Openvpn Site 2 Site

gucio

Hello,
I have tried to setup Site to Site configuration between two LAN. I have got two linux boxes which are also working as a router, gateway for LAN hosts.
My environment looks like a picture below:

AS1:
- eth1: 83.18.107.xxx, eth0: 10.11.0.1/24, eth2:192.168.1.2/24
- tun1: 10.4.7.1

local 83.18.107.xxx
port 11195
proto tcp
dev tun1
comp-lzo
ca /usr/local/openvpn-2.2.0/config/ca.crt
cert /usr/local/openvpn-2.2.0/config/bandrowskiego.crt
key /usr/local/openvpn-2.2.0/config/keys/bandrowskiego.key
dh /usr/local/openvpn-2.2.0/config/dh1024.pem
server 10.4.7.0 255.255.255.0
ifconfig-pool-persist /usr/local/openvpn-2.2.0/config/ipp.txt
push "route 10.11.0.0 255.255.255.0"
push "route 192.168.1.0 255.255.255.0"
client-config-dir client-configs
route 10.11.2.0 255.255.255.0
keepalive 10 120
cipher BF-CBC        # Blowfish (default)
max-clients 10
user nobody
group nobody
persist-key
persist-tun
status /var/log/openvpn-status.log
verb 5
daemon
script-security 2
writepid /var/log/openvpn-s2s.pid

AS2:
- eth0: 46.170.154.xxx, eth1: 10.11.2.254/24,
- tun1: 10.4.7.6

client
dev tun1
comp-lzo
remote 83.18.107.xxx
ca /usr/local/openvpn-2.2.0/config/ca.crt
cert /usr/local/openvpn-2.2.0/config/warsztat.crt
key /usr/local/openvpn-2.2.0/config/keys/warsztat.key
cipher BF-CBC
proto tcp
port 11195
log-append /var/log/openvpn.log
verb 4
user nobody
group nobody
daemon
persist-tun
persist-key
script-security 2
writepid /var/log/openvpn-s2s.pid

I have problem with connectiviity from AS1 which is working as a server to LAN behind AS2 - 10.11.2.254/24. There is connecitivty from AS2 to AS1, both LAN networks are reachable.
I am not able to ping any host from AS1 which is located in AS2, for example 10.11.2.1. I used tcpdumpe on AS1 and AS2

17:54:49.119680 IP 10.4.7.1 > 10.11.2.1: ICMP echo request, id 17759, seq 5, length 64
17:54:50.119678 IP 10.4.7.1 > 10.11.2.1: ICMP echo request, id 17759, seq 6, length 64
17:54:51.119617 IP 10.4.7.1 > 10.11.2.1: ICMP echo request, id 17759, seq 7, length 64

Tcpdump does not show anything ICMP traffic on AS2.

There is a static routing to network 10.4.7.0/24 added on AS2:

10.4.7.0        10.4.7.2        255.255.255.0   UG    0      0        0 tun1

May I please for any hints?

Thank you in advance,
Regards,
Gucio

maikcat

hi there,

did you enabled ip forwarding on both servers?

also..

iptables config?

Michael.

gucio

Hi Michael.
Thank you for answer..
Yes, I have enabled ipv4 forwarding on the both Linux boxes. During the test I stopped iptables rules... But I am using high log level on all chains, so every packet which is dropped I can notice in the kernel log.

It behaves very wired, I can see only outgoing traffic on TUN1 (AS1)

21:07:31.702752 IP 10.4.7.1 > 10.11.2.1: ICMP echo request, id 60715, seq 114, length 64
21:07:32.703254 IP 10.4.7.1 > 10.11.2.1: ICMP echo request, id 60715, seq 115, length 64
21:07:33.703699 IP 10.4.7.1 > 10.11.2.1: ICMP echo request, id 60715, seq 116, length 64
21:07:34.704169 IP 10.4.7.1 > 10.11.2.1: ICMP echo request, id 60715, seq 117, length 64

and I can not see any traffic on the AS2.

Appreciate your help.
Regards,
Gucio

maikcat

hi there,

if you want lan to lan you must create a ccd file (on server A) named after the cert used on client server
with the following in it

iroute 10.11.2.0 255.255.255.0

reconnect your client and try again

Michael.

gucio

Michael,

That works perfectly!! I have created directory which you have suggested and file with the cert name on client box with i route rule.
Thank you a lot, you were very helpfull. :-)

Kind Regards,
Gucio,

maikcat

ok then

closing topic

Michael.