Site to site VPN can ping but no connection to services
Posted: Sun Jul 26, 2020 1:43 am
Hi,
Looking for some expert help here please. Sorry if this has already been answered but I have spent hours googling and although there are quite a few results that seem to be my issue on the surface, the details aren't the same. I did find something that suggested the MTU might be to blame, but I haven't adjusted that from the defaults and I suspect there is a more fundamental explanation.
I set up my first site to site VPN using OpenVPN and was excited when I could ping hosts on the other side. It didn't last long as I discovered that nothing other than ping worked. Things like RDP, SSH and HTTP. These things do work locally host-to-host on the remote network so I know they are not refusing connections. Also I can access them via a SSH tunnel / port forward so it's all pointing to something being wrong with my VPN config.
The open access server in my case is at the remote location (remote from my perspective) but to avoid confusion I'll refer to the server side as local and the client side (my house) as remote.
The setup:
The entire local network including the access server is virtual, hosted on Proxmox Virtual Environment (PVE).
There is one public IP on the PVE host and all the VMs are on a private subnet. Access to the internet is via NAT. Incoming connections via port forwarding from the PVE host. I used a pre-built access server VM downloaded from OpenVPN. The remote side is a typical home network with a private local net behind NAT, only in my case there's an extra layer of NAT because I'm using a pfSense router and my ISPs router can't be put in bridge mode. It doesn't seem to cause any issues (unless it's the cause of this one). The OpenVPN client is on a CentOS 8 server in my home on the private network. Routing is done on PVE and pfSense.
I followed this guide to set it all up:
https://openvpn.net/vpn-server-resource ... te-to-site
Something I found puzzling with that "how-to" is that it never mentioned the WAN IP address of the router where the access server is. How can the client connect if it doesn't know where in the internet the server is? Anyway I got that sorted.
Long story short I have it successfully connecting. The client server can ping the access server and vice versa. Hosts on the remote network (client side) can ping the access server and any host on the local network (server side). Hosts on the local network can ping the client server, but not hosts on the client network. I'm not sure if this is related to the problem or if it's a separate issue.
Local site private subnet is 10.0.1.0/24
Local site gateway/router is 10.0.1.1
Local site OpenVPN access server is 10.0.1.5
Remote site private subnet is 10.0.2.0/24
Remote site gateway/router is 10.0.2.1
Remote site OpenVPN client "server" is 10.0.2.5
VPN tunnel subnet is 172.27.224.0/20, automatically generated by the access server during setup.
traceroute to host on local net from host on remote net (looks good):
traceroute to host on remote net from host on local net (this may the problem, ping also fails):
Static routes on pfSense (remote site):
Relevant static routes and port forwards on PVE (local site):
Any suggestions how to start troubleshooting this?
Thanks!
Looking for some expert help here please. Sorry if this has already been answered but I have spent hours googling and although there are quite a few results that seem to be my issue on the surface, the details aren't the same. I did find something that suggested the MTU might be to blame, but I haven't adjusted that from the defaults and I suspect there is a more fundamental explanation.
I set up my first site to site VPN using OpenVPN and was excited when I could ping hosts on the other side. It didn't last long as I discovered that nothing other than ping worked. Things like RDP, SSH and HTTP. These things do work locally host-to-host on the remote network so I know they are not refusing connections. Also I can access them via a SSH tunnel / port forward so it's all pointing to something being wrong with my VPN config.
The open access server in my case is at the remote location (remote from my perspective) but to avoid confusion I'll refer to the server side as local and the client side (my house) as remote.
The setup:
The entire local network including the access server is virtual, hosted on Proxmox Virtual Environment (PVE).
There is one public IP on the PVE host and all the VMs are on a private subnet. Access to the internet is via NAT. Incoming connections via port forwarding from the PVE host. I used a pre-built access server VM downloaded from OpenVPN. The remote side is a typical home network with a private local net behind NAT, only in my case there's an extra layer of NAT because I'm using a pfSense router and my ISPs router can't be put in bridge mode. It doesn't seem to cause any issues (unless it's the cause of this one). The OpenVPN client is on a CentOS 8 server in my home on the private network. Routing is done on PVE and pfSense.
I followed this guide to set it all up:
https://openvpn.net/vpn-server-resource ... te-to-site
Something I found puzzling with that "how-to" is that it never mentioned the WAN IP address of the router where the access server is. How can the client connect if it doesn't know where in the internet the server is? Anyway I got that sorted.
Long story short I have it successfully connecting. The client server can ping the access server and vice versa. Hosts on the remote network (client side) can ping the access server and any host on the local network (server side). Hosts on the local network can ping the client server, but not hosts on the client network. I'm not sure if this is related to the problem or if it's a separate issue.
Local site private subnet is 10.0.1.0/24
Local site gateway/router is 10.0.1.1
Local site OpenVPN access server is 10.0.1.5
Remote site private subnet is 10.0.2.0/24
Remote site gateway/router is 10.0.2.1
Remote site OpenVPN client "server" is 10.0.2.5
VPN tunnel subnet is 172.27.224.0/20, automatically generated by the access server during setup.
traceroute to host on local net from host on remote net (looks good):
Code: Select all
C:\Users\grace>tracert -d 10.0.1.20
Tracing route to 10.0.1.20 over a maximum of 30 hops
1 1 ms 2 ms <1 ms 10.0.2.1
2 1 ms 1 ms 1 ms 10.0.2.5
3 340 ms 317 ms 316 ms 172.27.232.1
4 319 ms 316 ms 316 ms 10.0.1.20
Trace complete.Code: Select all
[grace@web1 ~]$ traceroute -n 10.0.2.101
traceroute to 10.0.2.101 (10.0.2.101), 30 hops max, 60 byte packets
1 10.0.1.5 0.768 ms 0.714 ms 1.513 ms
2 172.27.232.4 320.923 ms 320.950 ms 321.052 ms
3 172.27.232.4 321.181 ms !X 321.503 ms !X 321.580 ms !X
[grace@web1 ~]$Code: Select all
Network Gateway
10.0.1.0/24 10.0.2.5
172.27.224.0/24 10.0.2.5Code: Select all
# Routes required for OpenVPN server vpn2
post-up ip route add 172.27.224.0/20 via 10.0.1.5
pre-down ip route del 172.27.224.0/20 via 10.0.1.5
post-up ip route add 10.0.2.0/24 via 10.0.1.5
pre-down ip route del 10.0.2.0/24 via 10.0.1.5
# Port TCP 9443(443) and UDP 9194(1194) to vpn2
post-up iptables -t nat -A PREROUTING -i vmbr0 -p tcp --dport 9443 -j DNAT --to 10.0.1.5:443
post-down iptables -t nat -D PREROUTING -i vmbr0 -p tcp --dport 9443 -j DNAT --to 10.0.1.5:443
post-up iptables -t nat -A PREROUTING -i vmbr0 -p udp --dport 9194 -j DNAT --to 10.0.1.5:1194
post-down iptables -t nat -D PREROUTING -i vmbr0 -p udp --dport 9194 -j DNAT --to 10.0.1.5:1194Thanks!
