VPN connection built and could access Internet, but could not connect to other LAN servers

fweng322

Hi,

I know it may be an FAQ, but still couldn't find solution. I'll show some documents and articles I've read later.

My scenario is:
OpenVPN Server 2.5.1 running on Debian Bullseye, LAN IP 192.168.212.58, there are other servers I want to access through VPN, all in subnet 192.168.212.0/24.
tun0 subnet: 192.168.199.0/24

port 1194
proto tcp
dev tun
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/issued/server.crt
key /etc/openvpn/server/private/server.key # This file should be kept secret
dh /etc/openvpn/server/dh.pem
topology subnet
server 192.168.199.0 255.255.255.0
ifconfig-pool-persist /var/log/openvpn/ipp.txt
push "route 192.168.199.0 255.255.255.0"
push "route 192.168.212.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 1.1.1.1"
client-to-client
keepalive 10 120
tls-auth /etc/openvpn/server/ta.key 0 # This file is secret
cipher AES-256-CBC
data-ciphers AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
log /var/log/openvpn/openvpn.log
log-append /var/log/openvpn/openvpn.log
verb 4

Client also Debian Bullseye and OpenVPN 2.5.1:

client
dev tun
proto tcp
remote my_openvpn_server 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca /etc/openvpn/keys/v7/ca.crt
cert /etc/openvpn/keys/v7/franklin.crt
key /etc/openvpn/keys/v7/franklin.key
remote-cert-tls server
tls-auth /etc/openvpn/keys/v7/ta.key 1
cipher AES-256-CBC
data-ciphers AES-256-CBC
verb 4
redirect-gateway def1
log /var/log/openvpn/openvpn.log
log-append /var/log/openvpn/openvpn.log

The VPN connection could be built successfully, and the client side could access Internet through VPN (checked with whatsmyip.org).

I could also ping the server IP, both tun (192.168.199.1) and LAN (192.168.212.58). However, I could not ping other machines in LAN (e.g., 192.168.212.50).

I added

iptables -t nat -A POSTROUTING -o $EXT_IF -s 192.168.199.0/24 -j MASQUERADE

in my iptable rules.

I think it seems to be a routing issue. Here are the routing tables of server and client after VPN connection built:

Routing table in server:

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         0.0.0.0         0.0.0.0         U         0 0          0 ppp0
168.95.98.254   0.0.0.0         255.255.255.255 UH        0 0          0 ppp0
192.168.199.0   0.0.0.0         255.255.255.0   U         0 0          0 tun0
192.168.212.0   0.0.0.0         255.255.255.0   U         0 0          0 ens19

Routing table in client:

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         192.168.199.1   128.0.0.0       UG        0 0          0 tun0
0.0.0.0         192.168.50.1    0.0.0.0         UG        0 0          0 wlp4s0
118.167.244.54  192.168.50.1    255.255.255.255 UGH       0 0          0 wlp4s0
128.0.0.0       192.168.199.1   128.0.0.0       UG        0 0          0 tun0
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 docker0
172.17.0.0      0.0.0.0         255.255.0.0     U         0 0          0 docker0
192.168.50.0    0.0.0.0         255.255.255.0   U         0 0          0 wlp4s0
192.168.199.0   0.0.0.0         255.255.255.0   U         0 0          0 tun0
192.168.212.0   192.168.199.1   255.255.255.0   UG        0 0          0 tun0

The documents I checked includes but not limited to:
OpenVPN HOWTO, especially this section
OpenVPN - Client cannot ping internal network machines
Troubleshooting client VPN tunnel connectivity
Cannot Connect to local LAN
OpenVPN routing to LAN

Any help will be appreciated!

TinCanTech

fweng322 wrote I could also ping the server IP, both tun (192.168.199.1) and LAN (192.168.212.58). However, I could not ping other machines in LAN (e.g., 192.168.212.50).

I added
iptables -t nat -A POSTROUTING -o $EXT_IF -s 192.168.199.0/24 -j MASQUERADE
in my iptable rules.

You added the TUN interface address .199, it should be your ethernet address .212

And be sure to set $EXT_IF correctly.

fweng322

TinCanTech wrote
fweng322 wrote I could also ping the server IP, both tun (192.168.199.1) and LAN (192.168.212.58). However, I could not ping other machines in LAN (e.g., 192.168.212.50).

I added
iptables -t nat -A POSTROUTING -o $EXT_IF -s 192.168.199.0/24 -j MASQUERADE
in my iptable rules.
You added the TUN interface address .199, it should be your ethernet address .212

And be sure to set $EXT_IF correctly.

Thanks for replying.

Did you mean that in my Server.conf I should directly set

server 192.168.212.0 255.255.255.0

instead of

server 192.168.199.0 255.255.255.0

? But this way the server will take 192.168.212.1 as its IP address which has been taken by another server.

TinCanTech

Is that what I said ?

Oh no, that's just you making something crazy up in your head..

fweng322

TinCanTech wrote Is that what I said ?

Oh no, that's just you making something crazy up in your head..

Sorry for not getting it. Could you please explain in more detail? What should I do?

TinCanTech

It's right there. Read it again..

fweng322

TinCanTech wrote Is that what I said ?

Oh no, that's just you making something crazy up in your head..

(Originally I thought I found the solution but then realized not... So edit this post)

TinCanTech

fweng322 wrote I found the solution. I should use tap instead of tun since it is bridging mode.

Then you are completely screwed.

fweng322

TinCanTech wrote
fweng322 wrote I could also ping the server IP, both tun (192.168.199.1) and LAN (192.168.212.58). However, I could not ping other machines in LAN (e.g., 192.168.212.50).

I added
iptables -t nat -A POSTROUTING -o $EXT_IF -s 192.168.199.0/24 -j MASQUERADE
in my iptable rules.
You added the TUN interface address .199, it should be your ethernet address .212

And be sure to set $EXT_IF correctly.

I finally got it.

The above rule is to masquerade 199.0 to EXT_IF (ppp0) in order to access Internet.
I need to add another rule

iptables -t nat -A POSTROUTING -o $INT_IF -s 192.168.199.0/24 -j MASQUERADE

in order to access .212.0 LAN ($INT_IF).

Thanks for your help!