[SOLVED] Error forward

jotremar

I have a openvpn client, one openvpn server and a server without openvpn.

Server without openvpn only accept connections from openvpn server by public ip (outside of lan).
openvpn clients must connect with server without openvpn. For it, I use vpn connection with openvpn server like gateway.

The problem is that connection not work. A tcpdump show that syn are ok, but there is not response (ack).

Server

port 11194
proto udp
dev tun
#---- Seccion de llaves -----
ca keys/ca.crt
cert keys/servidor.crt
key keys/servidor.key
dh keys/dh1024.pem
#----------------------------
server 192.168.37.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
persist-key
persist-tun
push "redirect gateway def1"
push "route public.outside.servers.ip 255.255.255.0"
#openvpn network 
push "route 192.168.37.0 255.255.255.0"
#local network openvpn server
push "route 10.129.2.0 255.255.255.0"
status openvpn-status-servidorvpn-udp.log

echo 1 > /proc/sys/net/ipv4/ip_forward

client

client
dev tun
proto udp
remote vpn.server 11194
float
resolv-retry infinite
nobind
persist-key
persist-tun
#------ SECCION DE LLAVES --------
ca "C:\\llaves\\ca.crt"
cert "C:\\llaves\\todorecargas.crt"
key "C:\\llaves\\todorecargas.key"
ns-cert-type server
#---------------------------------
comp-lzo
verb 3

maikcat

hi there,

i have a hard time to understand this:

erver without openvpn only accept connections from openvpn server by public ip (outside of lan).

can you give me more details about your setup..?

btw
remove this from your server config:

push "route public.outside.servers.ip 255.255.255.0"
push "route 192.168.37.0 255.255.255.0"

also
10.129.2.0 is your server side network?

Michael.

jotremar

For example:

PC with IP 1.1.1.1 must connect to 3.3.3.3 but firewall only accept connections from 2.2.2.2
I try to use OpenVPN like gateway for break this restriction.
1.1.1.1 can do ping to 192.168.37.1 and 10.129.2.10 but can't connect to 3.3.3.3

On OpenVPN server I do a tcpdump and it show this:
192.168.137.6->3.3.3.3 http [SYN]

but i don't see responses like 3.3.3.3->192.168.137.6 port [ACK,SYN]

I think that there is a problem with forwarding but I don't see what is the problem.

public.outside.servers.ip in this case is 3.3.3.0

maikcat

hi there,

you must allow traffic from vpn ip of your client to your server ip firewall..

stupid question

is openvpn server and server with firewall in the same network?

Michael.

jotremar

Both servers are on differents networks, differents countries... without VPN between they.
OpenVPN server have iptables, but it have no rules. It have a firewall by hardware but only for close incoming ports.

tcpdump say that clients can connect with server with firewall but I don't see responses to that connections. It must to see that came from openvpn server (2.2.2.2), it must not see that it came from vpn client, like a gateway.

maikcat

you will have to enable NAT on your openvpn server
so that every packet that leaves your client through
openvpn tunnel must look like it came from openvpn server itself.

you need something like

iptables -t nat -A POSTROUTING -s 192.168.37.0/24 -o eth0 -j MASQUERADE

openvpn server is linux,right?

so add this to your openvpn server conf

push "route public.outside.servers.ip 255.255.255.255"

with mask /32 not /24...

Michael.

jotremar

OpenVPN server is a centos 5

I do this changes and it not work. Now there isn't packets of SYN on tcpdump, there isn't connections to 3.3.3.3

jotremar

Now it work. I change 192.168.37.0 to 10.129.2.0 on iptables and it work.

Thank you.