OpenVPN subnet can't reach network I think I'm almost there

su4p

Hello,
I'm trying to reproduce part of the example given here :
https://openvpn.net/community-resources/configuring-client-specific-rules-and-access-policies/

My real local network is 192.168.5.0/24
My customer subnet is 10.8.1.0/24
My employees subnet is 10.8.0.0/24

I have no issue with the employees subnet.

For now I just want my customer subnet to be able to reach everything in the 192.168.5.0/24 with no restrictions like the 10.8.0.0/24.

local 192.168.5.202
port 1196
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-crypt tc.key
topology subnet
server 10.8.0.0 255.255.255.0
#push "redirect-gateway def1 bypass-dhcp"
#ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 192.168.5.254"
push "route 192.168.5.0 255.255.255.0"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 4
crl-verify crl.pem
explicit-exit-notify
client-config-dir /etc/openvpn/ccd
route 10.8.1.0 255.255.255.0
log-append /var/log/openvpn.log

I think there is something wrong here with the iroute or route : /etc/openvpn/ccd/customer

ifconfig-push 10.8.1.2 255.255.255.0
#ifconfig-push 10.8.0.2 255.255.255.0
#iroute 10.8.0.0 255.255.255.0
#route 192.168.5.0 255.255.255.0

iptables :

Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- 10.8.1.0/24 anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- 10.8.0.0/24 anywhere

/var/log/openvpn.log:

81.183.168.42:41372 VERIFY OK: depth=0, CN=Customer
81.183.168.42:41372 peer info: IV_VER=3.git:released:662eae9a:Release
81.183.168.42:41372 peer info: IV_PLAT=android
81.183.168.42:41372 peer info: IV_NCP=2
81.183.168.42:41372 peer info: IV_TCPNL=1
81.183.168.42:41372 peer info: IV_PROTO=2
81.183.168.42:41372 peer info: IV_AUTO_SESS=1
81.183.168.42:41372 peer info: IV_GUI_VER=net.openvpn.connect.android_3.2.4-5891
81.183.168.42:41372 peer info: IV_SSO=openurl
81.183.168.42:41372 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
81.183.168.42:41372 [Customer] Peer Connection Initiated with [AF_INET]81.183.168.42:41372
Customer/81.183.168.42:41372 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/Customer
Customer/81.183.168.42:41372 MULTI ERROR: primary virtual IP for Customer/81.183.168.42:41372 (10.8.1.2) violates tunnel network/netmask constraint (10.8.0.0/255.255.255.0)
Customer/81.183.168.42:41372 MULTI: Learn: 10.8.1.2 -> Customer/81.183.168.42:41372
Customer/81.183.168.42:41372 MULTI: primary virtual IP for Customer/81.183.168.42:41372: 10.8.1.2
Customer/81.183.168.42:41372 PUSH: Received control message: 'PUSH_REQUEST'
Customer/81.183.168.42:41372 SENT CONTROL [Customer]: 'PUSH_REPLY,dhcp-option DNS 192.168.5.254,route 192.168.5.0 255.255.255.0,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.1.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
Customer/81.183.168.42:41372 Data Channel: using negotiated cipher 'AES-256-GCM'
Customer/81.183.168.42:41372 Data Channel MTU parms [ L:1549 D:1450 EF:49 EB:406 ET:0 EL:3 ]
Customer/81.183.168.42:41372 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Customer/81.183.168.42:41372 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key

As you can see there is an error here :

MULTI ERROR: primary virtual IP for Customer/81.183.168.42:41372 (10.8.1.2) violates tunnel network/netmask constraint (10.8.0.0/255.255.255.0)

Help ?

TinCanTech

What version of openvpn is your server ?

su4p

TinCanTech wrote What version of openvpn is your server ?

OpenVPN 2.4.7 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 20 2019
library versions: OpenSSL 1.1.1d 10 Sep 2019, LZO 2.10
Originally developed by James Yonan
Copyright (C) 2002-2018 OpenVPN Inc <sales@openvpn.net>
Compile time defines: enable_async_push=no enable_comp_stub=no enable_crypto=yes enable_crypto_ofb_cfb=yes enable_debug=yes enable_def_auth=yes enable_dependency_tracking=no enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=needless enable_fragment=yes enable_iproute2=yes enable_libtool_lock=yes enable_lz4=yes enable_lzo=yes enable_maintainer_mode=no enable_management=yes enable_multihome=yes enable_pam_dlopen=no enable_pedantic=no enable_pf=yes enable_pkcs11=yes enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=no enable_server=yes enable_shared=yes enable_shared_with_static_runtimes=no enable_silent_rules=no enable_small=no enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=yes enable_werror=no enable_win32_dll=yes enable_x509_alt_username=yes with_aix_soname=aix with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no with_sysroot=no

TinCanTech

You missed a bit ..

server 10.8.0.0 255.255.252.0

su4p

TinCanTech wrote You missed a bit ..

server 10.8.0.0 255.255.252.0

81.61.17.167:46646 VERIFY OK: depth=0, CN=Customer
81.61.17.167:46646 peer info: IV_VER=3.git:released:662eae9a:Release
81.61.17.167:46646 peer info: IV_PLAT=android
81.61.17.167:46646 peer info: IV_NCP=2
81.61.17.167:46646 peer info: IV_TCPNL=1
81.61.17.167:46646 peer info: IV_PROTO=2
81.61.17.167:46646 peer info: IV_AUTO_SESS=1
81.61.17.167:46646 peer info: IV_GUI_VER=net.openvpn.connect.android_3.2.4-5891
81.61.17.167:46646 peer info: IV_SSO=openurl
81.61.17.167:46646 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
81.61.17.167:46646 [Customer] Peer Connection Initiated with [AF_INET]81.61.17.167:46646
Customer/81.61.17.167:46646 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/Customer
Customer/81.61.17.167:46646 MULTI: Learn: 10.8.1.2 -> Customer/81.61.17.167:46646
Customer/81.61.17.167:46646 MULTI: primary virtual IP for Customer/81.61.17.167:46646: 10.8.1.2
Customer/81.61.17.167:46646 PUSH: Received control message: 'PUSH_REQUEST'
Customer/81.61.17.167:46646 SENT CONTROL [Customer]: 'PUSH_REPLY,dhcp-option DNS 192.168.5.254,route 192.168.5.0 255.255.255.0,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.1.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
Customer/81.61.17.167:46646 Data Channel: using negotiated cipher 'AES-256-GCM'
Customer/81.61.17.167:46646 Data Channel MTU parms [ L:1549 D:1450 EF:49 EB:406 ET:0 EL:3 ]
Customer/81.61.17.167:46646 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Customer/81.61.17.167:46646 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key

Thank you it's way better.

I still have issue I cannot ping 10.8.0.1 nor 192.168.5.0.
The trace route of 192.168.5.0 goes by 10.8.0.1 but as it's not responding it doesn't come through.

So after changing the ccd customer to :

ifconfig-push 10.8.1.2 255.255.252.0

I can ping 10.8.0.1 but not 192.168.5.77

A little while later I saw that UFW was blocking 10.8.1.2 from reaching 192.168.5.254.
I tried to :

sudo ufw allow from 10.8.1.0/22

but it didn't work.
So I disabled UFW, but still no luck 10.8.0.1 doesn't forward to 192.168.5.0 :?

FYI :

net.ipv4.ip_forward = 1

TinCanTech

I use this:
https://community.openvpn.net/openvpn/wiki/HOWTO