1

I am trying to connect two networks together by using a pair of CentOS 7 systems running OpenVPN.

I have a "server" side that has two networks behind it, and a "client" side that has a single network. The basic openvpn connection is up, but I think I have something wrong with the routing or the firewalld config.

The OpenVPN is a pool on 10.8.0.0/24. The server has networks 10.254.1.0/24 and 10.255.1.0/24 behind it; the client has 10.255.0.1 behind it.

The server pushes these routing options in server.conf:

# Push any routes the client needs to get in
# to the local network.
push "route 10.254.1.0 255.255.255.0"
push "route 10.255.1.0 255.255.255.0"

These show up correctly in the client's routing table:

10.8.0.1 via 10.8.0.5 dev tun0
10.8.0.5 dev tun0  proto kernel  scope link  src 10.8.0.6
10.254.1.0/24 via 10.8.0.5 dev tun0
10.255.0.0/24 dev enp6s4f0  proto kernel  scope link  src 10.255.0.1  metric 100
10.255.1.0/24 via 10.8.0.5 dev tun0

...and on the server side I have manually set up an appropriate route:

10.8.0.0/24 via 10.8.0.2 dev tun0
10.8.0.2 dev tun0  proto kernel  scope link  src 10.8.0.1
10.255.0.0/24 via 10.8.0.2 dev tun0

...and the client gateway can in fact ping devices deeper in the server's network:

[root@sentry openvpn]# ping -c 1 10.254.1.10
PING 10.254.1.10 (10.254.1.10) 56(84) bytes of data.
64 bytes from 10.254.1.10: icmp_seq=1 ttl=63 time=300 ms

...but I can't ssh to it.

# ssh dave@10.254.1.10
ssh: connect to host 10.254.1.10 port 22: No route to host

...so, I think it might be a firewall problem.

On both sides I've added the tun interface to my internal zone.

On the client side:

# firewall-cmd --info-zone="internal"
internal (active)
  target: default
  icmp-block-inversion: no
  interfaces: enp6s4f0 tun0
  sources:
  services: dhcp dhcpv6-client dns http mdns mosh samba-client snmp ssh syslog
  ports: 8000/tcp
  protocols:
  masquerade: no
  forward-ports:
  sourceports:
  icmp-blocks:
  rich rules:

...and the server:

# firewall-cmd --info-zone="internal"
internal (active)
  target: default
  icmp-block-inversion: no
  interfaces: ens161 ens256 tun0
  sources:
  services: dhcpv6-client mdns samba-client snmp ssh
  ports:
  protocols:
  masquerade: no
  forward-ports:
  sourceports:
  icmp-blocks:
  rich rules:

Now, on the server in order to get the two internal networks to talk to each other, I had to add direct iptables rules:

firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i ens256 -o ens161 -j ACCEPT
firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i ens161 -o ens256 -j ACCEPT

...so I've done the same thing for the openvpn network:

firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i ens256 -o tun0 -j ACCEPT
firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -o ens256 -i tun0 -j ACCEPT
firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i ens161 -o tun0 -j ACCEPT
firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -o ens161 -i tun0 -j ACCEPT

...and on the client:

firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i enp6s4f0 -o tun0 -j ACCEPT
firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -o enp6s4f0 -i tun0 -j ACCEPT

...so clearly I either don't understand how the routing is supposed to work, or I'm missing something on the firewalld side.

Can anyone tell me what I'm missing?

  • Have you checked with tcpdump if the requests coming from the VPN leave the interfaces ens161 and ens256 or the traffic stops on the tun0? – DarkVex May 22 '17 at 21:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.