki/dh.pem
tls-auth /etc/openvpn/pki/ta.key
key-direction 0
keepalive 10 60
persist-key
persist-tun
topology subnet
proto udp
# Rely on Docker to do port mapping, internally always 1194
port 1194
dev tun0
status /tmp/openvpn-status.log
user nobody
group nogroup
comp-lzo no
### Route Configurations Below
push "route 192.168.2.0 255.255.255.0"
push "topology subnet"
### Push Configurations Below
#push "block-outside-dns"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
push "comp-lzo no"
OpenVPN startup logs
Enabling IPv6 Forwarding
sysctl: error setting key 'net.ipv6.conf.all.disable_ipv6': Read-only file system
Failed to enable IPv6 support
sysctl: error setting key 'net.ipv6.conf.default.forwarding': Read-only file system
Failed to enable IPv6 Forwarding default
sysctl: error setting key 'net.ipv6.conf.all.forwarding': Read-only file system
Failed to enable IPv6 Forwarding
Running 'openvpn --config /etc/openvpn/openvpn.conf --client-config-dir /etc/openvpn/ccd --crl-verify /etc/openvpn/crl.pem '
Sat Apr 4 15:16:34 2020 OpenVPN 2.4.7 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on May 5 2019
Sat Apr 4 15:16:34 2020 library versions: OpenSSL 1.1.1c 28 May 2019, LZO 2.10
Sat Apr 4 15:16:34 2020 Diffie-Hellman initialized with 2048 bit key
Sat Apr 4 15:16:34 2020 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Apr 4 15:16:34 2020 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Apr 4 15:16:34 2020 TUN/TAP device tun0 opened
Sat Apr 4 15:16:34 2020 TUN/TAP TX queue length set to 100
Sat Apr 4 15:16:34 2020 /sbin/ip link set dev tun0 up mtu 1500
Sat Apr 4 15:16:34 2020 /sbin/ip addr add dev tun0 10.0.0.1/24 broadcast 10.0.0.255
Sat Apr 4 15:16:34 2020 Could not determine IPv4/IPv6 protocol. Using AF_INET
Sat Apr 4 15:16:34 2020 Socket Buffers: R=[212992->212992] S=[212992->212992]
Sat Apr 4 15:16:34 2020 UDPv4 link local (bound): [AF_INET][undef]:1194
Sat Apr 4 15:16:34 2020 UDPv4 link remote: [AF_UNSPEC]
Sat Apr 4 15:16:34 2020 GID set to nogroup
Sat Apr 4 15:16:34 2020 UID set to nobody
Sat Apr 4 15:16:34 2020 MULTI: multi_init called, r=256 v=256
Sat Apr 4 15:16:34 2020 IFCONFIG POOL: base=10.0.0.2 size=252, ipv6=0
Sat Apr 4 15:16:34 2020 Initialization Sequence Completed
ip r @ OpenVPN server after OpenVPN started
default via 192.168.2.1 dev eno1
10.0.0.0/24 dev tun0 proto kernel scope link src 10.0.0.1
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown
172.18.0.0/16 dev br-4051d2675803 proto kernel scope link src 172.18.0.1
172.19.0.0/16 dev br-fbd7266304fe proto kernel scope link src 172.19.0.1 linkdown
172.21.0.0/16 dev br-8c8a1a1fb444 proto kernel scope link src 172.21.0.1
172.22.0.0/16 dev br-8c135a1980df proto kernel scope link src 172.22.0.1
172.24.0.0/16 dev br-56278909ca27 proto kernel scope link src 172.24.0.1 linkdown
172.27.0.0/16 dev br-1bbb1aeadcfd proto kernel scope link src 172.27.0.1 linkdown
172.28.0.0/16 dev br-7b49f65adf92 proto kernel scope link src 172.28.0.1
172.31.0.0/16 dev br-2ccef5ccbf6c proto kernel scope link src 172.31.0.1
192.168.2.0/24 dev eno1 proto kernel scope link src 192.168.2.10
192.168.16.0/20 dev br-7a5fff060b36 proto kernel scope link src 192.168.16.1 linkdown
192.168.32.0/20 dev br-a48eb0c61a3a proto kernel scope link src 192.168.32.1
192.168.80.0/20 dev br-1d57067f05ea proto kernel scope link src 192.168.80.1
192.168.112.0/20 dev br-d52c4a98d3f3 proto kernel scope link src 192.168.112.1 linkdown
192.168.128.0/20 dev br-a446e5b7f531 proto kernel scope link src 192.168.128.1
192.168.192.0/20 dev br-8ea996b160b5 proto kernel scope link src 192.168.192.1 linkdown
Able to ping the VPS from OpenVPN server
PING 10.0.0.20 (10.0.0.20) 56(84) bytes of data.
64 bytes from 10.0.0.20: icmp_seq=1 ttl=64 time=2.87 ms
64 bytes from 10.0.0.20: icmp_seq=2 ttl=64 time=4.04 ms
64 bytes from 10.0.0.20: icmp_seq=3 ttl=64 time=3.45 ms
--- 10.0.0.20 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 5ms
rtt min/avg/max/mdev = 2.867/3.451/4.041/0.481 ms
Able to ping other LAN machines from OpenVPN server
PING 192.168.2.11 (192.168.2.11) 56(84) bytes of data.
64 bytes from 192.168.2.11: icmp_seq=1 ttl=64 time=0.613 ms
64 bytes from 192.168.2.11: icmp_seq=2 ttl=64 time=0.517 ms
64 bytes from 192.168.2.11: icmp_seq=3 ttl=64 time=0.544 ms
--- 192.168.2.11 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 38ms
rtt min/avg/max/mdev = 0.517/0.558/0.613/0.040 ms
VPN
client connection log from the VPS
Apr 4 17:17:25 vps ovpn-client1.service[15347]: [vpn.server.com] Inactivity timeout (--ping-restart), restarting
Apr 4 17:17:25 vps ovpn-client1.service[15347]: /sbin/ip addr del dev tun0 10.0.0.20/24
Apr 4 17:17:25 vps ovpn-client1.service[15347]: SIGUSR1[soft,ping-restart] received, process restarting
Apr 4 17:17:30 vps ovpn-client1.service[15347]: TCP/UDP: Preserving recently used remote address: [AF_INET]78.192.xxx.xxx:1194
Apr 4 17:17:30 vps ovpn-client1.service[15347]: UDP link local: (not bound)
Apr 4 17:17:30 vps ovpn-client1.service[15347]: UDP link remote: [AF_INET]78.192.xxx.xxx:1194
Apr 4 17:17:30 vps ovpn-client1.service[15347]: [vpn.server.com] Peer Connection Initiated with [AF_INET]78.192.xxx.xxx:1194
Apr 4 17:17:31 vps ovpn-client1.service[15347]: TUN/TAP device tun0 opened
Apr 4 17:17:31 vps ovpn-client1.service[15347]: /sbin/ip link set dev tun0 up mtu 1500
Apr 4 17:17:31 vps systemd-udevd[31431]: link_config: autonegotiation is unset or enabled, the speed and duplex are not writable.
Apr 4 17:17:31 vps ovpn-client1.service[15347]: /sbin/ip addr add dev tun0 10.0.0.20/24 broadcast 10.0.0.255
Apr 4 17:17:31 vps ovpn-client1.service[15347]: Initialization Sequence Completed
OpenVPN
server connection log when VPS is connecting
Sat Apr 4 15:17:30 2020 195.154.xxx.xxx:39955 TLS: Initial packet from [AF_INET]195.154.xxx.xxx:39955, sid=fe6d6c7a 20629a97
Sat Apr 4 15:17:30 2020 195.154.xxx.xxx:39955 VERIFY OK: depth=1, CN=Badfile
Sat Apr 4 15:17:30 2020 195.154.xxx.xxx:39955 VERIFY OK: depth=0, CN=client1
Sat Apr 4 15:17:30 2020 195.154.xxx.xxx:39955 peer info: IV_VER=2.4.7
Sat Apr 4 15:17:30 2020 195.154.xxx.xxx:39955 peer info: IV_PLAT=linux
Sat Apr 4 15:17:30 2020 195.154.xxx.xxx:39955 peer info: IV_PROTO=2
Sat Apr 4 15:17:30 2020 195.154.xxx.xxx:39955 peer info: IV_NCP=2
Sat Apr 4 15:17:30 2020 195.154.xxx.xxx:39955 peer info: IV_LZ4=1
Sat Apr 4 15:17:30 2020 195.154.xxx.xxx:39955 peer info: IV_LZ4v2=1
Sat Apr 4 15:17:30 2020 195.154.xxx.xxx:39955 peer info: IV_LZO=1
Sat Apr 4 15:17:30 2020 195.154.xxx.xxx:39955 peer info: IV_COMP_STUB=1
Sat Apr 4 15:17:30 2020 195.154.xxx.xxx:39955 peer info: IV_COMP_STUBv2=1
Sat Apr 4 15:17:30 2020 195.154.xxx.xxx:39955 peer info: IV_TCPNL=1
Sat Apr 4 15:17:30 2020 195.154.xxx.xxx:39955 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
Sat Apr 4 15:17:30 2020 195.154.xxx.xxx:39955 [client1] Peer Connection Initiated with [AF_INET]195.154.xxx.xxx:39955
Sat Apr 4 15:17:30 2020 client1/195.154.xxx.xxx:39955 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/client1
Sat Apr 4 15:17:30 2020 client1/195.154.xxx.xxx:39955 MULTI: Learn: 10.0.0.20 -> client1/195.154.xxx.xxx:39955
Sat Apr 4 15:17:30 2020 client1/195.154.xxx.xxx:39955 MULTI: primary virtual IP for client1/195.154.xxx.xxx:39955: 10.0.0.20
Sat Apr 4 15:17:31 2020 client1/195.154.xxx.xxx:39955 PUSH: Received control message: 'PUSH_REQUEST'
Sat Apr 4 15:17:31 2020 client1/195.154.xxx.xxx:39955 SENT CONTROL [client1]: 'PUSH_REPLY,route 192.168.2.0 255.255.255.0,topology subnet,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,comp-lzo no,route-gateway 10.0.0.1,topology subnet,ping 10,ping-restart 60,ifconfig 10.0.0.20 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
Sat Apr 4 15:17:31 2020 client1/195.154.xxx.xxx:39955 Data Channel: using negotiated cipher 'AES-256-GCM'
Sat Apr 4 15:17:31 2020 client1/195.154.xxx.xxx:39955 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Sat Apr 4 15:17:31 2020 client1/195.154.xxx.xxx:39955 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
ip r @ VPS after connection
default via 195.154.xxx.xxx dev enp1s0
10.0.0.0/24 dev tun0 proto kernel scope link src 10.0.0.20
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown
172.18.0.0/16 dev br-ae61abfd2d05 proto kernel scope link src 172.18.0.1
172.19.0.0/16 dev br-1978144ee336 proto kernel scope link src 172.19.0.1
192.168.2.0/24 via 10.0.0.1 dev tun0
195.154.xxx.xxx/24 dev enp1s0 proto kernel scope link src 195.154.xxx.xxx
Able to ping the OpenVPN server from the VPS
PING 192.168.2.10 (192.168.2.10) 56(84) bytes of data.
64 bytes from 192.168.2.10: icmp_seq=1 ttl=64 time=3.22 ms
64 bytes from 192.168.2.10: icmp_seq=2 ttl=64 time=3.25 ms
64 bytes from 192.168.2.10: icmp_seq=3 ttl=64 time=3.20 ms
--- 192.168.2.10 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 5ms
rtt min/avg/max/mdev = 3.198/3.221/3.247/0.068 ms
NOT able to ping other LAN machines from the VPS
PING 192.168.2.12 (192.168.2.12) 56(84) bytes of data.
^C
--- 192.168.2.12 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 40ms
NOT able to ping the LAN router from the VPS
PING 192.168.2.1 (192.168.2.1) 56(84) bytes of data.
^C
--- 192.168.2.1 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 54ms
OpenVPN server can ping the VPS
PING 10.0.0.20 (10.0.0.20) 56(84) bytes of data.
64 bytes from 10.0.0.20: icmp_seq=1 ttl=64 time=2.89 ms
64 bytes from 10.0.0.20: icmp_seq=2 ttl=64 time=3.30 ms
64 bytes from 10.0.0.20: icmp_seq=3 ttl=64 time=3.46 ms
--- 10.0.0.20 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 5ms
rtt min/avg/max/mdev = 2.886/3.213/3.456/0.249 ms
LAN Host #2 can ping the OpenVPN server on its 10.0.0.0/24 address
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.575 ms
64 bytes from 10.0.0.1: icmp_seq=2 ttl=64 time=0.714 ms
64 bytes from 10.0.0.1: icmp_seq=3 ttl=64 time=0.686 ms
--- 10.0.0.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2027ms
rtt min/avg/max/mdev = 0.575/0.658/0.714/0.063 ms
LAN Host #2
not able to ping the VPS
PING 10.0.0.20 (10.0.0.20) 56(84) bytes of data.
^C
--- 10.0.0.20 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2041ms
A static route has been set on the LAN router from
10.0.0.0/24, next hop
192.168.2.10.
I should add that OpenVPN runs in a Docker container (
https://github.com/kylemanna/docker-openvpn) but with host networking instead of the Docker network.
So... I'm a bit lost here 🙂 it looks like all the routes are fine but I can't put my finger on the problem. A little help would be greatly appreciated. I'm not a network expert but I'd like to know more about networking.
Thanks!
