[resolved] OpenVPN tunnel problem on OBSD 4.9

[zealer]

Hello dear experts,

I have OpenVPN-2.2.1 configured on two OpenBSD 4.9
I am able to ping: client -> server and all networks behind
I am not able to ping: server -> client at all

I already checked my FW, you can see the configuration below.
Ping works with pf and OpenVPN stopped. (OK)
Ping does not work with pf enabled and openVPN stopped. (OK)
Ping works in only one direction with pf and OpenVPN enabled (NOT OK)

And a small question: why is there one tunnel from the client's point of view (10.0.1.6 -> 10.0.1.5, see screens below), but from the server's point of view - there is a different tunnel (10.0.1.1 -> 10.0.1.2)? What am I missing here? In my understanding, there should be only one tunnel (for example 10.0.1.0/30, with .0 being the net, .1 server, .2 the client and .3 the broadcast).


Why can't I initiate any connection from server to client? Please help me figure that out... i have a feeling it is something really simple, but I dont know where to go from here...
Uploaded are screenshots with my setup:

The simple topology:


Firewall setup:


OpenVPN configurations:


Interface IPs + routing tables:


Ping from client to server succeeds:


Ping from server to client fails:


I am also uploading the OpenVPN logs (verb=6). The successful ping (client->server, 5 packets) was initiated exactly at 21:29:30 and the 'unsuccessful' ping (server->client, 6 packets) was initiated at 21:29:45
OpenVPN Server-side log:
link #1 (w/ 10 sec timer): http://www.yourfilelink.com/get.php?fid=714560
link #2 (local file share server): http://dox.bg/files/dw?a=5535558a24

OpenVPN Client-side log:
link #1 (w/ 10 sec timer): http://www.yourfilelink.com/get.php?fid=714563
link #2 (local file share server): http://dox.bg/files/dw?a=2b17aa9164

I hope I havent missed any important information... one thing worth noting is the "openvpn: writing to routing socket: Protocol not supported" during OpenVPN startup on the server...


Thank you VERY much in advance for your help, it is greatly appreciated!
Kind regards,
Simeon

[Mimiko]

And a small question: why is there one tunnel from the client's point of view (10.0.1.6 -> 10.0.1.5, see screens below), but from the server's point of view - there is a different tunnel (10.0.1.1 -> 10.0.1.2)? What am I missing here? In my understanding, there should be only one tunnel (for example 10.0.1.0/30, with .0 being the net, .1 server, .2 the client and .3 the broadcast).

It's the way the tunnel is made. Every client, including server, have a private /30 subnet with the tun adapter. The adapter is joining everyone. If you whant to see only one network, you can use bridging.

Ping works in only one direction with pf and OpenVPN enabled (NOT OK)

As you can see, it's defiately a firewall problem on client. From screen shot I see that everything is blocked except the rules specified in the list, which does not include allowing pings from tun0. Please read the manual for pf from this link http://openbsd.org/faq/pf/filter.html and adjust you client's pf file to the rules onf using pf. Ypu may have incorrectly write commands.

[zealer]

First - about the tunnel question - thanks for the explanation.
Second - about the actual issue - why do you insist on this being a FW issue? The pf.conf are identical on both the server and the client. If what you say is true, ping should fail in both directions. Take a look at the last screenshot - no VPN packets leave the server's physical interface - i.e. definately not a firewall problem on the client.

Thanks

[Mimiko]

Mostly it's a firewall issue. So pinging 192.168.0.1 leads to a forward question on client. Is forwarding enabled on client? Try ping 192.168.2.200. Althought strange ip's have your client and server.

[zealer]

Yes, it is enabled (interfaces screenshot http://img842.imageshack.us/img842/6941 ... routes.png)

A ping sweep (10.0.1.1 to 10.0.1.10) from the client succeeds only on 10.0.1.1, and from the server - only on 10.0.1.6, i.e. they can only ping the address that appears on ifconfig tun0 on the remote machine (same screen)

[Mimiko]

Oke. Please post OpenVPN servers config file. May be you didn't write a route and iroute option.

[zealer]

Please refer to the third screenshot, right side of the screen

[Mimiko]

Sorry, I missed it.

Did you create a file under /etc/openvpn/ccd with name from cname of the client and write in it the option:
iroute 192.168.0.0 255.255.255.0
iroute 192.168.1.0 255.255.255.0

This is a must to add an internal route to clients LAN. Its not system route, it is OpenVPN internal route.

[zealer]

Brilliant! This resolved my problem.

Thank you Mimiko!

Cheers,
Simeon