1

I am trying to set up a Site-to-Site VPN using Openvpn , Initial setup has been completed , My openvpn Client side nodes (201.100.0.x) are able to communicate to the openvpn Server side nodes (192.0.0.x) .

But If I ping to any client node (201.100.0.18) from a server side node (192.0.0.32) , I am not getting reply , (I have proper route added on the endpoints) . And I can see the ping replays reaching up to my openvpn server by analysing with TCP dump .

Serverside node: 192.0.0.32 (eth0)

Server: 192.0.0.39 (eth0) ; 10.8.0.1 (tun0)

Clientside node : 201.100.0.18 (eth0)

OpenvpnClient :201.100.0.11 (eth0) ; 10.8.0.6 (tun0)

server node> ping 201.100.0.18 -c 1
 PING 201.100.0.18 (201.100.0.18) 56(84) bytes of data.
 --- 201.100.0.18 ping statistics ---
 1 packets transmitted, 0 received, 100% packet loss, time 10000ms

Here is the TCP dump form eth0 of openvpn server

vpnserver>  tcpdump -nni eth0 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
09:41:00.796021 IP 192.0.0.32 > 201.100.0.18: ICMP echo request, id 47432, seq 1, length 64
09:41:00.836637 IP 201.100.0.18 > 192.0.0.32: ICMP echo reply, id 47432, seq 1, length 64

Ping reply came back till 192.0.0.32 but it is not getting forwarded to 192.0.0.39 ; need to know why

IP forwarding already enabled And you can see existing firewall rules below

    *filter
:INPUT ACCEPT [397:39519]
:FORWARD ACCEPT [6:504]
:OUTPUT ACCEPT [362:40521]
-A FORWARD -i tun0 -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i tun0 -o eth0 -j ACCEPT
COMMIT
# Completed on Thu Nov  3 09:45:05 2016
# Generated by iptables-save v1.4.7 on Thu Nov  3 09:45:05 2016
*nat
:PREROUTING ACCEPT [31:3889]
:POSTROUTING ACCEPT [22:1848]
:OUTPUT ACCEPT [6:504]
-A POSTROUTING -o eth0 -j MASQUERADE   << before adding this rule client sides nodes were not able to access server side nodes
COMMIT
  • Ever found a solution, Shan? I believe I have the same problem. I suspect --state RELATED,ESTABLISHED doesn't include ping started from an internal network, but don't know how to solve it. – jcoppens Dec 4 '17 at 2:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.