Hi all,
Sorry for such a newbie question. I am running a VPN between two Ubuntu 10.04 server with openvpn 2.1.0-1ubuntu1.1. I need to establish communication between both networks. Unless you tell me to, there are no iptables involved. Scenario:
Server LAN address: 192.168.0.100/24 (ovpn.dominio)
Client LAN address: 10.1.0.1/16
VPN network: 10.255.0.0/24
192.168.0.0/24 default GW: 192.168.0.254 (gw.dominio)
Server.conf:
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server 10.255.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ccd
route 10.1.0.0 255.255.0.0
route 10.255.0.0 255.255.0.0
push "route 192.168.0.0 255.255.255.0"
client-to-client
keepalive 10 120
tls-auth ta.key 0
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
mute 20
script-security 1 execve
Client conf 'ccd\cliente':
iroute 10.1.0.0 255.255.255.0
ifconfig-push 10.255.0.2 10.255.0.1
On gw.dominio (192.168.0.254) there is a route for 10.1.0.0 via 192.168.0.100.
With such config, when I get the VPN connected, any 192.168.0.0/24 machine is able to ping the client 10.1.0.1, but not another machine on the 10.1.0.0/16 network:
root@desktop:~# traceroute 10.1.0.1
traceroute to 10.1.0.1 (10.1.0.1), 30 hops max, 60 byte packets
1 gw.dominio (192.168.0.254) 0.409 ms 0.453 ms 0.548 ms
2 ovpn.dominio (192.168.0.100) 0.731 ms 0.758 ms 0.774 ms
3 10.1.0.1 (10.1.0.1) 21.512 ms 22.055 ms 22.730 ms
root@desktop:~#
root@desktop:~# traceroute 10.1.0.3
traceroute to 10.1.0.3 (10.1.0.3), 30 hops max, 60 byte packets
1 gw.dominio (192.168.0.254) 0.422 ms 0.495 ms 0.589 ms
2 ovpn.dominio (192.168.0.100) 0.720 ms 0.759 ms 0.811 ms
3 10.255.0.2 (10.255.0.2) 21.766 ms 22.897 ms 23.498 ms
4 * * *
5 * * *
6 *^C
root@desktop:~#
Notice that the third hop is different. The same occurs if tracerouting from ovpn.dominio itself, but not routing trough gw.dominio. Routing tables on client and server:
Server:
root@ovpn:/etc/openvpn# route -n
Tabela de Roteamento IP do Kernel
Destino Roteador MáscaraGen. Opções Métrica Ref Uso Iface
10.255.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
10.255.0.0 10.255.0.2 255.255.255.0 UG 0 0 0 tun0
192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth3
10.1.0.0 10.255.0.2 255.255.0.0 UG 0 0 0 tun0
10.255.0.0 10.255.0.2 255.255.0.0 UG 0 0 0 tun0
0.0.0.0 192.168.0.254 0.0.0.0 UG 0 0 0 eth3
root@ovpn:/etc/openvpn#
Client:
root@cliente:/etc/network# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.255.0.1 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
aaa.bbb.ccc.160 0.0.0.0 255.255.255.252 U 0 0 0 eth1
10.255.0.0 10.255.0.1 255.255.255.0 UG 0 0 0 tun0
192.168.0.0 10.255.0.1 255.255.255.0 UG 0 0 0 tun0
10.1.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0
0.0.0.0 aaa.bbb.ccc.162 0.0.0.0 UG 100 0 0 eth1
root@cliente:/etc/network#
On the server log I get this:
Sep 1 14:24:09 ovpn ovpn-server[2265]: cliente/aaa.bbb.ccc.161:35006 SENT CONTROL [cliente]: 'PUSH_REPLY,route 192.168.0.0 255.255.255.0,route 10.255.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.255.0.2 10.255.0.1' (status=1)
Further, I will have to do the same with another network (10.2.0.1/16) and make them all talk nicely. Thanks in advance for any help on pointing what is missing/wrong and advices to make each net see the other.
Best regards,
--
Marcio Merlone
