partial success

chanlists

Hi everybody,

I am trying to get the following config to work. Our place has a network, say

a.b.103.0/255.255.255.0
a.b.102.192/255.255.255.192.

My gateway is located in the above network and has the address a.b.103.224 and has port 1194 through 1195 open to the outside. For now, I would like to accomodate two different configs. In the first config (a), external computers should be able to access the above networks, and have all network traffic transmitted via the gateway. In the second config (b), they should only be able to access the above networks, but all other traffic should not be redirected. My idea was to run config (a) on port 1194 and config (b) on port 1195.

On the gateway (debian squeeze), I use the following configs:

1194.conf (gateway)
--------------------
client-cert-not-required
username-as-common-name
plugin /usr/lib/openvpn/openvpn-auth-pam.so krb5
local a.b.103.224
port 1194
proto udp
dev tun
ca my_ca.crt
cert my_cert.crt
key my_key.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp_1194.txt
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status_1194.log
verb 3
mute 20
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS my_dns_ip"

1195.conf (gateway)
--------------------
client-cert-not-required
username-as-common-name
plugin /usr/lib/openvpn/openvpn-auth-pam.so krb5
local a.b.103.224
port 1195
proto udp
dev tun
ca my_ca.crt
cert my_cert.crt
key my_key.key
dh dh2048.pem
server 10.9.0.0 255.255.255.0
ifconfig-pool-persist ipp_1195.txt
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status_1195.log
verb 3
mute 20
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS my_dns"
push "route a.b.103.220 255.255.255.255"
push "route a.b.102.192 255.255.255.192"

1194.conf (client)
-----------------
auth-user-pass
client
dev tun
proto udp
remote fqdn_of_gateway 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca my_ca.pem
comp-lzo
verb 3

management 127.0.0.1 1194
management-hold
management-query-passwords
auth-retry interact

1195.conf (client)
-----------------
auth-user-pass
client
dev tun
proto udp
remote fqdn_of_gateway 1195
resolv-retry infinite
nobind
persist-key
persist-tun
ca my_ca.pem
comp-lzo
verb 3

management 127.0.0.1 1195
management-hold
management-query-passwords
auth-retry interact

IP forwarding is activated on the gateway; masquerading is also active:

# cat /proc/sys/net/ipv4/ip_forward
1

# iptables -t nat -n -L
Chain PREROUTING (policy ACCEPT)
target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 10.8.0.0/24 0.0.0.0/0
MASQUERADE all -- 10.9.0.0/24 0.0.0.0/0

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

On windows, I use the openvpn MI GUI. The first config (a) (full redirect) works flawlessly; using the second config, I cannot access any machines on the a.b.... network. How can I further debug this? Is there anything obviously wrong? Thanks and best regards,

Christian

Mimiko

You made both access internet thru VPN and only one access server's LAN. Add

push "route a.b.103.0 255.255.255.0"
push "route a.b.102.192 255.255.255.192"

to both configuration files, and

push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS my_dns"

to only one configuration file, ie (a).

chanlists

Mimiko wroteYou made both access internet thru VPN and only one access server's LAN. Add

push "route a.b.103.0 255.255.255.0"
push "route a.b.102.192 255.255.255.192"

to both configuration files, and

push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS my_dns"

to only one configuration file, ie (a).

Thanks for your answer. It turns out I actually had a mistake in the config files I posted, and the ones I am testing were slightly different. The first one (a) has only

push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS my_dns"

and works flawlessly, both for accessing computers on the internal networks and beyond. The second one has only

push "route a.b.103.0 255.255.255.0"
push "route a.b.102.192 255.255.255.192"

and does not allow me to access machines on the a.b.103.0/24 and a.b.102/27 networks.

Mimiko

Please post log from server and client, where access does not work. Also show a treacert to server's lan compter and routing table from the client where access does not work.
In server's configs you must use different tun addapter: tun0 and tun1.

chanlists

Mimiko wrotePlease post log from server and client, where access does not work. Also show a treacert to server's lan compter and routing table from the client where access does not work.
In server's configs you must use different tun addapter: tun0 and tun1.

Hm. I think I have an idea of what might be going on. The route commands in config (b) set up routes for a subnet, but the public IP address of the gateway is within that subnet. Could it be that once the route command is executed, the client can no longer reach the gateway? Because if I push specific routes for specific hosts, I can reach those in config (b). So some trick like a more specific route needs to be implemented which prevents traffic to the public IP of the gateway from being routed through the tunnel. Can this be done?

Mimiko

Only you can figurea out the situation, I don't have the full ip configuration's you use, ie. you masked ip's.

chanlists

Mimiko wroteOnly you can figurea out the situation, I don't have the full ip configuration's you use, ie. you masked ip's.

So currently I do

push "route a.b.103.0 255.255.255.0"
push "route a.b.102.192 255.255.255.192"

But the IP address of the server machine is a.b.103.224, which is on the a.b.103.0/24 subnet, and that seems to be the problem. So I need to push a route specifically for a.b.103.224 to the client that overrides the above routes, kind of like in the dhcp trick for the redirect-gateway. Could you give me a hint, or do I need to post more information? Thanks,

Christian

Mimiko

You can use

push "route a.b.c.d 255.255.255.255 net_gateway"

chanlists

Mimiko wroteYou can use

push "route a.b.c.d 255.255.255.255 net_gateway"

That was it! Thanks,

Christian