Can't access client subnet

radokristof

Dear Community!

I have a little problem with my openVPN setup. I have a Raspberry Pi connected as a client to my openVPN server.
Connection works flawlessly and I can access everything on my Raspberry within the VPN (10.0.0.0/16 is routed)
The VPN subnet is 10.0.98.0/24
The openVPN server is a Mikrotik router, but I think this is more a client issue.

However I want to access this Raspberry's subnet. Accessing the Raspberry through it's subnet address (192.168.1.2) works, however accessing the anything else on the 192.168.1.0/24 subnet is not working. Route is added, that's why I can access the Raspberry through it's 192.168.1.2 address (VPN address of the Raspberry is 10.0.98.2)

IP Forwarding is enabled on the Raspberry.

One strange thing I have found is that when I try to ping the Raspberry, in tcpdump I can see that it receives the icmp packets and replies to it:

Linux version:

Linux openhab 5.4.51-v7+ #1333 SMP Mon Aug 10 16:45:19 BST 2020 armv7l GNU/Linux

ifconfig:

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.1.2  netmask 255.255.255.0  broadcast 192.168.1.255
        ether b8:27:eb:11:f7:76  txqueuelen 1000  (Ethernet)
        RX packets 1481958  bytes 486175723 (463.6 MiB)
        RX errors 4  dropped 0  overruns 0  frame 0
        TX packets 1316313  bytes 283029298 (269.9 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 2187318  bytes 265621438 (253.3 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 2187318  bytes 265621438 (253.3 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 10.0.98.3  netmask 255.255.0.0  destination 10.0.98.3
        inet6 fe80::5dd1:abd6:6d2b:f905  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
        RX packets 16644  bytes 1521895 (1.4 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 21537  bytes 17747485 (16.9 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

14:13:04.403755  In ethertype IPv4 (0x0800), length 76: 10.0.0.10 > 192.168.1.2: ICMP echo request, id 1, seq 1, length 40
14:13:04.403861 Out ethertype IPv4 (0x0800), length 76: 192.168.1.2 > 10.0.0.10: ICMP echo reply, id 1, seq 1, length 40
14:13:05.356589  In ethertype IPv4 (0x0800), length 76: 10.0.0.10 > 192.168.1.2: ICMP echo request, id 1, seq 2, length 40
14:13:05.356683 Out ethertype IPv4 (0x0800), length 76: 192.168.1.2 > 10.0.0.10: ICMP echo reply, id 1, seq 2, length 40

However, pinging another device:

14:13:51.550987  In ethertype IPv4 (0x0800), length 76: 10.0.0.10 > 192.168.1.1: ICMP echo request, id 1, seq 4, length 40
14:13:51.551040 Out b8:27:eb:11:f7:76 ethertype IPv4 (0x0800), length 76: 10.0.0.10 > 192.168.1.1: ICMP echo request, id 1, seq 4, length 40
14:13:56.080196  In ethertype IPv4 (0x0800), length 76: 10.0.0.10 > 192.168.1.1: ICMP echo request, id 1, seq 5, length 40
14:13:56.080244 Out b8:27:eb:11:f7:76 ethertype IPv4 (0x0800), length 76: 10.0.0.10 > 192.168.1.1: ICMP echo request, id 1, seq 5, length 40
14:14:01.150836  In ethertype IPv4 (0x0800), length 76: 10.0.0.10 > 192.168.1.1: ICMP echo request, id 1, seq 6, length 40
14:14:01.150875 Out b8:27:eb:11:f7:76 ethertype IPv4 (0x0800), length 76: 10.0.0.10 > 192.168.1.1: ICMP echo request, id 1, seq 6, length 40

Only the requests can be seen and no answer. The interesting thing here is that the src/dst is not even swapped in the In/Out messages as I would assume from the previous ping.
Of course, I can ping 192.168.1.1 locally.

Client config

client

dev tun

proto tcp-client

remote domain.mynetname.net

port 1194

nobind

persist-key

persist-tun

tls-client

remote-cert-tls server

verb 4

mute 10

cipher AES-256-CBC

auth SHA1

auth-user-pass secret

askpass password

auth-nocache

<ca>
-----BEGIN CERTIFICATE-----
KEY
-----END CERTIFICATE-----
</ca>

<cert>
-----BEGIN CERTIFICATE-----
KEY
-----END CERTIFICATE-----
</cert>

<key>
-----BEGIN ENCRYPTED PRIVATE KEY-----
KEY
-----END ENCRYPTED PRIVATE KEY-----
</key>

Can someone point me where the problem might be?

Thanks!

TinCanTech

https://forums.openvpn.net/viewtopic.php?f=30&t=22603

Also, see the howto.

radokristof

Thanks for your answer!
As I said my server is a Mikrotik Router so I can't include the openVPN server config here.
Also I have read the howto and most posts regarding similar issues, though I was unable to solve this problem.

What else is missing? Client log file? I have added the exact client info to my original post.

TinCanTech

radokristof wrote my server is a Mikrotik Router so I can't include the openVPN server config here

What about your server log ?

https://forums.openvpn.net/viewtopic.php?f=30&t=22603#p68963
https://forums.openvpn.net/viewtopic.php?f=30&t=22603#p93575

radokristof

I have extracted everything from my setup so it might be useful for inspection (though the format is different).

/ppp profile
add dns-server=10.0.0.3 interface-list=PRIVATE local-address=10.0.98.2 name=\
    ppp_private remote-address=dhcp_pool_ovpn use-encryption=yes
/interface ovpn-server server
set auth=sha1 certificate=server cipher=aes256 default-profile=ppp_private \
    enabled=yes netmask=16 require-client-certificate=yes

I have turned on debug logging for ovpn, but I can't see any suspicious. This is what I get sometimes:

21:03:00 ovpn,debug,packet rcvd P_CONTROL_SOFT_RESET kid=5 sid=27a33c79b58ea546 pid=0 DATA len=0 
21:03:00 ovpn,debug,packet sent P_CONTROL_SOFT_RESET kid=5 sid=57d7379e03bc95 [0 sid=27a33c79b58ea546] pid=0 DATA len=0 
21:03:00 ovpn,debug,packet rcvd P_ACK kid=5 sid=27a33c79b58ea546 [0 sid=57d7379e03bc95] DATA len=0 
21:03:00 ovpn,debug,packet rcvd P_CONTROL kid=5 sid=27a33c79b58ea546 pid=1 DATA len=273 
21:03:00 ovpn,debug,packet sent P_ACK kid=5 sid=57d7379e03bc95 [1 sid=27a33c79b58ea546] DATA len=0 
21:03:00 ovpn,debug,packet sent P_CONTROL kid=5 sid=57d7379e03bc95 pid=1 DATA len=1400 
21:03:00 ovpn,debug,packet sent P_CONTROL kid=5 sid=57d7379e03bc95 pid=2 DATA len=749 
21:03:00 ovpn,debug,packet rcvd P_ACK kid=5 sid=27a33c79b58ea546 [1 sid=57d7379e03bc95] DATA len=0 
21:03:00 ovpn,debug,packet rcvd P_CONTROL kid=5 sid=27a33c79b58ea546 [2 sid=57d7379e03bc95] pid=2 DATA len=1170 
21:03:00 ovpn,debug,packet sent P_ACK kid=5 sid=57d7379e03bc95 [2 sid=27a33c79b58ea546] DATA len=0 
21:03:00 ovpn,debug,packet rcvd P_CONTROL kid=5 sid=27a33c79b58ea546 pid=3 DATA len=873 
21:03:00 ovpn,debug,packet sent P_ACK kid=5 sid=57d7379e03bc95 [3 sid=27a33c79b58ea546] DATA len=0 
21:03:00 ovpn,debug,packet sent P_CONTROL kid=5 sid=57d7379e03bc95 pid=3 DATA len=51 
21:03:00 ovpn,debug,packet rcvd P_CONTROL kid=5 sid=27a33c79b58ea546 [3 sid=57d7379e03bc95] pid=4 DATA len=418 
21:03:00 ovpn,debug,packet sent P_ACK kid=5 sid=57d7379e03bc95 [4 sid=27a33c79b58ea546] DATA len=0 
21:03:00 ovpn,debug,packet sent P_CONTROL kid=5 sid=57d7379e03bc95 pid=4 DATA len=227 
21:03:00 ovpn,debug,packet rcvd P_ACK kid=5 sid=27a33c79b58ea546 [4 sid=57d7379e03bc95] DATA len=0

300000

You need add "route 192.168.1.0 255.255.255.0 "
into server config and create file name as client openvpn inside cdd folder after that open that file add this one
"Iroute 192.168.1.0 255.255.255.0"

Basic you need to setup site to site so you can access client'subnet

Route and iroute to give info what to route to when client from server want to communicate to client's subnet

TinCanTech

radokristof wrote Also I have read the howto

If you had read the howto then you would be asking different questions.

:geek:

radokristof

300000 wrote You need add "route 192.168.1.0 255.255.255.0 "
into server config and create file name as client openvpn inside cdd folder after that open that file add this one
"Iroute 192.168.1.0 255.255.255.0"

Basic you need to setup site to site so you can access client'subnet

Route and iroute to give info what to route to when client from server want to communicate to client's subnet

Route is already added to server. That's why I can access it through 192.168.1.2

Also I must mention that I have other clients (Mikrotik routers) with the same setup and it works there. Only on the Raspberry I can't make this work.
However, looking at the Mikrotik config now, it might be that this is not supported.

300000

You must have route and iroute to make it work . client from server can access client from openvpn client 'subnet . Without route and iroute it wont works as openvpn design on that way .you should post server config so people can find out what wrong . how to make site to site work .

TinCanTech

300000 wrote You must have route and iroute to make it work

TinCanTech wrote
radokristof wrote Also I have read the howto
If you had read the howto then you would be asking different questions.

:geek:

The question you would be asking is: "how do i use --iroute ?"