0

I am having a problem getting my OpenVPN push route to work.

My setup is the following

Network

  • Homelan: 10.0.0.0/24 with
  • OpenVPN: 10.8.0.0/24
  • VPS in Internet

Servers (all Linux)

  • Server1: 10.0.0.13 + 10.8.0.1 (the OpenVPN Server)
  • Server2: 10.0.0.11 (DHCP+DNS)
  • VPS: Internet IP + 10.8.0.X (random IP from OpenVPN)

OpenVPN Server config

..snip..
push "route 10.0.0.0 255.255.255.0"
push "dhcp-option DNS 10.0.0.11"
..snip..

IP forward activated

cat /proc/sys/net/ipv4/ip_forward
1

Route VPS

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         www.xxx.yyy.1    0.0.0.0         UG    0      0        0 eth0
10.0.0.0        10.8.0.5        255.255.255.0   UG    0      0        0 tun0
10.8.0.0        10.8.0.5        255.255.255.0   UG    0      0        0 tun0
10.8.0.5        *               255.255.255.255 UH    0      0        0 tun0
www.xxx.yyy.1    *               255.255.255.255 UH    0      0        0 eth0

Route Server1

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         10.0.0.1      0.0.0.0         UG    0      0        0 eth0
10.0.0.0        *               255.255.255.0   U     0      0        0 eth0
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.8.0.2        *               255.255.255.255 UH    0      0        0 tun0

Try to ping the openvpn-server (10.8.0.1) from VPS

ping 10.0.0.13
ping 10.0.0.13 -I tun0;#gives same result

tcpdump of VPS

tcpdump -i tun0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 262144 bytes
19:05:22.049141 IP 10.8.0.6 > 10.8.0.1: ICMP echo request, id 17966, seq 1, length 64
19:05:22.101397 IP 10.8.0.1 > 10.8.0.6: ICMP echo reply, id 17966, seq 1, length 64

tcpdump server1

tcpdump -i tun0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 262144 bytes
18:05:22.064139 IP 10.8.0.6 > 10.8.0.1: ICMP echo request, id 17966, seq 1, length 64
18:05:22.064399 IP 10.8.0.1 > 10.8.0.6: ICMP echo reply, id 17966, seq 1, length 64
18:05:23.065687 IP 10.8.0.6 > 10.8.0.1: ICMP echo request, id 17966, seq 2, length 64
18:05:23.065886 IP 10.8.0.1 > 10.8.0.6: ICMP echo reply, id 17966, seq 2, length 64

What is not working is the connection from the VPS to the internal IP of Server 1

Try to ping the openvpn-server (10.0.0.13) from VPS

tcpdump of VPS

19:12:24.847216 IP vps.hoster.tld > 10.0.0.13: ICMP echo request, id 18136, seq 1, length 64 
19:12:25.876441 IP vps.hoster.tld > 10.0.0.13: ICMP echo request, id 18136, seq 2, length 64 
19:12:26.900408 IP vps.hoster.tld > 10.0.0.13: ICMP echo request, id 18136, seq 3, length 64 
19:12:27.924476 IP vps.hoster.tld > 10.0.0.13: ICMP echo request, id 18136, seq 4, length 64 
19:12:39.964724 IP vps.hoster.tld > 10.0.0.13: ICMP echo request, id 18137, seq 1, length 64 
19:12:40.980446 IP vps.hoster.tld > 10.0.0.13: ICMP echo request, id 18137, seq 2, length 64 

tcpdump of Server1

#stays empty

So I am really wondering what is wrong here. What would be the next step to find out what is blocking my traffic from the VPS to the internal IPs of 10.0.0.0/24 ? Maybe a firewall in the homelan is blocking the traffic? How to find out?

  • Show the 'iptables -L INPUT -n' and 'traceroute 10.0.0.13'. – Yurij Goncharuk Feb 11 '18 at 14:26
0

Reaching Internal Interface, No Routing
By default Linux will respond to any of its IPs on any interface, it will even respond to ARP requests on the "wrong" interface. This is super insecure, so most firewalls will block this behavior using iptables and proc/arp_filter.

You may have firewall rules that block routing in:
server1> iptables -L -n -v
server1> iptables -t nat -L -n -v

server1> iptables -A FORWARD -j LOG will log(dmesg) all packets that are routed between the 10.8 and 10.0 through server1. It might give you some info.
$server1> iptables -D FORWARD -j LOG to remove the rule.

The following will insert routing rules before any firewall rules.
server1> echo 1 > /proc/sys/net/ipv4/ip_forward
server1> iptables -I FORWARD 1 --in-interface tun0 --source 10.8.0.0/24 -j ACCEPT
server1> iptables -I FORWARD 1 --in-interface eth0 --source 10.0.0.0/24 -j ACCEPT

I wouldn't expect VPS> ping 10.0.0.11 to work, but if it does the problem is almost certainly in server1's iptables.

You are routing through server1 on a point to point, so it shouldn't be doing ARP, but if either of these are set to 1 it was probably done by a firewall script and the problem will be in server1's iptables.
server1> cat /proc/sys/net/ipv4/conf/all/arp_filter
server1> cat /proc/sys/net/ipv4/conf/tun0/arp_filter

Routes
Your routes look good, but with this setup you don't need the 10.8.0.0/24 ones in there. 10.8.0.1 to 10.8.0.5 is point-to-point.

VPS should have a default gw, 10.8.0.1 via tun0, and 10.0.0.0/24 via gw 10.8.0.1.
server1 should have a default gw and 10.8.0.5 via tun0, and 10.0.0.0/24 via eth0.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.