Communication between client and server over vpn tunnel

[deleted]

Hi,

I have an openvpn site to site to site tunnel with multiple subnets going though it. Both server and client are running Debian Buster. Communication ie pings and other network traffic between pcs behind client and server works just fine. However pings or communication directly from client fail. For example my client debclient1 192.168.127.10 cannot ping debserver1 192.168.8.5, or any other PCs behind debserver1.

Here is the ping response from debclient1:
PING 172.16.200.2 (172.16.200.2) 56(84) bytes of data.
From 172.16.75.1 icmp_seq=1 Destination Port Unreachable
From 172.16.75.1 icmp_seq=2 Destination Port Unreachable
From 172.16.75.1 icmp_seq=3 Destination Port Unreachable
From 172.16.75.1 icmp_seq=4 Destination Port Unreachable
From 172.16.75.1 icmp_seq=5 Destination Port Unreachable

Here is the tun1 info from debclient1.
54: tun1: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
link/none
inet 172.16.75.74 peer 172.16.75.73/32 scope global tun1
valid_lft forever preferred_lft forever
inet6 fe80::8bc:d0c4:dca1:849/64 scope link stable-privacy
valid_lft forever preferred_lft forever

Is there a setting or static route I need to add to make this communication work?

TinCanTech

Help us to help you, please see: https://forums.openvpn.net/viewtopic.php?f=30&t=22603

[deleted]

Fair enough, I will provide requested tinfo. I was hoping it was a stupid easy fix.

I am using openvpn community edition version 2.4.7.

Here is the client config file:

client
resolv-retry 20
keepalive 2 10
nobind
mute-replay-warnings
remote-cert-tls server
compress
verb 1
persist-key
persist-tun
explicit-exit-notify 1
pull-filter accept "route 172.16.200.0"
pull-filter accept "route 172.16.0.0"
pull-filter ignore "route 10."
pull-filter ignore "route 172.16."
pull-filter ignore "route 192.168."
dev tun1
proto udp
port 1194
cipher AES-128-CBC
cert keys/Guest-HA-P.crt
key keys/Guest-HA-P.key
ca keys/Guest-HA-P.crt
remote 1.1.1.1 1194 # public address
remote 1.1.1.1 1194 # static WAN 3
remote 2.2.2.2 1194 # static WAN 5

Here is the server config file:
mode server
multihome
ca data/ca.crt
cert data/server.crt
key data/server.key
dh data/dh.pem
client-config-dir ccd
keepalive 2 10
user nobody
group nogroup
tls-server
compress
status openvpn-status.log
log /var/log/openvpn.log
verb 1
dev tun0
max-clients 2048
ccd-exclusive
persist-key
persist-tun
mute 20
ifconfig-pool-persist /etc/openvpn/address-pool-assignments.txt
push "register-dns"
proto udp
port 1194
cipher AES-128-CBC
server 172.16.75.0 255.255.255.128
management 127.0.0.1 1195
# Exports
push "route 172.16.200.0 255.255.252.0"
push "route 172.16.0.0 255.255.252.0"

TinCanTech

Please see: https://community.openvpn.net/openvpn/wiki/HOWTO#ExpandingthescopeoftheVPNtoincludeadditionalmachinesoneithertheclientorserversubnet

[deleted]

Thank you. That is a huge document, what section specifically do you want me to review? Also, I did a packet capture to try and further trouble shoot the issue. This is a site to site vpn with NO NAT. A packet capture show that when pinging from a PC behind the client the source address shows up as the client pc ip address (As it should). However, when I ping from the client itself, the source ip address shows up as 172.16.75.74, which is the tun1 ip address on the client. Thoughts?

TinCanTech

williamk777 wrote

pull-filter ignore "route 172.16."

Do you understand what this does ?

[deleted]

Yes, the openvpn server is on an UnTangle router. By default their config pushes out ALL the routes on the server to clients. I can change that in the config file, but the next time I restart the server the Untangle software will overwrite any changes I have made. So to prevent every route on my network being pushed out to all my clients, I am using pull-filters. Kind of messed up, but it works. Good point though, that filter could be blocking traffic in question. I will try tweaking that and see what happens.