How to reach computers in the openvpn server network?

SaturnusDJ

I'm pretty new to this networking/VPN stuff.

Using this (pdf) page 291-295, I succeeded creating a working OpenVPN server config.

Now I want to access computers in the network of the OpenVPN server without using "add route" at those machines or connect them all to the VPN server and use client-to-client. For a total of ~4 hours I tried bridging stuff from the pdf, the OpenVPN website and google results... I can't get it to work.

For example: when doing bridging as said in the pdf file, the real eth-device loses it's connectivity. :?

OpenVPN server: 192.168.1.21. (Ubuntu 10.04 server, one network adapter called eth1.)
I want to reach: 192.168.1.2 and maybe more.
Gateway: 192.168.1.1.
Subnet: 255.255.255.0.
Internet access comes through 192.168.1.1. That's also the router (DHCP) where the 192.168.1.[2-*] range is connected to.

Server config that worked fine:

port 443
proto tcp
dev tun

ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh1024.pem

server 10.8.0.0 255.255.255.0

keepalive 30 120
comp-lzo
max-clients 2
persist-key
persist-tun
status statuslog.log
log log.log
verb 3

What should I try first now?
Thanks!

Mimiko

Please read this http://www.openvpn.net/index.php/open-source/documentation/howto.html#scope

You don't need to set the connection as a bridge for remote access to server's lan.

SaturnusDJ

Thanks.

Next, you must set up a route on the server-side LAN gateway to route the VPN client subnet (10.8.0.0/24) to the OpenVPN server (this is only necessary if the OpenVPN server and the LAN gateway are different machines).

I've seen that page a few times. Maybe I'm assuming wrong but doesn't this mean that I must "add route" at the machine I want to access?
For flexibility reasons I don't like that.

Edit:
I just found out the 'static routing' option in my gateway device (router).

ID	Destination Network	Subnet Mask		Gateway		Interface
1		10.8.0.0				255.255.255.0	192.168.1.21	LAN & WLAN

Added this to server.conf

push "route 192.168.1.0 255.255.255.0"

So, the above config should work then right? (I'm at home right now (internal) and busy finding a way to test this, so far it's just bypassing the vpn route.)

Edit2:
netstat -r at client1 shows the gateway for 192.168.1.* is 10.8.0.5 so I assume this is going to work externally.

I'll post if it did. Now I'm going to try so bridging stuff again.

Mimiko

SaturnusDJ wrote
Next, you must set up a route on the server-side LAN gateway to route the VPN client subnet (10.8.0.0/24) to the OpenVPN server (this is only necessary if the OpenVPN server and the LAN gateway are different machines).
I've seen that page a few times. Maybe I'm assuming wrong but doesn't this mean that I must "add route" at the machine I want to access?

In parantheses is mentioned that this routing addition must be done IF OpenVPN server is on different comuter then LAN's GW.

SaturnusDJ

I am able to test using a external network of a friend. 🙂

Now when pinging from a computer inside the OpenVPN server network to a vpn client, the gateway routes to the OpenVPN server, which is good. But there it ends.

When pinging from the client to the computer inside the OpenVPN server's network, also nothing.

Why?

SaturnusDJ

Details:
Client:
Client trace to VPN server

 tracepath 10.8.0.1
 1:  10.8.0.6                                              0.396ms pmtu 1500
 1:  10.8.0.1                                             68.850ms reached
 1:  10.8.0.1                                            358.721ms reached
     Resume: pmtu 1500 hops 1 back 64

Client trace to computer in vpn server network

tracepath 192.168.1.1
 1:  10.8.0.6                                              0.650ms pmtu 1500
 1:  no reply

Client trace to vpn server internal ip address

tracepath 192.168.1.21
 1:  10.8.0.6                                              0.424ms pmtu 1500
 1:  192.168.1.21                                        118.741ms reached
 1:  192.168.1.21                                        342.736ms reached
     Resume: pmtu 1500 hops 1 back 64

Client config

client
dev tun
proto tcp
remote $ip 443
resolv-retry infinite
nobind
persist-key
persist-tun

ca ca.crt
cert client1.crt
key client1.key

ns-cert-type server
comp-lzo
verb 3
log log.log

The computer inside the OpenVPN server network:
Trace to VPN server vpn-ip-address

tracepath 10.8.0.1
 1:  computer.local (192.168.1.2)                          0.353ms pmtu 1500
 1:  10.8.0.1 (10.8.0.1)                                    0.904ms reached
 1:  10.8.0.1 (10.8.0.1)                                    0.823ms reached
     Resume: pmtu 1500 hops 1 back 64

Trace to vpn client

tracepath 10.8.0.6
 1:  computer.local (192.168.1.2)                          0.366ms pmtu 1500
 1:  no reply

Server config

port 443
proto tcp
dev tun

ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh1024.pem

server 10.8.0.0 255.255.0.0"
push "route 192.168.1.0 255.255.255.0"

keepalive 30 180
comp-lzo
persist-key
persist-tun
status status.log
log         log.log
verb 6

(I tried much variations at the push route.)

Mimiko

OpenVPN server: 192.168.1.21. (Ubuntu 10.04 server, one network adapter called eth1.)
I want to reach: 192.168.1.2 and maybe more.
Gateway: 192.168.1.1.
Subnet: 255.255.255.0.

So you have GW on IP 192.168.1.1 and OpenVPN on ip 192.168.1.21. Which is on different devices. So you have to add on each computer on the server lan a static route:

route add 10.8.0.0 mask 255.255.0.0 gw 192.168.1.21

SaturnusDJ

You think this route in the gateway/router isn't enough?

(I know the subnet isn't what it should be for the current config, because of testing so much settings yesterday.)

As you can see from the tracepath the computer inside the vpn server network can reach 10.8.0.1, so 10.8.0.6 should at least be correctly routed to 192.168.1.21 but after this something goes wrong.

Maybe this ifconfig of the OpenVPN server gives more information:

eth1      Link encap:Ethernet  HWaddr 08:00:27:77:69:32  
          inet addr:192.168.1.21  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::a00:27ff:fe77:6932/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:150 errors:0 dropped:0 overruns:0 frame:0
          TX packets:109 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:15918 (15.9 KB)  TX bytes:17030 (17.0 KB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:8 errors:0 dropped:0 overruns:0 frame:0
          TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:480 (480.0 B)  TX bytes:480 (480.0 B)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

(At the moment of the command no clients were connected.)
I have my doubts about the tunnel config...

Mimiko

Enable forwarding on OpenVPN and add those routes not on router, but on computers and see that it is working.

SaturnusDJ

Mimiko wroteEnable forwarding on OpenVPN

What do you mean with this? Is my current config not sufficient?

and add those routes not on router, but on computers and see that it is working.

I added the route at the computer inside the OpenVPN server network. Makes no different.

Breakthrough:

echo 1 > /proc/sys/net/ipv4/ip_forward

Now the computer looks accessible. I'll continue the testing and keep you up to date.
Strange this command isn't talked much about online.

Also needed:

ufw disable

This will disable iptables firewall via an ubuntu config utility. Not recommended, but I'll add firewall routes later.

SaturnusDJ

Ok I am at my normal extern location right now. And...it's not working (surprise).
I'm connected to the vpn server but unable to reach computers other than the vpn server.

Does anyone have a clue what's going on? It's like the one day it works, the other it does not. :evil:

Now it appears to be I also can't reach the server anymore, while I am connected. ...

I'm home, openvpn restarted, now working again. Appearently it's an unstable program. Remote testing will continue tomorrow.

Mimiko

OpenVPN is very stable. Using it on stable cable ISP and even mobile devices has a stable connection all day. Check the other software on the server and client which may rewrite route table and/or iptable rules.

SaturnusDJ

Thanks for your replies every time.

Just to be sure I disabled apache2 for tomorrow. (Wasn't running https.)
No other things currently run (Ubuntu 10.04 LTS Server x64). Iptables is turned off. Netstat looks fine.

Let's hope for the best.

SaturnusDJ

Today was a better day.

Pinging the vpn server at his internal network ip was possible. (Not special.)
Pinging the gateway of the network was possible.
But...pinging the main computer of the network did not work. Trace did. Services weren't usable.

Some info:

(Upper left: vpn server adapters and netstat, bottom left: client -> internal computer, right side: client connection log.)

So it looks like the vpn server still doesn't route everything? How could that be possible with ipv4 forwarding enabled, iptables disabled, and correct looking routes?

Who has a clue?

Mimiko

You came to this problem: https://forums.openvpn.net/topic9230.html

SaturnusDJ

You appear to be true about this. 🙂

What I don't understand is...why. Why is the route needed?
The situation without the route add is:
PC in network needs to send something to vpn client.
It doesn't have a special configured route to the vpn client so it will send the stuff to the router (right?) and say: I don't know where to send this, but I assume that you know, so forward this for me. And the router should know because I configured it that the vpn server is the gateway for all stuff to 192.168.2.0.

:?:

Mimiko

Why is the route needed?

Every packet needs a route to reach destination. You have to read a lot to understand.

A computer does not know that packets for other site must be send to the VPN server, so it send to default gw. The gw does not where to send the packet and forwards to its default gw, and so on. That's why you have to explecitely show the route for the other site.

SaturnusDJ

The gateway should know because of this entry I gave it:

Entry #1 is deleted now.

I asked my CCNA teacher and he told something about invalid network setup. Subnet mask being wrong for this to work etc. I'll try to talk again tomorrow.

Mimiko

Some routers are not capable of redirecting like this, check the router site for updates.

SaturnusDJ

Mine is because that picture is how I configured it. 😉
The route is even in the netstat of the gateway. 🙂