One host inside the VPN it not visible from others

elleby

Hi,

I had at work:
- 1 Debian host configured as server, also execute the server part of my Web application;
- 1 Windows host configured as client (my machine);
- 21 RasPBerry hosts configured as client, with the client part of my Web application;
All the Raspberry see the Debian server without problems. From the server, I can ping all the 22 client, and log to each of them with SSH. Yet there is one Raspberry client that cannot see the Windows client and viceversa. Ping, traceroute, SSH, nothing works, like the two host are on separate networks. The only way to reach that particular Raspberry, it's to connect through SSH on the server and then connect to this host. My applications works fine for each of 21 hosts, all of them are sending data to the central server through Web Service. I'm able to connect with my Windows with SSH and FTP client to all the Raspberry except that one. If I try other two random Raspberry, I'm able to comunicate directly. But also other Raspberry cannot see that one.
I rechecked the configuration several times, recreated my client connection for the Windows host, yet I'm not able to solve this problem.

To make a more simple explaination, all the host are in the same network, 10.1.1.XXX
Server (10.1.1.1): S
Windows Client (10.1.1.10): C
Raspberry client 1 (10.1.1.11): R1
Raspberry client 2 (10.1.1.12): R2
Raspberry client 2 (10.1.1.13): R3

S can ping C, R1, R2, R3
C can ping S, R1, R3
R1 can ping S, C, R3
R2 can ping S
R3 can ping S, C, R1

There are any suggestion about this problem?

Thank you in advance for your help.

TinCanTech

If you suspect openvpn then please see:
https://forums.openvpn.net/viewtopic.php?f=30&t=22603#p68963

Otherwise .. firewall ..

elleby

Sorry for the silly question, you mean that I had to provide the configurations or what? I mean... maybe I wroted it in the wrong way. I think that the problem it's OpenVPN, because:
- I turn off the Windows Firewall on Windows Client;
- even if not necessary (iptables is not setted with Raspberry by default) I created new rules for SSH traffic, allowing it explicitely;
- Windows client can connect to other Raspberry through SSH except that one;
- that Raspberry accepts SSH connections except from the Windows client;
My conclusion it's that the problem it's in the VPN configuration, because it's seems to me more logic. I want a confirm of that from more expert user of OpenVpn, because if the problem it's in the firewall, I'm asking in the wrong place. At least, I want to know if it's possible that a missing or wrong configuration of OpenVpn can explain this behaviour.

Matr1x

Hello, I have nearly the same problem. When I connect my Clients, they get the IP 10.8.0.x
And always the highest x can see the lower IP's:
10.8.0.3 can ping and see 10.8.0.2, but 10.8.0.2 to 10.8.0.3 doesnt work: _Nmap done: 1 IP address (0 hosts up) scanned in 2.50 seconds

Here my Client config

client
dev tun
proto udp
remote xxxx.xxxx.xx 7xx2
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
tls-version-min 1.2
verify-x509-name server_xxxU name
cipher AES-256-CBC
auth SHA256
auth-nocache
verb 3
<ca>.. <cert>.. <key>.. <tls-crypt>

And the Server:

dev tun
proto udp
port 7xx2
ca /etc/openvpn/easy-rsa/pki/ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/serverxxxxU.crt
key /etc/openvpn/easy-rsa/pki/private/serverxxxU.key
dh none
topology subnet
server 10.8.0.0 255.255.255.0
# I ADDED THIS PUSH ROUTE THING BUT THIS ONE DOESNT HELP 
push "route 10.8.0.0 255.255.255.0"
# Set your primary domain name server address for clients
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
# Prevent DNS leaks on Windows
push "block-outside-dns"
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
keepalive 1800 3600
remote-cert-tls client
tls-version-min 1.2
tls-crypt /etc/openvpn/easy-rsa/pki/ta.key
cipher AES-256-CBC
auth SHA256
user nobody
group nogroup
persist-key
persist-tun
crl-verify /etc/openvpn/crl.pem
status /var/log/openvpn-status.log 20
status-version 3
syslog
verb 3
#DuplicateCNs allow access control on a less-granular, per user basis.
#Remove # if you will manage access by user instead of device.
#duplicate-cn
# Generated for use by PiVPN.io

I tried this, but doesnt work: https://backreference.org/2010/05/02/controlling-client-to-client-connections-in-openvpn/

I just want, that all clients can talk to each other

TinCanTech

Matr1x wrote # Generated for use by PiVPN.io

Please report bugs to pivpn.io