Client get IP but can't browse through intranet

iserhard

This is what's happening...

I see that they are connected and able to ping a name on intranet and get the ip from that name, but it's impossible even to ping any server/service inside.

Ubuntu Server 10.04.3 LTS

OpenVPN 2.1.0-1ubuntu1.1

server.conf:

dev tun

server 10.10.0.0 255.255.255.0
port 1194

#Chaves para a conexao SSL
ca /etc/openvpn/keys/ca.crt                  #CA
cert /etc/openvpn/keys/server.crt            #Certificado do servidor
key /etc/openvpn/keys/server.key             #Chave privada do servidor
dh /etc/openvpn/keys/dh1024.pem              #Parametros Diffie hellman

client-cert-not-required   #desobriga os clientes a possuirem cert.
duplicate-cn               #permite "COMMON NAME" duplicado nos certificados

comp-lzo                   #compressao de dados
max-clients 50
user  nobody               #usuario do openvpn
group nogroup              #grupo do openvpn
persist-key
persist-tun

#rotas
#push "redirect-gateway def1"

#modulo de autenticacao
auth-nocache              # previne cache de password

#plugin /usr/lib/openvpn/openvpn-auth-pam.so login
plugin /usr/local/lib/openvpn-auth-ldap.so "/etc/openvpn/ldap/auth-ldap.conf"

# Pinga a cada 10 segundos, assume desconexao
# se nao houver resposta num periodo de 1200 segundos.
keepalive 10 1200
ping-timer-rem

client-connect /etc/openvpn/scripts/client-connect.sh
client-disconnect /etc/openvpn/scripts/client-disconnect.sh

#Secao de logs
#status         /var/log/openvpn/udp-status.log
#log-append     /var/log/openvpn/udp-total.log
verb 5
push "route xxx.xx.0.0 255.255.0.0 vpn_gateway"

Mimiko

You didn't enabled forwarding on server. Please read this: http://www.openvpn.net/index.php/open-source/documentation/howto.html#scope

iserhard

I got this basic rules

# Liberacao de acesso ao serviço da VPN
iptables -A INPUT -p udp --dport 1194 -j ACCEPT    # A própria VPN

# Aceita conexoes estabelecidas e relacionadas 
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

It should work if I got this other two rules in the border firewall

/sbin/iptables -A firewall -d xxx.xx.x.xxx -p udp --dport 1194 -j ACCEPT
/sbin/iptables -A firewall -s xxx.xx.x.xxx -p udp --dport 1194 -j ACCEPT

xx being VPN real IP

right?

Mimiko

You migh use

iptables -A FORWARD -i tun+ -o eth0 -J ACCEPT
iptables -A FORWARD -i eth0 -o tun+ -J ACCEPT
iptables -A INPUT -i tun+ -J ACCEPT

iserhard

I add this:

# Allow TUN interface connections to OpenVPN server 
iptables -A INPUT -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -o eth0 -j ACCEPT
iptables -A FORWARD -i eth0 -o tun+ -j ACCEPT

still can't even ping from client. It's getting really weird

janjust

can the clients
* ping the VPN server IP (10.10.0.1) ?
* ping the VPN server LAN IP?
* ping the router on server-side LAN?

are servers on the server-side LAN aware of the VPN IP range and do they know what to do with packets coming from 10.10.0.x ?

iserhard

client CAN ping VPN server IP
CAN ping the VPN server LAN IP
and CANNOT ping router on server-side LAN

I just can't get out of the VPN server.

After adding the roules for tun+, client tried do ping and, weirdly, got ONE response (pong) and suddnly STOP pinging. i really can't get what's going on.

I tried this:

iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

guess what?

DIDN'T WORK...

janjust

again, for debugging, try this

iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE

does ping work after that?

iserhard

Still get that lonely PONG and then, nothing. I can't find no explanation for that behavior

I'm REALLY confused, because it really seem to be some network issue INSIDE the server, since FROM openvpn server I can ping ANYTHING, but clients can't and there's nothing we can do to make things work right, till now.

iserhard

As soon as the client connect, the last line I guet in OpenVPN log is:

SENT CONTROL [UNDEF]: 'PUSH_REPLY,route xxx.xx.0.0 255.255.0.0,route 10.10.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.10.0.6 10.10.0.5' (status=1)

Is there any problem here?

iserhard

I FOUND SOMETHING

I REMOVED our root certificate (*.pem) from the path that ldap.conf points to "/etc/ssl/certs"

Guess what? client connect (even if ldap can't authenticate, which means anyone can connect with ANY user and PASSWD) AND ping EVERYTHING inside.

I put certificate back on the path... CLIENT STOP PINGING