0

I have setup a OpenVPN server on a server in the office for people to VPN into. They can hit any host on the office network just fine but if they try to access our datacenter on another subnet nothing happens. I believe it is on the access-list of the cisco router but cannot figure it out.

Office LAN: 192.168.71.0/24
DataCenter Lan: 192.168.100.0/24
OpenVPN Server: 192.168.71.15
VPN LAN: 192.168.61.0/24
Office Router IP: 192.168.71.1

So when a client is connected their routing table looks like

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.61.5    0.0.0.0         255.255.255.255 UH    0      0        0 tun0
192.168.61.1    192.168.61.5    255.255.255.255 UGH   0      0        0 tun0
192.168.100.0   192.168.61.5    255.255.255.0   UG    0      0        0 tun0
192.168.71.0    192.168.61.5    255.255.255.0   UG    0      0        0 tun0
192.168.1.0     0.0.0.0         255.255.255.0   U     2      0        0 wlan0
0.0.0.0         192.168.1.1     0.0.0.0         UG    0      0        0 wlan0

A traceroute to the datacenter looks like

traceroute to 192.168.100.52 (192.168.100.52), 30 hops max, 60 byte packets
 1  192.168.61.1 (192.168.61.1)  18.851 ms  39.294 ms  39.297 ms
 2  192.168.71.1 (192.168.71.1)  39.287 ms  39.278 ms  39.269 ms
 3  * * *
 4  * * *
 5  * * *
 6  * * *
 7  * * *
 8  * * *
 9  * * *
10  * * *

Here is the route table on the openvpn server

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.61.2    0.0.0.0         255.255.255.255 UH    0      0        0 tun0
192.168.71.0    0.0.0.0         255.255.255.0   U     0      0        0 eth0
192.168.61.0    192.168.61.2    255.255.255.0   UG    0      0        0 tun0
192.168.122.0   0.0.0.0         255.255.255.0   U     0      0        0 virbr0
169.254.0.0     0.0.0.0         255.255.0.0     U     0      0        0 eth0
0.0.0.0         192.168.71.1    0.0.0.0         UG    0      0        0 eth0
0.0.0.0         0.0.0.0         0.0.0.0         U     0      0        0 eth0

So the packet seems to me to be making it to the office router

Here is my route config for the cisco router

ip route 0.0.0.0 0.0.0.0 216.173.2.217
ip route 10.1.168.0 255.255.255.0 192.168.71.5
ip route 10.100.1.0 255.255.255.0 192.168.72.5
ip route 192.168.61.0 255.255.255.0 192.168.71.15

And here is my access-list

access-list 1 remark CCP_ACL Category=2
access-list 1 permit 192.168.71.0 0.0.0.255
access-list 23 permit 10.10.10.0 0.0.0.7
access-list 100 remark CCP_ACL Category=4
access-list 100 permit ip 192.168.0.0 0.0.255.255 any
access-list 101 deny   ip any 192.168.0.0 0.0.255.255
access-list 101 deny   ip any 172.16.0.0 0.15.255.255
access-list 101 deny   ip any 10.0.0.0 0.255.255.255
access-list 101 permit ip 192.168.71.0 0.0.0.255 any
access-list 102 remark CCP_ACL Category=4
access-list 102 permit ip 192.168.71.0 0.0.0.255 any
access-list 103 remark CCP_ACL Category=4
access-list 103 permit ip 192.168.71.0 0.0.0.255 any
access-list 103 permit ip 192.168.100.0 0.0.0.255 any
access-list 120 permit ip 192.168.71.0 0.0.0.255 192.168.100.0 0.0.0.255
access-list 701 deny   0007.e917.876f   0000.0000.0000

Any help or pointers?

6
  • So based on what I see, if the client on the VPN needs to hit 192.168.100.x, it would be routed from their machine to 192.168.61.5. So what is that .61.5 address and does it know how to get to the 192.168.100.0 subnet? Sep 10, 2010 at 15:29
  • 61.5 is the openvpn ip.. that's the thing.. i have no idea how to tell it to get to 100.0
    – Mike
    Sep 10, 2010 at 15:35
  • Sorry, I'm not intimately familiar with the OpenVPN, but can't you just add a static route to it? Sep 10, 2010 at 15:37
  • I have tried.. but 100.0 is a site to site vpn and on the 71.0 side i cannot ping 100.1
    – Mike
    Sep 10, 2010 at 15:44
  • I'm sort of getting lost in the numbers here, if you'd like to contact me via email (mark at warpool . org), I'll be happy to try to help. Sep 10, 2010 at 15:53

1 Answer 1

0

I'm guessing that your Cisco router has two "legs": one for the Office LAN and one for the Data Center LAN.

Your packets from your VPN users are getting to your data center but they have no route back because the Cisco doesn't know that the Open VPN server is the router for the VPN LAN.

You need to add a route in the Cisco that tells it to route packets with a destination of 192.168.61.0/24 to 192.168.71.15, which, being the OpenVPN router, has a route to that network, and will in turn forward packets to the VPN host(s).

6
  • I need that on our datacenter side router right?
    – Mike
    Sep 10, 2010 at 16:32
  • Whats your "data center side router"? Is there more than one router between the Office and the Data Center?
    – gravyface
    Sep 10, 2010 at 16:42
  • its done by rackspace and its a site to site vpn connection. I believe its an ASA on their end 2600 series if I remember
    – Mike
    Sep 10, 2010 at 17:06
  • Ok, but your data center has a route to go to your office LAN, correct? i.e. you can hop on a box in the data center and ping a machine in your office LAN?
    – gravyface
    Sep 10, 2010 at 17:11
  • yes that is correct
    – Mike
    Sep 10, 2010 at 17:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .