[Problem] Site to Site Network Share / Port Access

jayem_heh

Hi,

I've been trying to resolve this issue before proceeding any further.

Scenario:
Office A (Main): 192.168.100.0 / 24
Office B (Sub): 192.168.101.0 / 24

Both I can ping each other but I cannot access any network drives from each subnet from Main to Sub or Vise Versa. Even access some servers using ports for their services.

To simplify my testing I disabled all firewalls from vpn server, vpn client, office a desktop and office b desktop.

Hope some one can help me.

Regards,
Jay

300000

If you got problem let hide someone who can do it for you so it is simple solution

jayem_heh

Hi 300000,

I'm asking only opinion, where everyone can point or give me idea which step I am missing and lacking.

I will not post here if I did not try to solve it. I posted here to have additional idea to resolve my issue.

Jay

jayem_heh

VPN IP 10.10.0.0 / 24
VPN Server 10.10.0.1 / 24
VPN Client 10.10.0.6 / 24

All IP / PC from both network can ping each other.
OpenVpn Server can access the samba on the Remote Office B
OpenVpn Client can access the samba on the Main Office A

Please help and guide me
Why my Desktop Clients cannot access the opposite side Samba on both direction.
Office A Clients cannot access Samba on Office B
Office B Clients cannot access Samba on Office A

Any idea or suggestions?

Here are my configs

Server Config

port XXXX
proto udp
dev tun

ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/server.crt
key /etc/openvpn/server/server.key
dh /etc/openvpn/server/dh.pem

server 10.10.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.100.0 255.255.255.0"
push "route 192.168.101.0 255.255.255.0"

keepalive 10 120
comp-lzo
ping-timer-rem
persist-key
persist-tun
mute-replay-warnings

daemon

client-to-client
client-config-dir /etc/openvpn/client-configs
route 192.168.101.0 255.255.255.0

status openvpn-status.log

verb 3
crl-verify /etc/openvpn/easy-rsa/3.0/pki/crl.pem
log openvpn.log

******************************************************************
Client-Configs
iroute 192.168.101.0 255.255.255.0

******************************************************************
Server Route

Destination Gateway Genmask Flags Metric Ref Use Iface
default 192.168.100.99 0.0.0.0 UG 1024 0 0 enp2s0
10.10.0.0 10.10.0.2 255.255.255.0 UG 0 0 0 tun0
10.10.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
192.168.100.0 0.0.0.0 255.255.255.0 U 0 0 0 enp2s0
192.168.101.0 10.10.0.2 255.255.255.0 UG 0 0 0 tun0

******************************************************************
Iptables

-A FORWARD -s 10.10.0.0/24 -d 192.168.100.0/24 -i tun0 -o enp2s0 -m conntrack --ctstate NEW -j ACCEPT
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

-A POSTROUTING -s 10.10.0.0/24 -o enp2s0 -j MASQUERADE

******************************************************************
IP FORWARD

net.ipv4.ip_forward = 1

Client Config

client
dev tun
proto udp
remote x.x.x.x XXXX
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo
verb 3
ca /etc/openvpn/client/ca.crt
cert /etc/openvpn/client/client.crt
key /etc/openvpn/client/client.key
status openvpn-status.log
log openvpn.log

******************************************************************
Client Route

Destination Gateway Genmask Flags Metric Ref Use Iface
default 192.168.101.99 0.0.0.0 UG 1024 0 0 enp3s0
10.10.0.0 10.10.0.5 255.255.255.0 UG 0 0 0 tun0
10.10.0.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
192.168.100.0 10.10.0.5 255.255.255.0 UG 0 0 0 tun0
192.168.101.0 0.0.0.0 255.255.255.0 U 0 0 0 enp3s0

******************************************************************
Iptables

-A FORWARD -s 10.10.0.0/24 -d 192.168.101.0/24 -i tun0 -o enp3s0 -m conntrack --ctstate NEW -j ACCEPT
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

-A POSTROUTING -s 10.10.0.0/24 -o enp3s0 -j MASQUERADE

******************************************************************

IP FORWARD

net.ipv4.ip_forward = 1

300000

in order to access to all pc by name you need push DNS server address to all client but there is no push dns from openvpn server to openvpn client and second openvpn client must act as default getaway to server all network so it will work
you need two line like this one on server . you can use samba act as WINS server so and push address to client so from client you can use name instead ip to access it.withou WINS server on openvpn client never can access by name to server or to all pc over vpn.

push "dhcp-option WINS 192.168.20.1"
push "dhcp-option DNS 192.168.20.1 "

jayem_heh

@300000

Thanks for the giving me time to help.
I did put on Server config

push "dhcp-option WINS 192.168.100.1"
push "dhcp-option DNS 192.168.100.99"

Samba
WINS Support = yes
WINS Server = 192.168.100.1

Also
I put on my router (Office B) static route
192.168.100.0 255.255.255.0 192.168.101.104

I put on my router (Office A) static route
192.168.101.1 255.255.255.0 192.168.100.35

But still the same, even i triend to hit
From Office B Desktop \\192.168.100.1\Shared no luck.

Thanks,
Jay

300000

on openvpn server do you run dns server or not? if you push dns to client but there is no dns serer so it not work.and if you have dns server on that you need create filewall rule on dns server so client can access dns server . without firewall rule everthing will stop.

from remote office can you try tracert route to samba to see when route stop.

tracert 192.168.100.1 to see when route stop

you need remove this line from server push "route 192.168.101.0 255.255.255.0" , it have nothing do and create loop route on client .you only need to push route from server 192.168100.0 to client , dont need to push route 192.168.101.0 to client , that route from client so it will cause loop .

jayem_heh

I dont run DNS on my OpenVPN Server, I run DNS directly to my Office Main Router and Remote Office Router.

Tracert result:
Tracing route to ABC [192.168.100.1]
over a maximum of 30 hops:

1 1 ms 1 ms 1 ms 192.168.101.99
2 1 ms 1 ms 1 ms 192.168.101.104
3 12 ms 16 ms 14 ms ABC [192.168.100.1]

Trace complete.

I remove that unnecessary line I put that one while doing my troubleshooting while waiting someone to give me help / ideas.

@300000

Please note OpenVPN Client and OpenVPN Server can access all computers and services.

The one that cannot access is the remote office desktops going to main office desktops. And Vise Versa.

300000

can you tell me samba from remote can ping samba from main or not? you didnot give out all info ip so nobody understand your network , you said that you can ping all pc so nothing to do with openvpn at all but there is something inside your network make trouble ,

openvpn server run dns server ? make sure ir is running , if the dns server not working so it can service name to ip .

now from pc on remote can try to ping main router and tracer main router.
now from pc on remote can try to ping samba main router and tracer main router.

if all can ping so try to restart your dns server , maybe you run dnsmanq on the main openvpn .

jayem_heh

@300000

I am out of the office now, but I will give you all details about your question tomorrow.

I can give you brief details now.

OpenVPN Server : NO DNS Server

now from pc on remote can try to ping main router and tracer main router.
Yes; Remote Office PC can ping and access the web gui of the router.

now from pc on remote can try to ping samba main router and tracer main router.
Yes; Remote Office PC can ping samba server on main office but cannot access any service like shared folders.

All traceroute and pings I will send tomorrow.

Thanks
Jay

jayem_heh

This is the result of the Pings and Tracert

From Remote Office Desktop (192.168.101.2)

Ping and Tracer of SAMBA in Main Office

C:\Users\Boom>ping 192.168.100.1

Pinging 192.168.100.1 with 32 bytes of data:
Reply from 192.168.100.1: bytes=32 time=12ms TTL=61
Reply from 192.168.100.1: bytes=32 time=12ms TTL=61
Reply from 192.168.100.1: bytes=32 time=10ms TTL=61
Reply from 192.168.100.1: bytes=32 time=13ms TTL=61

Ping statistics for 192.168.100.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 10ms, Maximum = 13ms, Average = 11ms

C:\Users\Boom>tracert 192.168.100.1

Tracing route to SAMBA [192.168.100.1]
over a maximum of 30 hops:

1 1 ms 1 ms 1 ms 192.168.101.99
2 2 ms 11 ms 11 ms 10.10.0.1
3 11 ms 9 ms 16 ms SAMBA [192.168.100.1]

Trace complete.

---------------------------------------------------------------------------------
Ping and Tracer of router in Main Office

C:\Users\Boom>ping 192.168.100.99

Pinging 192.168.100.99 with 32 bytes of data:
Reply from 192.168.100.99: bytes=32 time=13ms TTL=62
Reply from 192.168.100.99: bytes=32 time=11ms TTL=62
Reply from 192.168.100.99: bytes=32 time=13ms TTL=62
Reply from 192.168.100.99: bytes=32 time=10ms TTL=62

Ping statistics for 192.168.100.99:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 10ms, Maximum = 13ms, Average = 11ms

C:\Users\Boom>tracert 192.168.100.99

Tracing route to 192.168.100.99 over a maximum of 30 hops

1 1 ms 1 ms <1 ms 192.168.101.104
2 1 ms 9 ms 10 ms 10.10.0.1
3 12 ms 9 ms 10 ms 192.168.100.99

Trace complete.

jayem_heh

The full scenario

Remote Office Desktops

Working:

I can ping all computers, routers and server of the MAIN Office

Not Working:

I cannot access any service like shared folders, rdp etc

Main Office Desktops

Working:

I can ping all computers, routers and servers of the Remote Office

Not Working:

I cannot access any service like shared folders, rdp etc

VPN Server (Main Office) and VPN Client (Remote Office)

Working:

I can ping and access all computers, routers and servers.

I can access all services

300000

how can you access to service like share folder , rdp. you type the ip of pc you want to access or name to access? could you give extract full address

now there is nothing wrong with openvpon , it is working site to site so only your dns server not working that is why i ask you how you access to service to all pc?

jayem_heh

@300000

Thanks for the time that you share with me.

When I am on the VPN Client, I am hitting the Servers in the Main Office in their IP's.
When I am on the VPN Server, I am hitting the Servers in the Remote Office in their IP's as well.

I want to access only using IP. so I don't need DNS.

Main Office Router 192.168.100.99
VPN Server 192.168.100.35 10.10.0.1
SAMBA 192.168.100.1
Desktop PC 192.168.100.2

Remote Office Router 192.168.101.99
VPN Client 192.168.101.104 10.10.0.6
NetworkShare 192.168.101.1
Desktop PC 192.168.101.2

Remote Office Desktop cannot access service of Servers in Main Office.
Main Office Desktop cannot access service of Servers in Remote Office.

jayem_heh

To clarify this is the topology as of now

300000

can you correct static route on office A 192.168.101.1 255.255.255.0 192.168.100.35 , correct one is 192.168.101.0 255.255.255.0 192.168.100.35

jayem_heh

@300000

It was typo error but I double check on the router it is correct as you said. 192.168.101.0 255.255.255.0 192.168.100.35.

300000

Only thing is iptable . Let backup it first and do just one and clear all rule only one Nat rule

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

I think you make forward to 192.168.100.0 on iptables so it only range go do it on both openvpn server and client

jayem_heh

@300000

Sure I will do that tomorrow, I will keep you posted. I will backup the current iptables.

after I will execute
iptables -F

iptables -t nat -A POSTROUTING -o XXXX -j MASQUERADE

serivce iptables save

systemctl restart iptables.service

I will do this to both openvpn server and client.

jayem_heh

@300000

After doing this reset of IPtables everything went well. Thank you for the time you spent for helping me deal with this issue.

Also can you explain why this entry cause issue before.

Previous IPTables

Server Side
Iptables
-A FORWARD -s 10.10.0.0/24 -d 192.168.100.0/24 -i tun0 -o enp2s0 -m conntrack --ctstate NEW -j ACCEPT
(Please correct me if I am wrong, I think this is the cause of my issue -d 192.168.100.0/24)
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A POSTROUTING -s 10.10.0.0/24 -o enp2s0 -j MASQUERADE

Client Side
Iptables
-A FORWARD -s 10.10.0.0/24 -d 192.168.101.0/24 -i tun0 -o enp3s0 -m conntrack --ctstate NEW -j ACCEPT
(Please correct me if I am wrong, I think this is the cause of my issue -d 192.168.101.0/24)
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A POSTROUTING -s 10.10.0.0/24 -o enp3s0 -j MASQUERADE

This is just clarification for my side to know what happen.

This thread resolve thanks for the help @300000.

Regards,
Jay