Multiple PC s on server side but not all can ping clients

hulky

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

maikcat

hi there,

if openvpn client can ping pcs inside your lan that
means that your routing is ok and works...

maybe your client has a firewall and drops connections from 192.168.2.0 net?
what OS is it?

Michael

hulky

Hi Thanks for the reply

all clients connected to VPN can ping these:

Computer 2 192.168.2.40 Debian

Computer 3 192.168.2.101 Windows server 2003

The problem is that from these 2 pc s which are on the server side cannot ping the clients on the 10.8.5.* network

Maybe this helps: computer 2 & 3 don't get an open vpn ip (10.8.5.*)

i need to connect to the vpn clients via the ips assigned by the openvpn server from computer 2 and 3

Any idea how this can be done?

Thanks for you help

maikcat

hi there,

if openvpn clients can ping both pcs (computer 2 &3 )
means that ip routing is correct..

if these both computers cant ping your clients
then something on your clients maybe blocking traffic (firewall maybe)

your clients what os they use?

Michael.

sanpej

I am having the same issue over here. I have a client which is connected to my VPN Server. My client is using a Dreambox. I am trying to access the user using the vpn ip from a windows xp which is found on the vpn server network to no avail. Do you think the problem is about a firewall on the dreambox because if i'm not mistaken there is no firewall on the dreambox by default. like hulky said, i can ping the windows xp from the client side but not from the windows xp to the client

maikcat

hi there,

AFAIK dreambox doesnt have firewall enabled (just a busybox)
which image are you using?

please post configs and details about your setup to help you..

Michael.

sanpej

Thanks for your fast reply. Please find below the configuration I have

VPN Server - server.conf

local 192.168.10.100
port 1194
proto udp
dev tun
mode server
tls-server
client-to-client
max-clients 300
persist-key
persist-tun
server 10.8.0.0 255.255.0.0
push "route 192.168.10.0 255.255.255.0"
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh1024.pem
tls-auth /etc/openvpn/keys/ta.key 0
ifconfig-pool-persist /etc/openvpn/ipp.txt
keepalive 20 180
reneg-sec 0
cipher AES-128-CBC   # AES
status openvpn-stauts.log
log /etc/openvpn/openvpn.log
verb 3

client.conf - found on dreambox

client
proto udp
remote dnsname.dyndns.com 1194
resolv-retry infinite
nobind
dev tun
ca /var/etc/openvpn/keys/ca.crt
cert /var/etc/openvpn/keys/xxxxx.crt
key /var/etc/openvpn/keys/xxxxx.key
tls-auth /var/etc/openvpn/keys/ta.key 1
ns-cert-type server
cipher AES-128-CBC   # AES
reneg-sec 0
ping-timer-rem

maikcat

is ip forwarding enabled on openvpn server?

just curious,what image you use on dm? which model?

Michael.

sanpej

in rc.local i have the below

iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
iptables -A FORWARD -j REJECT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

The image I am using is Gemini2 v5.1 OE1.6

maikcat

hi there,

>iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

why are you using nat?

also for tests disable ip tables...

Michael.

sanpej

I am going to remove the below from rc.local

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

I will also disable the iptables and will post again.

maikcat

also please open a new thread about your issue

Michael.

sanpej

Removed the below - still the same problem

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

Removed the below - still the same problem

iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
iptables -A FORWARD -j REJECT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

After removing the above the client could not ping the PC behind the VPN Server

iptables -L

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

hulky

We have the same problem mate ... i'm following

without ip tables client cannot connect to pc behind the server

I have also added

route 10.8.x.x 255.255.255.0 192.168.2.50

still no success

maikcat

to everyone reading

please create your own thread *dont* hijack other peoples threads..

you got me confused

@hulky

lets review one more the setup.

you have server with lan ip 192.168.2.50 and vpn ip 10.8.5.1
also you pushing route for 192.168.2.0 subnet to your clients.
in your local lan there is a second server with ip 192.168.2.40
disable whatever iptables you have

your clients connects fine and ping both 192.168.2.50 and 192.168.2.40 ips
but from your servers you cant ping the clients
right so far?

if the above is true then something on client side blocks traffic
if client is win7 there is an issue about public/private network thing....

@sanpej

i have worked with dreamboxes (500,600,7020,800,7025) with
various images (gemini,sif,nabilo) none of them have iptables
enabled on them by default,
they all do have telnet though (not SSH)

disable iptables on server
if you have enable ipforwarding on server thats ok

your server ip is 192.168.10.100 and vpn 10.8.0.1
also pushing route for 192.168.10.0 net to clients
when your dm connects if you issue a netstat -nr does it
shows a route for 192.168.10.0 network?
if yes can you ping 192.168.10.100?
if yes then dm accepts the routes.
from your openvpn server can you access the dreambox?
please update what problem EXACTLY you have...

Cheers,

Michael.

hulky

you have server with lan ip 192.168.2.50 and vpn ip 10.8.5.1
also you pushing route for 192.168.2.0 subnet to your clients.
in your local lan there is a second server with ip 192.168.2.40
disable whatever iptables you have

Correct

your clients connects fine and ping both 192.168.2.50 and 192.168.2.40 ips
but from your servers you cant ping the clients
right so far?

Not exactly, If i remove the ip tables clients can only connect to the .50 server but not to the .40
but if i add the ip tables in rc.local client can connect to both .50 and .40

from server .50 i can ping all clients on the vpn 10.8.x.x but from .40 (debian, no vpn installed, no ip tables etc...) I cannot

and that is what i need... to ping/connect to clients from the .40 pc

Thanks again for your help.

maikcat

hi there,

leave iptables down for the moment..
did you added a route to 192.168.2.40 server for the vpn subnet 10.8.5.0?

do you have any type of firewall running on 192.168.2.40?

Michael.

hulky

As routes I have:

push "route 192.168.2.0 255.255.255.0"
route 10.8.5.0 255.255.255.0 192.168.2.50

Firewall on the .40 its all standard what s there by default... do i have to change something?

maikcat

>Firewall on the .40 its all standard what s there by default... do i have to change something?

standard?!?!
what os is it?
if its win it blocks you.

can you post the output of netstat -nr on .40?

>did you added a route to 192.168.2.40 server for the vpn subnet 10.8.5.0?

i was reffering to .40 not openvpn config

Michael.

hulky

Hi

.40 is OS is Debian

can you post the output of netstat -nr on .40?

192.168.2.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
0.0.0.0 192.168.2.1 0.0.0.0 UG 0 0 0 eth0

did you added a route to 192.168.2.40 server for the vpn subnet 10.8.5.0?
No

Do i need to add this line to my vpn config?
route 10.8.5.0 255.255.255.0 192.168.2.40