I've got a LAN on the safe side of a firewall (the firewall runs OpenBSD), with a server running Windows Small Business Server 2003 and about 30 machines (a mix of Windows (XP, 7, 2000) and Linux) connected to it. The server is also the mail server (through Windows Exchange). There's also a nas, which exports several filesystems to machines on the LAN, though they're not repeated through the sbs. The sbs is at static address 10.1.70.4, and the firewall at 10.1.70.1. The OpenVPN server runs on the firewall; here's the config file (sans comments):
# ls -l /dev/tun1port 1194
proto udp
dev tun1
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/companyfw.crt
key /etc/openvpn/keys/companyfw.key # This file is secret
dh /etc/openvpn/keys/dh1024.pem
server 10.20.0.0 255.255.255.0
push "route 10.1.2.0 255.255.255.0"
push "route 10.1.70.0 255.255.255.0"
push "route 10.1.75.0 255.255.255.0"
duplicate-cn
keepalive 10 60
comp-lzo
max-clients 100
status /var/local/log/openvpn-status.log
log-append /var/local/log/openvpn.log
writepid /var/local/log/openvpn.pid
verb 3
crl-verify /etc/openvpn/keys/crl.pem
crw------- 1 root wheel 40, 1 Oct 13 19:52 /dev/tun1
The firewall rules contain the lines:
I have several client machines outside (one at my house, one in East Timor, and two in China) who all want to connect to the LAN (and use the shares on the nas and receive email from the exchange server) across the internet. Here's the config file for my machine:pass in on tun1 no state label "tun1_in"
pass out on tun1 no state label "tun1_out"
The external machines can reach the firewall, and /dev/tun1 changes its access times as it's accessed. /var/local/log/openvpn-status.log shows accesses appropriate to who's trying to access it eg:client
dev tun
dev-node tap-company
proto udp
remote incoming.company.com.au 1194
resolv-retry infinite
nobind
ca keys\\company\\\ca.crt
cert keys\\company\\fishcustard.crt
key keys\\company\\fishcustard.key
ns-cert-type server
comp-lzo
verb 4
# cat /var/local/log/openvpn-status.log
OpenVPN CLIENT LIST
Updated, Thu Oct 13 20:06:30 2011
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
fishcustard,192.168.100.100:1670,343908,454275,Thu Oct 13 14:42:34 2011
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
10.20.0.10,fishcustard,192.168.100.100:1670, Thu Oct 13 20:06:26 2011
GLOBAL STATS
Max bcast/mcast queue length,0
END
tcpdump -nS -i tun1 shows access every few seconds from 10.20.0.10 to 10.1.70.4 and back, including icmp packets. I can ping 10.1.70.4, but not cosbs (cosbs is the name of the sbs; .company.local is appended internally.)
So, I can connect from outside, and get a valid IP address. I can't access any of the nas shares (the nas is called nas1 and is on 10.1.70.5) or the email server.
I can post the output of the tcpdump command, or the logs of either the server or clients (or both) if they'll help.
Any suggestions?
